Why Komerza Forge visited your site.

You are probably here from a server log. KomerzaForge is the fetcher behind Forge, Komerza's AI store builder. It only requests a page when a merchant asks Forge to look at it, it signs every request so you can verify that, and you can turn it away in one line.

At a glance

What it is, who runs it, and what it does with what it fetches.

Operator: Komerza, UAB (Vilnius, Lithuania), the company behind komerza.com.
User-Agent: KomerzaForge/1.0 (+https://komerza.com/bot)
What it is: A fetcher, not a crawler. Forge is Komerza's AI store builder. When a merchant asks it to look at a web page, or to search the web while building their store, Forge fetches the pages that request needs, on that merchant's behalf, and nothing else.
What it is not: It does not crawl sites on a schedule, follow links beyond what was asked for, build an index, or collect pages to train AI models. Fetched content is used to answer the merchant's request and is not republished.
Volume: One request at a time, for the specific pages a merchant asked about. If you see more than a handful of requests from it, that is unexpected: tell us.

How it identifies itself

Web Bot Auth: every request is cryptographically signed, so a spoofed User-Agent proves nothing and a real one proves everything.

Fetch the key directory

Every signed request carries Signature-Agent: "https://komerza.com". Fetch that origin's directory at /.well-known/http-message-signatures-directory. It is a JSON Web Key Set, and the response is itself signed with the key it publishes, so a copy hosted anywhere else will not verify.

Verify the request signature

The Signature and Signature-Input headers are an RFC 9421 HTTP Message Signature (Ed25519) over the request's authority and the Signature-Agent header, with the tag web-bot-auth and a short expiry. The keyid is the thumbprint of the key in the directory.

Or let Cloudflare do it

If your site is on Cloudflare, requests that verify are treated as a verified bot, so you can allow or block Forge by name in Bot Management and AI Crawl Control rather than by guessing at IP ranges.

Blocking it

Forge respects robots.txt. Name the product token and it will not fetch the paths you list.

robots.txt

Add a group for KomerzaForge to keep it out of your whole site, or list only the paths you want left alone.

User-agent: KomerzaForge
Disallow: /

Something else

Unexpected traffic, a request that did not verify, or a question about what was fetched: email admin@komerza.com with the URL and the timestamp from your log, and a person will answer.

Specifications: RFC 9421 (HTTP Message Signatures), the IETF Web Bot Auth architecture and key directory drafts, and RFC 9309 (robots.txt).