Signed agent policy
Crazy Monkeys is a CI-native end-to-end QA agent used only on sites the customer has authorized or that we operate. Purpose is benign value-delivery validation of preview and production environments. We do not perform credential stuffing, excessive scraping, scalping, DDoS, or other abusive activity. We respect robots.txt and crawl directives, keep request rates within per-run budgets, and do not use the agent as a general-purpose web crawler. We affirm compliance with Cloudflare's Signed Agents Policy.
Key directory
https://crazymonkeys.ai/.well-known/http-message-signatures-directory
User-Agent strings
CrazyMonkeys-QA/1.0CrazyMonkeys (+https://crazymonkeys.ai)CrazyMonkeys
CrazyMonkeys is the substring match for allow rules.
Contact
bots@crazymonkeys.ai
Customer WAF snippet
After Cloudflare lists the signed agent, customers can allow it with a rule like:
(http.user_agent contains "CrazyMonkeys") or (http.request.headers["signature-agent"][0] contains "crazymonkeys.ai")
Playwright explore signs outbound http and https requests with HTTP Message Signatures when CM_WEB_BOT_AUTH_PRIVATE_KEY is configured. The default stealth Chrome User-Agent includes CrazyMonkeys-QA/1.0; solver-supplied User-Agents are left unchanged. Operator Chrome (Secondary) is not Playwright-signed in this release.