Description
ARPP, the Agent Rights and Provenance Protocol, is published by LLMBOO as an alternative to robots.txt for stating what an AI agent may do with a page. Where robots.txt is an unsigned text file that says nothing about retrieval, training, attribution, or commercial use, and that anyone can forge a copy of, ARPP is a cryptographically signed statement of rights bound to the exact bytes a publisher actually served.
Read More
A publisher signs a rights manifest, covering licence, retrieval, training, commercial use, attribution, and expiry, using an Ed25519 key. The manifest is bound to a SHA-256 digest of the served content, so any change to the page invalidates the signed claim. It rides over plain HTTPS using a standard RFC 8288 Link header, so no new scheme, port, or crawler is required. An agent that reads a manifest can optionally send back a receipt referencing that manifest; LLMBOO states receipts store only six fields (an id, the manifest digest, the agent's URL, its stated purpose, and issue and arrival times), contain no personal data, and are deleted after 90 days.
LLMBOO is explicit about the protocol's limits: ARPP is not DRM and does not block, encrypt, or restrict anything; a receipt only proves its issuer made a record, not that the agent obeyed the stated policy; it is not legal advice or a licence agreement; and it is not an IANA-registered media type, since the current type is private to this release pending further deployments.
The protocol was initiated by Piruz Afruz MB in Lithuania and published as an open specification. It was released as PARP and renamed ARPP as of September 2026; existing /parp paths on adopting sites continue to work as migration aliases. The current release is spec v0.1.0 with publisher adapters (arpp-integrations v1.0.1) for Node, PHP, .NET, and Shopify, plus free plugins for WordPress and OpenCart that publish a signed manifest automatically. LLMBOO runs ARPP in production on its own site and says it is looking for a second independent implementer, since two deployments with published interoperability evidence are its stated bar before proposing a neutral media type to IANA.
- CategoryAI Privacy Tools
- Pricing ModelFreemium
- DeploymentCloud
- PlatformsWordPress, OpenCart
ARPP's Core Features
Lets a publisher sign a rights manifest covering licence, retrieval, training, commercial use, attribution, and expiry
Binds the signed manifest to a SHA-256 digest of the exact content served
Uses Ed25519 signatures over canonical JSON so re-serialized manifests cannot silently change meaning
Rides over plain HTTPS with a standard RFC 8288 Link header, needing no new scheme or port
Lets an agent send an optional, privacy-limited receipt referencing the manifest it read
Publishes the public verification key separately from the manifests it signs
Ships free WordPress and OpenCart plugins that publish a signed manifest automatically
Provides starter adapters for Node, PHP, .NET, and Shopify
How to use ARPP?
Generate a key: Create an Ed25519 keypair and publish the public half as JWK at a stable URL.
Sign a manifest: Set the licence, the four use permissions, the content digest, and an expiry per resource.
Serve and advertise it: Publish the manifest and reference it with a Link header on the resource.
Accept receipts (optional): Turn on the receipt endpoint if you want agents to report back.
Or use a plugin: Install the free WordPress or OpenCart plugin to publish ARPP automatically.
ARPP's Use Cases
- Publisher AI-rights signaling
- AI training opt-out
- E-commerce content protection
- Agent compliance receipts
