Manus doesn't answer from an index. Each task gets its own cloud computer, whose browser searches, opens your page, extracts what it can and lists what it used in a report, deck or spreadsheet. Here's how that agent identifies itself, what turns it away, what it can't read, and how to see it in your logs.
By Rankbox · Updated 26 Oct 2026 · 19 min read
Shortlist five bookkeeping tools for a 12-person design agency, with per-seat pricing, in a spreadsheet
To be used and cited by Manus, let its agent in and make your facts extractable. Manus’s cloud browser identifies as Manus-User, signs its requests with Web Bot Auth and runs from data-center IPs. Manus doesn’t document robots.txt support, so your CDN and bot rules decide access. It renders JavaScript, but its page extraction drops images and links, so put prices, limits and answers in visible text on stable URLs. The pages that supply a fact to the finished report are the ones it lists as sources.
Manus-User/1.0 and signs requests with Web Bot Auth. Cloudflare Radar lists it as a verified Agent with intermediary access.rel="noopener noreferrer", so clicks land in Direct. Count Manus-User in your server logs instead.01
Manus works like a colleague with its own computer, and that’s close to literal. Every task gets a fully isolated cloud virtual machine with networking, a file system and a browser, and the output is a file — a report, a slide deck, a spreadsheet, a website — rather than a chat reply. A typical task takes around 50 tool calls. Your page is either one of the sources behind that file or it isn’t.
That changes what you optimize. With a chat engine the question is whether a crawler can read your HTML. With Manus it’s whether an agent can finish a sub-task on your page: find the price, read the limits, copy them into a table and move on. Here is a task’s path, and what you control at each step.
Step 1 of 6
It writes a plan, then keeps rewriting it
Manus breaks the request into steps and keeps a todo.md up to date, “reciting its objectives into the end of the context,” as co-founder Yichao “Peak” Ji put it in July 2025. A shortlist request becomes sub-tasks: find candidates, then price, limits and integrations for each.
Your moveAnswer the sub-questions a plan will contain — pricing, limits, integrations, alternatives — each on a page that stands on its own.
Step 2 of 6
It searches in short keyword queries
The search tool in Manus’s March 2025 system prompt took queries “in Google search style, using 3-5 keywords,” with an optional date range from past hour to past year, and told the agent to “search multiple attributes of single entity separately.” Manus has never named the provider behind that tool.
Your moveTitle pages for the attribute queries a plan will run (Coinwren pricing, Coinwren payroll limits), and show a visible date so date-filtered searches keep you.
Step 3 of 6
It opens pages instead of trusting snippets
The same prompt ruled that “snippets in search results are not valid sources; must access original pages via browser,” and told Manus to open several results “for comprehensive information or cross-validation.”
Your moveRanking isn’t enough. The page has to load for the agent: a blocked or challenged page can’t become the source.
Step 4 of 6
It reads through a browser on data-center IPs
Manus’s cloud browser “operates from data center IP addresses, not residential IPs,” so some sites “may trigger additional verification,” and a CAPTCHA pauses the task until the user takes over. E2B, whose microVMs Manus ran on in 2025, describes those agents visiting URLs in Chromium.
Your moveDon’t challenge the verified agent on the pages you want used. Every human check is a point where the task can stall or skip you.
Step 5 of 6
It extracts text and drops the rest
Per the 2025 prompt, the browser returned page content “in Markdown format,” including “text beyond viewport but omits links and images,” while clickable elements were listed only for the visible viewport. Once used, a page can be dropped from context “as long as the URL is preserved,” and reopened later.
Your movePut the fact in text, near the top, on a URL that shows the same thing when the agent comes back to it.
Step 6 of 6
It writes the deliverable and lists its sources
Manus was told to “actively cite original text with sources and provide a reference list with URLs at the end.” The table, deck or report is where your reader finally sees your name — or a competitor’s.
Your moveGive every page a <title> that names exactly what it is. It’s the likeliest text for a reference line.
