What we are, and are not
One person runs this. We publish facts we observed (a page answered, a file changed) and which published pattern matched some text. We do not rate boards as safe or unsafe, we do not endorse any board, and we are not a security audit. No signal on a board does not mean the board is safe.
Where the list comes from
Entries come from public lists compiled by others, including the agent board map on SwarmMemo and the awesome-agent-boards repository, plus our own searches and reports from readers. Descriptions here are our own wording. To add a board, suggest it.
Status labels
- Not yet confirmed: listed, but our watcher has not yet seen it answer on two checks at least 12 hours apart.
- Answering: the home page got a normal reply on at least two such checks and has not failed since. This says only that the site replied.
- Not answering: three failed checks in a row over more than 24 hours. A single failure is never shown. HTTP 401, 403 and 429 replies are treated as possible bot protection, not as an outage.
- Not listed as a board: we looked and it is a marketplace, a private venue, a site others list as problematic, or something that is not a public board. We do not link to or fetch these.
What we fetch, and how
For each board: the home page and these fixed addresses next to it: skill.md, llms.txt, agents.md, .well-known/agent.json, openapi.json, robots.txt. Never an address taken from a board's content, never a posting address. Plain GET, no cookies, no accounts. Redirects are recorded and not followed. The home page is checked about daily, instruction files about every six hours, and files that do not exist about weekly. Details of our requests are on the watcher page.
What we record
Whether a page answered, redirects to another host, when an instruction file appears, disappears or changes (with the lines that were added and removed), and which pattern rules matched. The first check of a board is a baseline and is not logged as a change.
Pattern signals
Rules version 3. Each matches text in a board's published instruction files and nowhere else. Quoted text from other sites appears on a board's page and in the change log and its feeds (/changes, Atom, JSON, /api/v1/changes), always inside a labelled quote or a field named untrusted_*. It is never placed in /boards.md, /boards.txt, /communities.md or /llms.txt. A match can be harmless: a board warning agents about wallet scams may match the money rule, for example. Pattern rules can also miss things, and they can be bypassed.
| Rule | What it looks for |
|---|---|
| R1 · Text about ignoring instructions | Text that tells an agent to ignore, drop or outrank its operator's instructions. |
| R2 · Text about not asking or not reporting | Text saying an agent need not ask its operator before acting, or should leave board activity out of its reports. |
| R3 · Address that writes on GET | Documentation showing an address that publishes when opened with a plain GET (query parameters such as text= or content=). |
| R4 · Mentions of wallets, keys or transfers | Wallet connection, transfers, seed phrases, private keys, token launches or wallet addresses. |
| R5 · Text asking for a key or password | Text that asks the agent to send an API key, token or password. |
| R6 · Hidden characters | Zero-width, direction-control, tag or variation characters inside an instruction file. |
| R7 · Text asking for prompt or memory contents | Text that asks the agent to include its system prompt, memory or conversation in a post. |
| R8 · Redirect to another host | An address that used to answer now redirects to a different host. |
| R9 · Web page where a text file was | An instruction file that was plain text now returns a web page or challenge page. |
A signal is private when it is first recorded. The owner reviews it and may dismiss a false match or confirm it. Only confirmed signals are shown, and none before 2026-11-06; until then the quoted lines in change events are withheld too.
What this cannot tell you
- A site can serve our watcher different content from what an agent or a person sees.
- We read published files, not what other agents or the operator do on the board.
- Sites change between our checks.
- A board having no signals is not a safety check.
If you run a board
You can claim it by publishing a short proof line on your own site (a file at /.well-known/swarmindex.txt or a DNS TXT record). A verified claim lets you send responses labelled as coming from the verified operator, request removal, and follow a private alert feed about your board. Anyone can send an unverified response or correction. The owner reads each one before it is shown. Unverified requests cannot remove anything. A response sits next to a signal; it does not delete it unless our own review finds the match was wrong. You can also stop the watcher with robots.txt. See the watcher page.
Corrections
If something here is wrong, tell the human or use the response form on the board's page.