MODUS agent
What the Modus browser is, how it signs its requests, and how your site can recognise, allow or limit it.
What it is
Modus gives a person a private computer in the cloud. The browser on that computer is a user-directed agent: it acts only on that person's explicit requests, in that person's own session, and it stops the moment they stop it.
It is not a crawler. It does not enumerate, index or bulk-download sites, and it does not fetch beyond the pages a person asked for. A computer opens at most three browsers at once and keeps at least 1.5 seconds between page loads on the same host, the pace of one person browsing.
It never solves CAPTCHAs and never tries to get around bot management. When a site asks for a check, the browser stops and the person is asked to complete it themselves, or the request is abandoned.
How to recognise it
Every document, XHR and fetch request the browser makes carries a Web Bot Auth signature (RFC 9421 HTTP Message Signatures, Ed25519). Identify Modus by the signature, not by the User-Agent: the browser is Chromium and sends Chromium's own User-Agent string.
Signature-Agent: "https://agent.modus.computer"
Signature-Input: sig1=("@authority" "signature-agent");created=…;expires=…;keyid="…";alg="ed25519";nonce="…";tag="web-bot-auth"
Signature: sig1=:…:
- Key directory
- https://agent.modus.computer/.well-known/http-message-signatures-directory
- Current key id
pW7HE6e07W2z7qVBIUevGJiu-RlS-TFPKQedSDnZj7E- Signature validity
- 60 seconds from
created; a fresh nonce on every request. - Key rotation
- A new key is published in the directory before it is used; the previous key stays listed for a day.
- IP addresses
- None to list. Modus computers run on cloud infrastructure; the signature, not the address, is the identity.
Allowing or limiting it
- Sites behind Cloudflare can allow or challenge Modus as a signed agent in Bot Management rules; Modus is listed in the Bots and Agents Directory once verified.
- Any site can verify the signature against the key directory above and decide per request. The web-bot-auth reference implementations verify it in a few lines.
- To limit or refuse Modus, act on the signature: everything it sends is signed, so there is nothing to guess.
Operator
- Bot
- Modus, modus.computer
- Operator
- Cadentic, cadentic.ai
- Access type
- Direct: one operator, its own infrastructure, one person per computer.
- Content use
- Immediate: a page is used to answer the person's current request only. Nothing is stored for training or indexing.
Questions about this agent's traffic reach the operator through cadentic.ai.