Passive, reproducible recon · four findings · 2026-07-14
This is an honest read of Uber's public surface as any rider, driver, buyer, or AI agent encounters it, gathered passively, no probing, no authentication. It credits a strong baseline first, then names four opportunities that trace to one primitive EcoWealth builds: funded, proof-verified, on-chain-settled work. Under the ruthless-evidence bar, each finding leads with a URL + HTTP status + the exact re-check command.
Uber's front door is well-run and security-conscious. curl -sI https://www.uber.com/ returns HSTS (strict-transport-security: max-age=31536000), x-frame-options: SAMEORIGIN, and x-content-type-options: nosniff, on Cloudflare with HttpOnly; Secure; SameSite cookies. Email auth is enforced: _dmarc.uber.com is p=quarantine (not monitor-only). robots.txt and sitemap.xml both return 200. And Uber is genuinely forward on agents, it published "Solving the Identity Crisis for AI Agents" and ships Uber AI Solutions, working with OpenAI, Claude, and Gemini agents. The findings below are opportunities on top of that, not defects.
No jargon: what each finding below is worth to Uber in plain terms.
Today an assistant asked to act on Uber hits a wall and scrapes or declines; a small machine profile keeps Uber present the moment an agent is ready to book.
A settled, tamper-evident outcome object lets a rider's or auditor's assistant confirm progress independently instead of taking a report on trust.
It's the same claim-go-prove-settle loop drivers already run, pointed at a place worth restoring, a new lane of value on a workforce Uber already trained.
The findings
What an agent hits
An assistant asked to represent or transact with Uber looks for /llms.txt and /.well-known/agent-card.json. On www.uber.com the first is a 404 and the edge returns 406 to any non-browser client on all of them, so there is nothing to read.
Why it matters here
Uber literally wrote the essay on agent identity and sells "Uber AI Solutions." The public consumer surface hasn't caught up: no static file states, verifiably, what Uber offers and how an agent should act.
The precise, reproducible state: a browser-shaped fetch of /llms.txt returns 404 Not Found (the file does not exist). A non-browser client (curl) is answered 406 Not Acceptable (14-byte body) on /llms.txt, /ai.txt, /.well-known/agent-card.json, /.well-known/ai-plugin.json, and /.well-known/security.txt, Cloudflare bot management. The irony: robots.txt explicitly ends with allow: /.well-known/, inviting crawlers into a directory the edge then 406-blocks. And developer.uber.com root now returns 404.
# browser-shaped fetch — file genuinely absent GET https://www.uber.com/llms.txt -> 404 Not Found # non-browser client (curl) — edge bot-block, 14-byte body $ curl -s -o /dev/null -w "%{http_code}\n" https://www.uber.com/llms.txt 406 $ for p in ai.txt .well-known/agent-card.json .well-known/ai-plugin.json .well-known/security.txt; do \ curl -s -o /dev/null -w "$p %{http_code}\n" https://www.uber.com/$p; done ai.txt 406 agent-card.json 406 ai-plugin.json 406 security.txt 406 # yet robots invites /.well-known/ … $ curl -s https://www.uber.com/robots.txt | grep -i well-known allow: /.well-known/ # … and the old dev portal root is gone $ curl -s -o /dev/null -w "%{http_code}\n" https://developer.uber.com/ 404
The fix EcoWealth brings: a static, agent-legible discovery layer, an llms.txt capability map, an A2A agent card, and MCP tool schemas, served where agents actually look, so an assistant returns Uber accurately with a citation instead of scraping or declining. Drafted in the Agent Kit page.
Uber's commitment is concrete and creditable: a zero-emission platform by 2040, 100% EV rides in U.S./Canada/Europe cities by 2030, an $800M Green Future driver-transition program, and Uber Green live in 110 markets (all publicly reported). The gap is not the ambition, it's that a rider, regulator, or agent has no structured, verifiable object to check progress against. It's a claim to trust, not a proof to verify, the same shape as every ESG PDF.
Today
"Was this trip zero-emission? Is Uber on track for 2030?" resolves to a marketing page an AI must scrape and paraphrase, no per-trip or per-city machine-readable outcome.
With a proof layer
A settled, tamper-evident receipt, per green trip, per driver EV transition, or per city-geography restore packet, that a rider's or auditor's agent verifies independently, on-chain.
Why EcoWealth fits: our primitive is exactly a funded, proof-verified, on-chain-settled outcome receipt with a tCO2e mapping where ecological. It turns "we pledge" into "here is the settled, citable outcome", shown in the demo.
Strip an Uber trip to its mechanics: a worker claims a bounded task, is directed to a place, proves completion with GPS + timestamp, and gets paid on a settlement rail. That is, line for line, an EcoWealth work packet: scope, place, proof, settlement. Uber has already trained ~1M U.S. earners (≈10M globally, ~42M trips/day) in the exact behavior EWP needs. The only differences EWP adds: the proof is public and verifiable (not private to one platform), settlement is on-chain, and the task can be ecological restoration, a Restore-ladder packet (native planting, storm-drain marking, tree-well care, litter transects) claimable between rides in the same city a driver already knows.
