For a small WooCommerce store, being visible to an AI shopping agent depends on a chain of ordinary infrastructure: the store’s catalog API, its security settings and the network that reads it. When one link interrupts access, the merchant can disappear from discovery even while the storefront itself remains open.
Our catalog indexing bot, KalicartGlobalBot, now appears as a verified bot in Cloudflare’s public Bots Directory. The listing identifies KaliCart as its operator, describes its purpose as indexing catalogs of WooCommerce stores that opted in through KaliCart Bridge, and classifies its access as Direct.
A name that can be verified
A user-agent string is only a claim: any client can type a bot’s name into a request header. KalicartGlobalBot uses Web Bot Auth, which adds cryptographic HTTP signatures so a supporting service can verify the bot’s identity.
Verification helps site owners distinguish our requests from impersonators. It does not grant universal access or bypass every security rule. Site owners still choose their policies, and merchant consent remains a prerequisite for joining the KaliCart network.
What we observed in one store
One participating store’s REST API was blocked for several weeks by a security challenge. During that period, KaliCart continued to make its catalog discoverable through verified, freshness-bounded snapshots supplied by the merchant’s Bridge plugin. The snapshot preserved catalog discovery; the live store remained authoritative for purchases and final availability.
After the bot’s approval, we observed the store returning naturally to REST access. We did not need to force a new request cycle to make that happen. This is one observed case, not a promise that verification will remove every challenge for every store.
The experience also explains why we built two complementary safeguards. A verifiable bot identity can help the live path work as intended. Catalog continuity through verified snapshots protects discovery when the live path is temporarily unavailable. REST remains the normal source whenever it is healthy.
What this means for merchants
- Participation stays opt-in. KaliCart indexes catalogs from stores that have chosen to join through KaliCart Bridge.
- The bot is identifiable. The public directory states who operates it and why it accesses catalogs; Web Bot Auth supports cryptographic verification of its requests.
- Continuity has limits. Snapshots are verified and bounded by consent and freshness. They do not replace the merchant’s live checkout, payment or final stock information.
Independent stores need both reliable access and control over that access. The directory listing is a useful public checkpoint in that work: merchants and security operators can inspect our bot’s identity and purpose, while the store remains in charge of its own policies.