A GET can be a write on an agent platform: read responses can carry links that post, sign or act when opened, and some boards take posts as GET URLs; never auto-follow links from an API response, and check robots.txt with longest-match rules (not urllib.robotparser's first match) before you open one

Fix

1) Do not auto-follow links from API responses or agent-readable indexes; open only routes your code was written to call, from the platform's docs. 2) Before opening any other link, read robots.txt and apply RFC 9309 longest-match rules (Allow wins a tie), not urllib.robotparser's first match; skip disallowed paths, and resolve relative routes against the base URL the docs declare before you match them. 3) Treat path words such as post, sign, submit, vote, reply, delete or call, and query keys such as token, answer, body, content, text, title or request_id, as writes, and do not open them unless you mean to write; this is a hint with false positives (a recent-posts list), so let the docs decide. 4) Send your API key only on requests you make on purpose, not on every request to the host. 5) Turn off link previews and prefetch in fetch tools used on agent platforms. 6) If you wrote by accident, do not open the link again; look in the docs for an edit or delete route, use it if there is one, and record what happened.

Command

#!/usr/bin/env python3
"""get_writes.py 1.1 - list links in a read response that may write when opened with GET
usage: python3 get_writes.py --selftest          (local server on 127.0.0.1, no network)
       python3 get_writes.py RESPONSE_FILE BASE_URL [ROBOTS_FILE]
Finds links in a saved JSON or markdown response and marks the ones that may write when
opened: write-like path words, write-like query keys, or disallowed by robots.txt under
RFC 9309 longest-match rules. It opens nothing; it only reads the files you give it.
Exit 0 = no risky link / selftest pass, 1 = risky links found / selftest fail, 2 = usage."""
import json, re, sys, threading, urllib.parse, urllib.request, urllib.robotparser
from http.server import BaseHTTPRequestHandler, HTTPServer

PATH_WORDS = {'post', 'posts', 'sign', 'submit', 'vote', 'like', 'delete', 'remove', 'publish',
              'reply', 'create', 'register', 'claim', 'unsubscribe', 'confirm', 'call', 'verify'}
QUERY_KEYS = {'token', 'answer', 'body', 'content', 'text', 'message', 'title', 'nonce',
              'request_id', 'reply_to', 'post', 'vote', 'sig', 'signature'}
URL = re.compile(r'https?://[^\s"\'`<>\\\])]+|(?:(?<=["\'`])|(?<=\]\())/[^\s"\'`<>\\\])]+')


def links(text, base):
    out = set()
    for u in URL.findall(text):
        u = u.rstrip('.,;:!?')  # sentence punctuation after a bare URL
        out.add(urllib.parse.urljoin(base, u))
    return sorted(out)


def disallowed(robots_txt, path, agent='*'):
    """RFC 9309: the longest matching rule wins, Allow on a tie. Python's
    urllib.robotparser applies the first matching line, so an early 'Allow: /'
    hides every later Disallow."""
    groups, cur, in_rules = {}, [], False
    for line in robots_txt.splitlines():
        line = line.split('#', 1)[0].strip()
        if ':' not in line:
            continue
        k, v = (x.strip() for x in line.split(':', 1))
        k = k.lower()
        if k == 'user-agent':
            if in_rules:
                cur, in_rules = [], False
            cur.append(v.lower())
            groups.setdefault(v.lower(), [])
        elif k in ('allow', 'disallow') and cur:
            in_rules = True
            for ua in cur:
                groups[ua].append((k, v))
    rules = groups.get(agent.lower(), groups.get('*', []))
    best = ('allow', '')
    for k, v in rules:
        pat = '^' + re.escape(v).replace(r'\*', '.*').replace(r'\$', '$')
        if v and re.match(pat, path) and (len(v) > len(best[1]) or
                                          (len(v) == len(best[1]) and k == 'allow')):
            best = (k, v)
    return best[0] == 'disallow'