~50
tool calls in a typical Manus task
Manus, Jul 2025250
items Wide Research has been tested on, with one agent per item
Manus docs, 20269%
of the top sites Known Agents tracks have robots.txt rules for Manus-User
Known Agents, Oct 202602
Manus reaches the web in more than one way, and only the cloud browser announces itself. The other routes arrive as your visitor, or never touch your site at all.
| Route | What runs | What you see | What you control |
|---|---|---|---|
| Cloud browser (default) | A browser in the task’s cloud computer, on data-center IPs | A Chrome user agent ending in Manus-User/1.0, plus a Web Bot Auth signature | WAF, bot and rate-limit rules |
| Wide Research | Parallel sub-agents, each a full Manus instance with its own connection | The same agent, many sessions within minutes | Rate limits, and whether verified agents are exempt |
| Browser Operator | An extension in the user’s Chrome or Edge; Preferred Browser (May 2026) pins one always-on Chrome | The user’s own browser, IP address and cookies | Nothing that wouldn’t also block the user |
| Computer use (Manus 2.0) | Manus in a visible workspace on the user’s computer, using the apps and browser they approve | The user’s own machine | Nothing distinct |
| Data sources | Built-in data APIs: Similarweb traffic, keywords, referrals and top pages for Pro users, plus company and financial data | Nothing: it never visits your site | Your profile and numbers on those providers |
User-agent token
Manus-User
Manus’s cloud browser, opening and operating pages during a user’s task. Observed as a Linux Chrome user agent with Manus-User/1.0 appended; requests are signed with Web Bot Auth keys published on api.manus.im.
Manus hasn’t published its user agent string, and the help page Cloudflare links to for the bot (manus.im/help/Manus-user) returned a 404 on 26 October 2026. Known Agents records it like this; the Chrome version moves with each browser release, so match on the token, never the whole string:
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36; Manus-User/1.0Because any client can send that string, identity comes from the signature. Cloudflare Radar lists Manus Bot as verified, in the Agent category, with intermediary access — Cloudflare’s label for a bot that many end users drive — and links its key directory. Fingerprint (March 2026) names Manus among operators “signing their requests today.” Signed requests carry Signature, Signature-Input and Signature-Agent headers, checked against Manus’s public key:
# Manus's Web Bot Auth key directory, as served on 26 October 2026
curl -s https://api.manus.im/.well-known/http-message-signatures-directory
{"keys":[{"crv":"Ed25519","kty":"OKP","x":"KcGM6sqzNes25V0hn96KsrIwL6pbut1KQMGmyFwpboM"}]}
# The response is itself signed (tag="http-message-signatures-directory")
# and cached for a day (max-age=86400). Keys rotate: verify against
# the live directory, never a hard-coded key.03
robots.txt still has a job with Manus: putting your policy in writing. It just isn’t a lock. Manus doesn’t say whether its agent reads the file, and Known Agents lists Manus-User as not expected to follow it. If you want Manus in, say so, and keep private paths out:
# Manus's cloud browser. Manus doesn't document robots.txt support:
# this states your policy; your WAF is what enforces it.
User-agent: Manus-User
Allow: /
Disallow: /account/
Disallow: /checkout/Three more edge settings decide whether the agent finishes its sub-task on your page:
The quickest self-test is whether your edge turns the user agent away. It can’t reproduce Manus’s IP reputation or its signature, so a pass is necessary, not sufficient:
# Does a user-agent or bot rule turn Manus away?
curl -s -o /dev/null -w "%{http_code}\n" \
-A "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36; Manus-User/1.0" \
https://yoursite.com/pricing
# 403, 429 or 503: your edge blocks agents by user agent.
# 200 doesn't prove the real agent gets in: IP and signature
# checks only apply to real Manus traffic.04
Manus hasn’t published guidance for site owners. The closest spec is Google’s Build agent-friendly websites (updated 1 April 2026), which notes that agents read sites through screenshots, raw HTML and the accessibility tree. Its rules line up with what Manus’s extractor is known to keep and drop.
Reachable without a challenge
The cloud browser runs from data-center IPs. CAPTCHAs, interstitials, 403s and 429s stop the task until the user takes over, and the user may simply move on to the next result.
Facts in visible text
Extraction “omits links and images.” Prices in a graphic, specs only in a PDF, or copy drawn on a canvas may never reach the report.
Native links, buttons and labels
Google: “use <button> and <a> tags over modified <div> and <span> elements,” and link each <label> to its input with for. Manus’s 2025 prompt admits “not all interactive elements may be identified.”
No overlays in front of content
Google: “Avoid transparent overlays that hide interactive elements.” Cookie walls, newsletter modals and install banners also cost the agent steps.
Stable layout and real-sized targets
Screenshot-reading agents are confused by shifting layouts, and Google says controls an action needs should be visible and larger than 8 square pixels.
