Skip to content
GrokBotsHub

How the Hub works

Trust & testing methodology

What each trust level, permission level and risk flag means, how we test bots and check their links, and where the limits of all of it are.

Checked against the code on

Short answer

A listing is not a recommendation. Trust levels say what we confirmed, from "the link works" up to "we ran it and published the result". Permission levels and risk flags marked est. are our reading of the listing text. Nobody can pay to change any of them.

The Trust Ladder

Every bot sits on the highest rung whose rule it meets. We recompute it after every link check, every creator claim and every published test. Sponsorship is not an input: paying cannot move a bot up or down.

  1. 1 ListedShare link submitted

    The bot is in the directory: imported from the official marketplace, or submitted and approved. Nothing else has been confirmed. A bot also falls back here when its link stops answering and no higher rung applies.

  2. 2 Link verifiedShare link crawled OK in the last 7 days

    The latest check of the share link worked, and the last working check is less than 7 days old.

  3. 3 Creator verifiedClaimed by its creator via X

    The creator signed in with X, and X confirmed that the username matches the creator on the listing.

  4. 4 Hub-testedWe ran it and published a report with a real sample

    We ran the bot and published a test report with a real sample of its output.

  5. 5 Staff pickHub-tested and recommended by the editors

    The bot is Hub-tested, the newest published report has the verdict Recommended, and the editors picked it.

The upper rungs do not depend on the link. A Hub-tested bot whose link breaks stays Hub-tested, and its card shows a warning that the share link is not working.

Permission levels: Reads, Drafts, Acts

Every card says what the bot may do with the accounts it touches.

  • ReadsReads your data and reports back. Never changes anything.
  • DraftsPrepares drafts and proposals. You approve before anything is sent or changed.
  • ActsCan send, post, move or change things on your behalf. Read the risk flags.
  • Not statedThe share page does not say what it can do. Check it in preview before adding.

A level can come from four places, and the bot page says which:

  • The share page: the public listing states it.
  • The creator: a verified creator stated it.
  • A Hub test: we confirmed it when we ran the bot.
  • Our estimate: none of the above, so we estimated it from the listing text. It is shown with est., for example Drafts· est..

How estimates work

Most listings do not state a permission level. So we estimate one from the listing text: the name, the description, the summary, the skills and the connected apps. It is keyword matching, not a test:

  1. We first remove negated phrases such as "never sends" or "doesn't post".
  2. If the text describes actions (sends, posts, publishes, books, pays, merges, deploys, deletes, moves, creates tickets) and also approval (drafts, for your approval, you approve, preview, asks before), the estimate is Drafts.
  3. Actions without approval: Acts.
  4. Approval language alone: Drafts.
  5. Only reading words (watches, monitors, reports, summarizes, researches, tracks, alerts): Reads.
  6. None of these: Not stated.

Estimates can be wrong in both directions. We refresh them when the listing text changes. Once a creator or a Hub test confirms a level, it replaces the estimate, and later imports never overwrite it.

Risk flags

A risk flag marks something a bot can do that is hard to undo. Flags are estimated from the same listing text, after negated phrases are removed, unless a creator or a Hub test confirmed them.

  • Sends messagesSends email, messages or DMs to other people, such as customers, leads or contacts.
  • Posts publiclyPosts, publishes or tweets where others can see it.
  • Spends moneyBuys, pays, places orders or spends a budget.
  • Deletes dataDeletes, archives or wipes data.
  • Uses your loginsLogs in with your credentials or uses browser sessions.
  • Health dataTouches health records, medical or clinical information.

In the directory you can hide every bot that carries a flag you do not want.

Hub tests

A Hub test is the only way a bot reaches Hub-tested. We add the bot to a Grok account, run it, and write down what happened. A published report always contains:

  • who ran the test and on which date;
  • a verdict: Recommended, Works with caveats or Not recommended;
  • four scores from 1 to 5: setup, quality, noise and safety;
  • a one-line summary and the full write-up;
  • a real sample of the bot's output, with names changed;
  • how many minutes the setup took, when we measured it.

A bot becomes Hub-tested only when its report is published. The newest published report is the one that counts. A bot without a report says "Not yet tested"; we never fill the space with sample data. Staff pick needs a Recommended verdict plus the editors' pick. Paying cannot buy a verdict or a trust level.

See every tested bot on Hub-tested bots.

Each bot has a public share page at x.ai/bot/<id>. We fetch it and follow these rules:

  • 200, and it is a bot page (its title reads "name by creator"): the link is OK. A bot marked broken goes back to live, and its change log says the link works again.
  • 404 or 410: the link is broken. A 200 that is not a bot page, such as xAI's generic page, counts the same. The bot stays listed, its card says "Share link not working", and its change log notes it.
  • Retired: after at least 3 failed checks in a row, with 3 or more days since the last working check. A retired bot leaves every list. Its page stays online with a notice.
  • Anything else (a server error, a timeout, a network failure) is temporary. We log it and change nothing: it does not count as a failure and does not reset the count.

A bot is due for a check when its last check is more than 20 hours old. We send one request per second, so in practice every link is checked about once a day. Every check is kept in a log with its HTTP status. A link counts toward Link verified only while its last working check is under 7 days old.

What we do not claim

  • A listing is not a recommendation. Listed means the bot is in the directory. Nothing more.
  • Link verified means the share page answered. It says nothing about quality or safety.
  • Creator verified means the creator claimed the listing. It is not a review of the bot.
  • Anything marked est. comes from the listing text and can be wrong.
  • A Hub test describes the bot on the test date. Creators can change their bot at any time after it.
  • We see what the public listing shows. We do not see a bot's private setup.
  • Reviews come from signed-in users who say they added the bot. We cannot confirm every one.
  • Adding a bot happens on x.ai. What a bot does in your accounts is between you, its creator and xAI.

Corrections

Spot a wrong level, a missing flag or a dead link? Use "Report a problem with this bot" on its page, or write to [email protected]. Creators can claim their listing to correct it, or ask us to remove it. How lists are ordered is on how ranking works.