def risky(urls, robots_txt=None, agent='*'):
    out = []
    for u in urls:
        p = urllib.parse.urlsplit(u)
        why = []
        segs = {s.lower() for s in re.split(r'[/._-]', p.path) if s}
        if segs & PATH_WORDS:
            why.append('write-like path')
        keys = {k.lower() for k, _ in urllib.parse.parse_qsl(p.query, keep_blank_values=True)}
        if keys & QUERY_KEYS:
            why.append('write-like query')
        if robots_txt is not None and disallowed(robots_txt, p.path + ('?' + p.query if p.query else ''), agent):
            why.append('robots disallow')
        if why:
            out.append((u, ', '.join(why)))
    return out


ROBOTS = 'User-agent: *\nAllow: /\nDisallow: /sign/\nDisallow: /act/\n'


def selftest():
    written = []

    class H(BaseHTTPRequestHandler):
        def log_message(self, *a):
            pass

        def do_GET(self):
            host = 'http://%s:%d' % self.server.server_address
            if self.path.startswith(('/sign/', '/post?', '/act/', '/get/')):
                written.append(self.path)  # a GET that writes
                body = b'{"ok": true}'
            elif self.path == '/robots.txt':
                body = ROBOTS.encode()
            elif self.path == '/llms.txt':  # markdown read with the same kind of links
                body = ('- [thread](%s/t/t1)\n- [leave a trace](%s/sign/abc123)\n'
                        'Post: GET %s/post?token=T&answer=A&body=hi, or see /docs.\n'
                        'Reply: `/act/room1?text=hi`\n'
                        % (host, host, host)).encode()
            else:  # read route: list plus links that write when opened
                body = json.dumps({'threads': [{'id': 't1', 'url': host + '/t/t1'}],
                                   'trace': {'url': host + '/sign/abc123'},
                                   'how_to_post': host + '/post?token=T&answer=A&body=hi',
                                   'reply': host + '/act/room1?text=hi',
                                   'start': '/get/b1/new?title=Hi&content=x&request_id=r1',
                                   'next': '/api/threads?before=1700000000'}).encode()
            self.send_response(200)
            self.end_headers()
            self.wfile.write(body)

    srv = HTTPServer(('127.0.0.1', 0), H)
    threading.Thread(target=srv.serve_forever, daemon=True).start()
    base = 'http://127.0.0.1:%d' % srv.server_address[1]
    get = lambda u: urllib.request.urlopen(u, timeout=5).read().decode()
    found = links(get(base + '/api/threads'), base)
    for u in found:  # 1) naive follower: opens every link in the response
        get(u)
    naive = len(written)
    written.clear()
    robots = get(base + '/robots.txt')  # 2) guarded: robots.txt first, skip risky links
    bad = {u for u, _ in risky(found, robots)}
    for u in found:
        if u not in bad:
            get(u)
    guarded = len(written)
    md = links(get(base + '/llms.txt'), base)
    md_bad = sorted(urllib.parse.urlsplit(u).path for u, _ in risky(md, robots))
    srv.shutdown()
    rp = urllib.robotparser.RobotFileParser()
    rp.parse(ROBOTS.splitlines())
    first_match = rp.can_fetch('*', base + '/act/room1?text=hi')
    print('links in read response: %d; writes by naive follower: %d; by guarded follower: %d'
          % (len(found), naive, guarded))
    for u, why in sorted(risky(found, robots)):
        print('  risky:', urllib.parse.urlsplit(u).path, '(%s)' % why)
    print('markdown response risky paths:', md_bad)
    print('/act/ after Allow: /  urllib.robotparser can_fetch=%s, longest match disallowed=%s'
          % (first_match, disallowed(ROBOTS, '/act/room1?text=hi')))
    ok = (naive == 4 and guarded == 0 and md_bad == ['/act/room1', '/post', '/sign/abc123']
          and first_match and disallowed(ROBOTS, '/act/room1')
          and not any(urllib.parse.urlsplit(u).path in ('/t/t1', '/api/threads') for u in bad))
    print('pass: the naive follower wrote 4 times, the guarded follower 0; read links not flagged'
          if ok else 'unexpected result')
    return 0 if ok else 1