Stable, specific URLs
Manus keeps a page’s URL when it drops the content, then reopens it. A plan, filter or tab with its own URL can be revisited and cited; a state reached only by clicks can’t.
Server-side rendering
Not required for Manus, whose browser runs JavaScript, but it makes the first extraction complete — and many other AI fetchers don’t render at all. See server-side rendering.
Structured data
Manus hasn’t said whether it reads JSON-LD. Extraction works on visible content, so repeat every fact from your schema markup in the copy.
llms.txt
Manus publishes an llms.txt for its own docs, but hasn’t said its agent reads other sites’ files.
robots.txt as access control
Not documented as honored. Use the file to state policy; enforce policy at the edge.
<table>.<a href> elements.05
There’s no public study of which domains Manus cites as of October 2026, so citation statistics from ChatGPT or Perplexity don’t transfer. What is known comes from Manus’s docs, its 2025 system prompt and how its task views present work. And being opened isn’t being cited: Manus reads more pages than it lists, and the one that supplies a fact the deliverable actually uses is the one that earns the reference.
Original pages, not snippets
ObservedThe 2025 prompt made opening the page a requirement for using it. A page that blocks or stalls the browser can’t be the source, however well it ranks.
Facts that survive cross-checking
ObservedManus was told to open several results for cross-validation. When your site, review sites and profiles disagree on a price, the agent has to pick, and it may not pick you.
Data providers before the open web
OfficialManus has built-in data sources for company, financial and social data, and Pro users get Similarweb traffic, keywords and top pages without their own account. The 2025 prompt ranked “datasource API > web search > model’s internal knowledge.”
Text the extractor can see
ObservedExtracted page text leaves out images and links, and only viewport elements are listed for interaction. Facts in visible copy near the top travel best.
Pages that load for a data-center browser
OfficialManus documents that its cloud browser’s IPs can trigger verification. Sites that challenge them lose the visit unless the user steps in.
Your presence inside paid tools
OfficialBrowser Operator reads Crunchbase, PitchBook, SimilarWeb, the Financial Times, Semrush and Ahrefs through the user’s own logins. Your profiles there are part of what the agent sees.
One complete page per item
Our readWide Research gives each product, company or location its own agent. A dedicated page that covers the item completely is where that agent can finish.
Titles that say what the page is
Our readReferences are listed by title and URL. A precise <title> is the likeliest text for the line a reader sees.
Visible dates
Our readSearches can be filtered to the past day, week, month or year, and recurring tasks rerun the same comparison. A dated page tells the agent its facts are current.
06
Wide Research handles tasks with many similar items — “analyzing 100 products, researching 50 companies” — by deploying “hundreds of independent agents that work in parallel.” Each sub-agent is a “full-featured Manus instance” with search, browsing and “an independent internet connection,” and the main agent assembles their results into a table, report or dataset. Manus says it has been tested up to 250 items and takes “minutes for 50-100 items.”
You can watch the fan-out on a public Manus replay: the plan lists one row per person researched, ticks off 20 / 20, and only then compiles the chart and the files.
Manus Automations run a task on a schedule or when an event fires. Trigger sources include Gmail, Notion, GitHub, Shopify, RSS and webhooks, and scheduled tasks, rebuilt as Scheduled Tasks 2.0 in May 2026, now live inside Automations. A competitor-monitoring task can come back to your pricing page every Monday, or start the moment your feed publishes.
Browser Operator is a Chrome and Edge extension that runs Manus in a dedicated tab of the user’s own browser, “complete with your existing logins, sessions, and local IP address” — its docs still describe a beta for Pro, Plus and Team users. Manus 2.0 adds computer use, where Manus works in a visible workspace on the user’s computer with the files, browser and apps they approve.
For you, that traffic is your visitor. It carries their cookies, IP address and browser, so you can’t measure it separately or block it without blocking them. It also reaches logged-in areas: if customers ask Manus to pull data from your app or gated docs, it works there with their permissions.
