meta-externalagent: robots token, verification and how to allow or disallow it

All 21 documented crawlers

Identity

The vendor page fetched on 2026-09-06 carries the exact snippet 'User-agent: meta-externalagent Allow: / # Allow everything Disallow: /private/ # Disallow a specific directory', asks for up to 24 hours for a robots.txt change to take effect, and notes that its integrity and security checks may not follow robots.txt.

Allow or disallow it

User-agent: meta-externalagent
Allow: /

User-agent: meta-externalagent
Disallow: /

A robots.txt rule is a request that a well behaved crawler honours. It is not an access control, and this page does not tell anyone what to choose.

Build a robots.txt with meta-externalagent and every other documented token

Questions

Does meta-externalagent obey robots.txt?

The vendor documentation at https://developers.facebook.com/docs/sharing/webmasters/web-crawlers/ states that meta-externalagent respects robots.txt. We fetched that page and it answered our checker on 2026-09-06. This records what the vendor documents, not what any individual request did.

How do I allow meta-externalagent in robots.txt?

Add this group to the robots.txt at the root of the host: User-agent: meta-externalagent Allow: /. The token is matched case insensitively as a substring of the user agent by RFC 9309, and the longest matching rule wins.

How do I disallow meta-externalagent in robots.txt?

Add this group to the robots.txt at the root of the host: User-agent: meta-externalagent Disallow: /. A robots.txt rule is a request that a well behaved crawler honours; it is not an access control.

How do I verify a request really came from meta-externalagent?

We have not found a documented verification method for meta-externalagent: the vendor publishes neither an IP range file nor a reverse DNS convention that we could fetch. Without one, a user agent string is not evidence of origin.

What we measure

Of the 12976 seeded domains whose robots.txt we have read, 1465 disallow meta-externalagent for / and 11511 allow it, which is 11.3% disallowed, week 2026-W43. Counts only: no domain is named.

The weekly AI crawler access index

Sources

Free data

• The AEO Watch dataset
• Tranco top 1,000 AI crawler policy (CSV, CC BY 4.0)
• The AEO Watch API
• The checker as a command line tool (one file, no install)

Check a domain against every token

Check your own site

The same checks, run on your domain now: what robots.txt tells each AI crawler, whether the edge answers them, and whether the text is readable without JavaScript. Free, no signup.

Limits: 8 checks and 5 different domains per address per hour; a repeat of the same domain inside 7 days is answered from what we already hold.

AEO Watch is an independent, factual monitor. It is not affiliated with, endorsed by or speaking for any crawler vendor. Every statement is an observation with the date it was made and the raw evidence behind it: a robots.txt line, an HTTP status code, a header. There are no scores, no grades and no verdicts here, and nothing on this page is advice. A site opts out at any time and the opt out is honoured automatically and permanently.