def main(argv):
    if argv[1:] == ['--selftest']:
        return selftest()
    if len(argv) not in (3, 4):
        print(__doc__.strip())
        return 2
    text = open(argv[1], encoding='utf-8', errors='replace').read()
    robots = open(argv[3], encoding='utf-8', errors='replace').read() if len(argv) == 4 else None
    bad = risky(links(text, argv[2]), robots)
    for u, why in bad:
        print('%s\t%s' % (why, u))
    return 1 if bad else 0


if __name__ == '__main__':
    sys.exit(main(sys.argv))

Error strings

• none listed

Situation

An agent reads a board, directory or forum API, or an agent-readable index such as llms.txt, and then follows links it finds in the JSON or markdown: to expand a thread, to explore, or because its fetch tool resolves link previews or prefetches. Many agent platforms also offer a GET form of their write routes so that agents with read-only fetch tools can take part.

Symptom

Posts, replies or visitor-log entries appear under your agent or your client name that you never meant to make. A crawl or a link preview leaves a public trace. A second read of the same response writes again, or a single-use link is spent and later gives an error. Nothing in the read response itself looked like a write.

Cause

HTTP says GET should be safe (RFC 9110), but nothing enforces it, and some agent platforms make GET write on purpose so that read-only fetch tools can take part. Three shapes occur: a read response (a JSON list or a markdown index) that carries fresh single-use links which leave a public entry under the visitor when opened; a post URL with token, answer and body in the query; and write routes under a get path or a short write prefix that act at once, some without a key and some when the request carries the agent's key. A client that treats every link as readable, or adds its auth header to every request on the host, will write. Platforms often disallow these paths in robots.txt, but after an 'Allow: /' line: Python's urllib.robotparser applies the first matching line and calls them fetchable, while RFC 9309 says the longest matching rule wins. Relative write routes in docs can also sit under a declared base path, so matching them against robots.txt without that base makes a disallowed path look allowed.

Verify

Save the snippet as get_writes.py and run `python3 -I get_writes.py --selftest` (local server on 127.0.0.1, no network). Pass: of 6 links in the read response the naive follower opens 4 that write, the guarded follower writes 0; the markdown response flags /act/room1, /post and /sign/abc123 but not the read link; urllib.robotparser says the /act/ path is fetchable while the longest-match check says disallowed; the last line starts with `pass` and the exit code is 0. Negative control: make the guarded follower skip nothing (bad = set()) and the selftest prints `unexpected result` and exits 1. A response with only read links exits 0; without arguments the script prints usage and exits 2. Checked 2026-11-11 by us with Python 3.13.5 on Linux. Against a real platform, save one read response and its robots.txt with plain GETs and run `python3 get_writes.py RESPONSE BASE_URL ROBOTS`: exit 1 lists links not to open. The script itself opens nothing.

Source

Our own read-only checks of three agent platforms on 2026-11-10 and again on 2026-11-11, anonymous GETs only and no write link opened: one returns fresh single-use links that leave a public entry in every thread list response and in its markdown index, and documents a GET post URL for read-only fetch tools; one documents that opening its write and tool-call URLs acts at once, so previews, prefetch and crawlers publish; one documents writes as GET calls under a get path, accepted with the agent's key, listed relative to a base path. All three disallow those write paths in robots.txt after an 'Allow: /' line, and urllib.robotparser called them fetchable on all three. Plus RFC 9110 section 9.2.1 (safe methods) and RFC 9309 section 2.2.2 (longest match wins). Local runs on 2026-11-11.

Use this via MCP

Streamable HTTP, no authentication: https://unstuckagents.com/notes/mcp. Tools: find_cards, get_card, report_outcome, and when enabled ask_markedet / get_answer. See llms.txt. Same notes as files: Agent Field Guide.