Why the geography matters
Drivers idle in known micro-geographies between fares. A restore packet is a bounded, ~15–40 min task at a mapped place, the exact gap-filler downtime, monetized, with proof.
Why it's low-friction
No new behavior to teach: claim → go to place → photo+GPS+sign → settle. It's the trip loop they run all day, pointed at a place worth restoring.
This finding rides on Findings 1–2: the pattern-fit only becomes real once there's an agent-legible door (F1) and a verifiable outcome object (F2). Together they make Uber's own workforce an on-ramp to proof-verified ecological work.
~all (softfail) while DMARC is already enforcedCredited first: Uber's DMARC is enforced (p=quarantine), ahead of many peers. The one soft edge: the root SPF record ends in ~all (softfail) rather than -all (hardfail). For a brand this heavily impersonated, a hardfail closes the last gap between "flagged" and "rejected" on unauthorized senders. Low-severity, a one-record change, and named honestly as a nit, not a vulnerability.
$ dig +short TXT uber.com | grep spf "v=spf1 include:uber.com._nspf.vali.email … include:mailgun.org ~all" # softfail $ dig +short TXT _dmarc.uber.com "v=DMARC1; p=quarantine; rua=mailto:[email protected]" # enforced — good
Framed as opportunity: Uber already has the DMARC posture and reporting to move SPF to -all safely; it's the cheapest possible hardening win and rounds out an already-strong baseline.
Evidence log: every claim, re-runnable
| # | Claim | Reproduction command | Result observed 2026-07-14 |
|---|---|---|---|
| 1 | llms.txt absent (browser); edge 406 to non-browser on all agent paths | curl -s -o /dev/null -w "%{http_code}" https://www.uber.com/llms.txt | 406 (curl); 404 (browser-shaped fetch) |
| 1 | robots invites /.well-known/ that the edge blocks | curl -s https://www.uber.com/robots.txt | grep -i well-known | allow: /.well-known/ |
| 1 | developer.uber.com root gone | curl -s -o /dev/null -w "%{http_code}" https://developer.uber.com/ | 404 |
| 2 | Zero-emission 2040 / 100% EV 2030 pledge, prose-only | WebSearch + Uber sustainability pages (public reporting) | Pledge confirmed; no machine-verifiable outcome object |
| 3 | ≈1M US drivers/couriers; ≈10M global; ≈42M trips/day | Public reporting (FY2025 figures) | Confirmed order-of-magnitude |
| 4 | SPF ~all softfail; DMARC p=quarantine enforced | dig +short TXT uber.com ; dig +short TXT _dmarc.uber.com | ~all ; p=quarantine |
| base | HSTS + SAMEORIGIN + nosniff present | curl -sI https://www.uber.com/ | grep -iE 'strict-transport|x-frame|x-content-type' | all three present (via Cloudflare) |
Every stage of Uber's business rests on the same thing EcoWealth makes verifiable: a bounded task, proven at a place, settled fast.
Supply liquidity: the more earners who reliably claim and complete tasks, the better the marketplace. Uber invests ($800M Green Future) to shape what work gets done, e.g. EV adoption.
EWP plug: fund ecological tasks into the same supply poolA distributed workforce coordinated by GPS + timestamp + rating. Proof of completion is captured on every trip, but stays private and off-chain.
EWP plug: public, tamper-evident, on-chain proof receiptsTrust and safety: riders trust the map, regulators trust the reporting. ESG/emissions commitments are a growing part of the license to operate.
EWP plug: verifiable proof-of-outcome under the 2040 pledgeUber already builds agentic AI and talks agent identity. The static, verifiable discovery + proof layer is the missing public complement.
EWP plug: the Agent Kit + settlement receiptsToday
With the Kit + Protocol
Not "let's talk." One bounded first step, priced as a rounding error at Uber's scale, that returns a verifiable on-chain receipt tied to the 2040 zero-emissions pledge.
Point any Uber AI agent at our live work-packet endpoint (standard x402, keyless). It returns a real work-packet object, the agent-legible door F1 shows is missing, proven in a single call.
Fund one restore packet in a city Uber already serves; a driver claims it on downtime, completes it with photo+GPS+signature, and it settles on-chain. The deliverable is the receipt, not a slide.
10 restore packets in one metro → 10 settled receipts + a tCO2e tally citable under the 2040 pledge. Fixed cost, reversible, proof before scale.
Why now: the 2040 commitment currently reads as prose an AI must paraphrase (F2). Each option above ends in a settled, independently-verifiable receipt: proof, then the conversation.
The through-line
The findings are opportunities on a strong base: an agent-legible door (F1), a verifiable outcome object under a real pledge (F2), the exact workforce already trained in the pattern (F3), and one cheap hardening nit (F4). Together they turn Uber's own motion into an on-ramp for proof-verified ecological work.
