Retrieval provider
Cloudflare-AutoRAG is operated by Cloudflare. Sells the index that other companies’ AI products search. Blocking it removes you from all of them at once.
Cloudflare runs it as a retrieval provider, which means it crawls the web once and sells the resulting index to other companies, whose AI products search it. One crawler, many downstream products, and the name on the user agent is rarely the name of any product you have heard of.
What blocking it costs you: Anyone building a retrieval application on Cloudflare cannot include your pages in it. You leave every AI product built on that index at once, which is a great many more than the one company whose name is on the crawler.
These are two different strings and confusing them is why a rule that looks right does nothing.
A robots.txt rule matches on the product token, case-insensitively, and
ignores the rest of the user-agent header entirely.
| robots.txt token | Cloudflare-AutoRAG |
|---|---|
| Operator | Cloudflare |
| Category | Retrieval provider |
| Full user agent | Not published by Cloudflare. Match on the token above. |
Where an operator has not published the exact string, this page says so rather than inventing a plausible one. A user agent you can grep your logs for is worth nothing if it is a guess.
Paste this into robots.txt at the root of your domain.
User-agent: Cloudflare-AutoRAG
Allow: /
Sitemap: https://axray.online/sitemap.xml
An empty Disallow: and Allow: / mean the same thing to a crawler. What does
not mean the same thing is having no rule at all: absence is permission by default, but it is
permission nobody wrote down, and it survives only until somebody adds a blanket
User-agent: * block without thinking about this crawler.
User-agent: Cloudflare-AutoRAG
Disallow: /Before you paste that: anyone building a retrieval application on Cloudflare cannot include your pages in it. That is the cost, and it is paid silently — no error appears in your logs, no report tells you, and the traffic you lose was traffic you never saw arrive.
Measured on 2026-09-06, by reading the robots.txt of
292 public websites and resolving each one against this crawler specifically.
| Verdict | Sites | Share |
|---|---|---|
| Blocked | 8 | 3% |
| Explicitly allowed | 230 | 79% |
| No rule either way | 54 | 18% |
No site is named, here or anywhere else on this domain. The count is the useful part; a league table of businesses that never asked to be measured is not.
The row worth reading twice is the last one. 54 of 292 sites have written no rule about
Cloudflare-AutoRAG at all, which means their position on it is an accident rather than a decision — whatever
their User-agent: * block happens to say.
Reading your own robots.txt is not the same as knowing what a crawler concludes from it.
Precedence between a User-agent: * group and a named one, the longest-match rule between
overlapping paths, and a token you spelled slightly wrong all produce a file that looks correct and
behaves otherwise.
npx axray-cli your-site.comThe scan resolves your file against all 54 crawlers on this list individually and reports which ones are allowed, blocked, or covered by nothing. It is free, needs no account, and installs nothing.
Cloudflare-AutoRAG is a retrieval provider operated by Cloudflare: it crawls the web once and sells the resulting index to other companies, whose AI products search it. One crawler, many downstream products, and the name on the user agent is rarely the name of any product you have heard of.
Only if you are willing to pay what it costs. Anyone building a retrieval application on Cloudflare cannot include your pages in it. You leave every AI product built on that index at once, which is a great many more than the one company whose name is on the crawler.
Cloudflare does not publish a full user-agent string for this crawler. The robots.txt product token is Cloudflare-AutoRAG, and that is what a rule matches on; matching is case-insensitive.
Scan your site with AXRAY. It resolves your robots.txt against 54 named AI crawlers individually rather than reporting one verdict for all of them, so it will tell you whether this specific crawler is allowed, blocked, or covered by no rule at all. It is free and needs no account.
ExaSearchBot — ExaTavilyBot — TavilyFirecrawlAgent — FirecrawlShapBot — ParallelDiffbot — Diffbotbedrockbot — AmazonThe full reference: all 54 AI crawlers, and who blocks each one.
See which of these 54 crawlers your own site is blocking, and what each one costs you. One scan, no account.