# ai

> openwaf-cloud ctl ai commands for AI crawler and agent reports, MCP Shield, the AI bot catalog and agent readiness scans.

To change the AI agents settings of a zone or a name, use [`zones set`](https://developers.openwaf.dev/cli/reference/zones/#zones-set) with the `ai_agents.*` keys.

## ai report

```text
ai report <zone> [--host <name>] [--range 24h|7d|30d] [--view <view>] [--bot <id>] [--category <c>] [--kind <k>] [--limit N] [--json]
```

How AI agents and crawlers use the zone.

| Option | Meaning |
|---|---|
| `--host <name>` | Only this name of the zone. |
| `--range` | Period up to now: `24h` (default), `7d` or `30d`. |
| `--view` | What to show (below). Default `overview`. |
| `--bot <id>` | Only this bot of the catalog. Required with `--view spoofers`. |
| `--category <c>` | Only this category: `ai_training`, `ai_search`, `ai_user_agent`, `search_engine`, `unverified_automation`, `spoofed` or `human`. |
| `--kind <k>` | With `--view events`: only these event kinds, comma-separated. |
| `--limit N` | With `--view events`: at most N events (maximum 500). |

| View | Shows |
|---|---|
| `overview` | Requests per category and decisions, compared with the previous period. |
| `crawlers` | Each bot with its operator, category, requests (allowed, unsuccessful, verified, spoofed), bursts and the action applied. |
| `spoofers` | Requests that claim to be a bot without being it (needs `--bot`): addresses, countries and networks. |
| `optimization` | Content retrievals for AI answers, the pages AI asks for most and the requests for pages that do not exist. |
| `signals` | `robots.txt` requests per name with their status and whether they carry content signals, and the bots that ignore `robots.txt`. |
| `traps` | How often the trap link was injected and followed, and who followed it. |
| `bursts` | Bursts of agent requests (many endpoints in seconds, id enumeration, paging) and who sent them. |
| `endpoints` | AI endpoints with their requests, injections, limited, blocked and would-be blocked requests, and the detections. |
| `events` | The latest individual events: time, kind, bot, category, decision, address, name, path and status. |

```sh
openwaf-cloud ctl ai report example.com --range 7d --view crawlers
openwaf-cloud ctl ai report example.com --view spoofers --bot gptbot
openwaf-cloud ctl ai report example.com --view events --kind mcp_injection_response,mcp_dlp --limit 50
```

## ai mcp

```text
ai mcp <zone> [--host <name>] [--range 24h|7d|30d] [--json]
```

MCP Shield: per MCP endpoint, its requests, JSON-RPC messages, blocked (or would-be blocked) messages, messages with detections and responses that passed uninspected; per tool, its calls, blocks and detections.

```sh
openwaf-cloud ctl ai mcp example.com --range 7d
```

## ai catalog

```text
ai catalog [--json]
```

The AI bot catalog the edge verifies against: each bot's id, name, operator, category, verification methods and published address ranges.

## ai readiness

```text
ai readiness <zone> [--host <name>] [--scan] [--json]
```

How ready a name is for AI agents (robots.txt AI rules and content signals, sitemap, `llms.txt`, markdown, structured data…), from its latest scan.

| Option | Meaning |
|---|---|
| `--host <name>` | Only this name. |
| `--scan` | Scan now. Needs the Tech role; at most once per name and minute. |