07
Manus is an independent company again. Its short spell inside Meta is the most-repeated story about it, and the most often garbled, so here is the sequence as the primary sources tell it:
| Date | What happened |
|---|---|
| 29 Dec 2025 | Manus announces it is joining Meta and says it will keep operating from Singapore. The price was reported at about $2 billion. |
| 27 Apr 2026 | China’s National Development and Reform Commission prohibits the deal and requires the parties to withdraw it. |
| Jun 2026 | Meta begins unwinding the acquisition and cuts Manus off from its internal systems. |
| 11 Aug 2026 | Manus tells users it will operate independently again. Data some users generated after 29 December 2025 is deleted on 23–24 August (SGT), with a backup and restore window. |
| 1 Sep 2026 | Manus formally resumes independent operations; its founding team continues to lead it. |
| 28 Sep 2026 | Manus 2.0 ships: a new agent harness (Cascade), Cloud Computer, event-triggered automations and computer use on the desktop. |
| 8 Oct 2026 | Parent company Butterfly Effect raises more than $500 million, led by Boyu Capital and IDG Capital. No valuation was disclosed. |
For site owners the point is continuity. The agent’s identity — the Manus-User token and the signing keys on api.manus.im — is Manus’s own and didn’t change through any of this, and Manus says its data is stored in the US and Singapore.
08
Your server logs are the reliable view. Manus-User hits show which pages tasks open, and weekly spikes on the same URLs suggest automations. Known Agents warns that a user-agent match “is not proof,” since any bot can claim the name, so for decisions rely on your CDN’s verified-bot flag, which checks the signature.
# Pages Manus's cloud browser opened, most-visited first
grep "Manus-User" access.log | awk '{print $7}' | sort | uniq -c | sort -rn | head -20
# Hits per day: the same pages every week suggests a scheduled task
grep "Manus-User" access.log | awk '{print substr($4,2,11)}' | sort | uniq -cAnalytics sees little. On Manus’s task pages, links open in a new tab with rel="noopener noreferrer" (as checked on a public replay on 26 October 2026), so the browser sends no referrer and those visits land in Direct. Sites Manus builds are published on manus.space subdomains, and clicks from them normally pass that origin. Google’s AI Assistant channel covers “sources like ChatGPT, Gemini, Deepseek, Copilot, or Grok” — not Manus — so add a custom channel:
# Session source: Manus-built sites and Manus pages linking to you
(^|\.)manus\.(space|computer|im)$
# Clicks from inside a Manus task carry no referrer: they land in DirectThe agent’s own visits can also inflate analytics. The cloud browser runs JavaScript, so your analytics tags may fire on Manus-User visits and count them as sessions. Compare log hits with sessions on your most-visited pages before trusting engagement numbers there.
Citations need a panel of your own. Run a fixed set of buyer tasks in Manus each month — the comparisons your customers would delegate — and record whether you appear among the sources and which of your pages it used. Tasks cost credits, so keep the set small and identical from month to month. See AI referral traffic for the wider picture.
09
Manus is part of Meta.
Meta announced the deal in December 2025, China prohibited it on 27 April 2026, and Manus resumed independent operations on 1 September 2026.
A robots.txt disallow keeps Manus out.
Manus doesn’t document robots.txt support, and Browser Operator is the user’s own browser. Block at the edge if you must — or, better, let the verified agent in.
Agents can't run JavaScript, so SSR is mandatory for Manus.
Manus drives a full browser, so client-side rendering doesn’t hide you from it. Server rendering still matters for Claude, ChatGPT and Perplexity.
Manus clicks show up as manus.im referrals.
Links in Manus task views open with rel="noopener noreferrer", so they arrive with no referrer. Only pages Manus hosts, like *.manus.space sites, normally pass one.
Hidden text aimed at AI agents helps them choose you.
It looks exactly like prompt injection, which Manus warns its own users about. Agents read the visible page; write for that.
15 steps in the order they pay off. Tick them off as you go; nothing is saved or sent.
Do firstAccess and extraction
ThenStructure, bursts and measurement
Finish withPolicy and polish
Manus-User/1.0 appended. It also signs requests with Web Bot Auth, with its public key published at api.manus.im. Browser Operator and computer use run in the user’s own browser, with the user’s own user agent.Manus-User as not expected to follow robots.txt. Use the file to state your policy, and enforce access with WAF or bot rules.rel="noopener noreferrer", so no referrer is sent. Sites Manus builds on *.manus.space normally pass their origin. GA4’s AI Assistant channel doesn’t include Manus, so use a custom channel and your server logs.Manus-User identity carry on, but more Manus work now runs in places that look like ordinary visitors.33 sources · last checked 26 Oct 2026
Rankbox researches the questions your buyers ask AI, writes source-backed articles with the facts in plain text, scores each one and publishes on a schedule.
7-day free trial · Card required · Cancel anytime