agents.txt 0.1 is the robots.txt for agent actions

agents.txt 0.1 is published: a normative spec, an npm package (agents-txt 0.1.1, MIT, Node 20 or later) and a live example at dekimu.com/agents.txt. robots.txt tells a crawler what it may fetch and llms.txt tells a model what it may read; neither says anything about the verb that matters now, which is acting. agents.txt is the missing policy layer: two files at a site's origin that tell an autonomous agent what it may attempt, under what conditions, and what verifiable proof results.

Two files, one policy

The first file is /agents.txt, the human-readable stub. It is line-oriented like robots.txt: lines starting with # are comments, lines starting with > are prose, everything else is a Key: value directive. Two directives are required, Policy: (the URL of the machine-readable document) and Contact: (an email or URL for agent-related queries); Verify: optionally names the base URL of the receipt verifier for that surface. Unknown directives are ignored, so the format can grow without breaking old parsers.

The second file is /.well-known/agent-policy.json, the one a machine reads. It is a schema-validated, versioned capability descriptor: who the issuer is, the default posture (deny), a contact, a verifier, and a list of capabilities. Each capability has an id, a description, a door (its type and URL, an MCP endpoint for example), an auth requirement and a risk tier. A conforming parser must reject a document with unknown top-level keys. Strict parse, fail closed: a policy that does not validate is treated as no policy at all.

The package and the CLI

npm i agents-txt gives you four functions. parseAgentPolicy validates a policy object and returns an ok/error result rather than throwing. fetchAgentPolicy discovers a surface's policy by fetching /agents.txt, following the Policy: URL and validating the JSON, and returns null on any failure. buildAgentPolicy produces a typed policy object and throws if the result would not validate. renderAgentsTxt writes the stub for you. The only runtime dependency is zod.

The CLI is one command: npx agents-txt validate https://example.com follows the two files on a live origin, and npx agents-txt validate path/to/agent-policy.json checks a local file. It exits 0 on success, 1 on an invalid or missing policy and 2 on bad usage, so it drops straight into CI. For a one-off check without installing anything, the browser validator at dekimu.com/tools/agents-txt-validator does the same walk from a pasted URL.

dekimu.com publishes its own

dekimu.com serves both files. The stub points to dekimu.com/.well-known/agent-policy.json, names security@dekimu.com as the contact and verify.dekimu.com as the verifier. The policy document is version 0.1, default deny, and its capabilities list is currently empty. That is the honest state of the site today: unlisted actions are denied and nothing is listed yet. The door that will list capabilities is Dekimu Hub's gated capability door, which is fail-closed and off by default until the binding between credential, action and receipt is exactly right.

A policy an agent cannot parse is a policy it cannot respect. Two files, strict parse, deny by default.

The honesty box in the README is short. v0 declares policy; it does not verify credentials. auth: credential on a capability means a credential is required, not that one was checked. The package issues nothing, verifies nothing and enforces nothing at runtime, by design: it is zero-crypto. Enforcement belongs to the surface's gate. For Dekimu that gate is Hub, which issues scoped agent credentials, enforces the risk tier and emits independently verifiable receipts. agents.txt also does not replace robots.txt or llms.txt; a conforming agent respects all three.

Open source at Dekimu

Everything Dekimu publishes as open source now lives on one page, dekimu.com/open-source: the Anchored Receipts specification (anchors-spec, CC0) and the append-only anchors-trusted-issuers-chain, the dekimu-mcp server and the agents.txt package on npm, regulation-as-code (legal obligations as typed predicates over an evidence corpus), and claude-memory (decaying file-based memory for Claude Code). All of it is MIT, Apache-2.0 or CC0; all of it interoperates with Dekimu Hub as the reference implementation; and verify.dekimu.com is the public verifier for the receipts Hub issues.