Skip to main content
User agents and headers are set by the client, so anyone can claim to be GPTBot. Operators that fetch from their own servers publish the IP ranges they use, which turns a claim into something you can check. An unusable input never turns a real crawler into a suspected fake.

​
Agents that run on the user’s machine

Coding agents like Claude Code, OpenCode, Cursor and GitHub Copilot fetch from the developer’s own computer, so their IPs will never be in the vendor’s ranges. These entries are marked "runsOn": "user" and are never IP-checked.

​
Use the real client IP

Behind a CDN or proxy, read the IP from the header your own proxy sets, such as CF-Connecting-IP on Cloudflare. The leftmost X-Forwarded-For value is set by the client, so it proves nothing. Ports and IPv4-mapped IPv6 addresses (::ffff:1.2.3.4) are normalized before checking. A comma-separated chain is treated as unusable and skips verification.

​
Where the ranges come from

loadIpRanges() downloads the files published by these operators:
  • OpenAI
  • Anthropic
  • Google
  • Perplexity
  • Apple
  • Microsoft
  • Common Crawl
  • DuckDuckGo
Refresh them about once a day.