Agent Tracking

What AI agents do on your site

The check tells you whether agents can use your site. This tells you what they do with it: who sends them, which pages they fetch, which of your WebMCP tools they call, and whether they finish. One snippet, one dashboard, no cookies, no personal data, hosted in Germany.

Install

Add your site in the dashboard, then put this line on every page. The domain in data-domain has to be the one you registered; events for any other domain are dropped at the door.

<script defer data-domain="example.com" src="https://webmcp-tool.com/agent.js"></script>

Under five kilobytes, plain JavaScript, no framework, no dependencies. It sends small batches to /api/event with sendBeacon, so a click that leaves the page still lands. The script has no integrity hash on purpose: it is updated in place when a new agent appears in the list below.

Three layers

A. AI referrals

A visitor arrives from an assistant: the referrer is matched against a maintained list of assistant hosts, plus utm_source patterns. Recorded as the assistant and the landing path.

B. AI fetches

An assistant loads a page and runs its scripts: the user agent of the request that carries the beacon is matched against the same list. The matching is done on our server from the request headers, not in the snippet, so the list stays in one versioned place and the snippet stays small.

C. WebMCP tool calls

The part nobody else measures. The snippet wraps document.modelContext (and the deprecated navigator.modelContext), so every registration and every call is recorded: tool name, duration, success or failure, error class, and the names of the input keys. Declarative tools on forms are caught on submit.

What this cannot see

A crawler that does not run JavaScript never executes the snippet. GPTBot, ClaudeBot and their kind mostly fetch raw HTML, so they appear here only when they render the page. Counting them needs the server log. For webmcp-tool.com itself that import runs every quarter hour and feeds the same dashboard, including fetch bursts (one agent, several pages, a few seconds: what a query fan-out looks like from your side). For your site, upload the log on the settings page or let a cron send it daily with the API token; nginx or Apache combined format, plain or gzipped, whole files are fine. Where the vendor publishes address ranges (OpenAI, Perplexity, Microsoft, Google, Apple) each line is checked against them, and a claimed agent from elsewhere is shown as unverified rather than counted.

Tools and goals

Nothing to change in how you register tools. Register them as the specification says and the snippet sees them:

await document.modelContext.registerTool({
  name: "search_products",
  description: "Search the catalogue by free text.",
  inputSchema: { type: "object", properties: { query: { type: "string" } }, required: ["query"] },
  annotations: { readOnlyHint: true },
  execute: async ({ query }, { signal }) => { /* ... */ },
});
// agent.js wraps registerTool and provideContext before this runs:
// the registration, every call, its duration, success or failure and
// the argument key names are recorded. Values never are.

Declarative tools are forms with a toolname. Add data-agent-goal to any element to mark a conversion, such as an order placed or a booking confirmed:

<form toolname="book_table" tooldescription="Book a table for a date and party size."
      action="/book" method="post">
  <input name="date" type="date" required>
  <input name="guests" type="number" min="1" required>
  <button type="submit" data-agent-goal="table_booked">Book</button>
</form>

If you publish a manifest at /.well-known/webmcp, the snippet hashes it once per visit, on the page the visit enters through. The dashboard shows when it last changed; Pro accounts can be alerted.

What is recorded, and what is not

Recorded	Never recorded
Page path, without query string	Query strings, fragments, form values
Referrer host and utm_source, when they name an assistant	Full referrer URLs
Tool name, duration, success, error class, input key names	Input values, output values
A session id: daily random salt, your domain, a coarse browser class and the address, hashed	The address itself, cookies, storage, fingerprints, any durable identifier
Which AI agent, from a maintained list (version 2026-09-08)	Full user agent strings

Raw events are kept for 90 days and then deleted; daily totals are kept for as long as the site exists. Everything is stored on our own server in Germany. Removing a site deletes all of it. Our privacy notice has the formal version, and the data processing agreement is concluded when you add a site.

Plans

During the pilot every account is on Free, and paid plans are not open yet. Need more while the pilot runs? Write to hi@webmcp-tool.com and we switch your account by hand. The product page has the terms of the pilot.

Plan	Sites	Agent events per month	History	Extras
Free	1	10,000	30 days	none
Pro	5	500,000	365 days	manifest change alerts
Agency	unlimited	5,000,000	365 days	manifest change alerts, white-label badge

Prices are shown at checkout in the dashboard. Free needs no card.

Your numbers, in your own tools

Everything the dashboard shows is available as JSON and as an MCP tool, so your own scripts, notebooks and agents can read it. Create the token on a site's settings page; it is shown once and belongs to the account, so it reads every site on it. Read-only, daily totals only, no raw events.

curl -s https://webmcp-tool.com/api/stats/example.com?days=30 \
  -H "Authorization: Bearer wmt_your_token"

The same token sends your server log. Whole files are fine, daily from a cron; lines at or before the newest line already imported are skipped, so nothing is counted twice:

curl -sS -X POST https://webmcp-tool.com/api/logs/example.com \
  -H "Authorization: Bearer wmt_your_token" \
  -H "Content-Type: text/plain" --data-binary @/var/log/nginx/access.log

GET /api/stats with the same header lists the sites the token can read. days is capped by the plan's history. The answer carries totals, the previous period for trends, the day series, the agents with share and trend, the tools with success rate and average duration, and the busiest pages.

Over MCP, add our server with the token as a header and ask in words. Claude Desktop, Cursor and most clients take a configuration like this:

{
  "mcpServers": {
    "webmcp-tool": {
      "url": "https://webmcp-tool.com/api/mcp",
      "headers": { "Authorization": "Bearer wmt_your_token" }
    }
  }
}

Then: “Which agents read example.com this week?” The client calls get_agent_stats and gets the same JSON. A client that cannot set headers can pass the token in the tool's token argument instead.

The agents on the list

Version 2026-09-08. Referrers: ChatGPT, Perplexity, Claude, Microsoft Copilot, Google Gemini, You.com, Mistral Le Chat, Meta AI, Grok, DeepSeek, Phind, Kagi Assistant, DuckDuckGo AI, Poe, HuggingChat. User agents: ChatGPT-User, OAI-SearchBot, GPTBot, ClaudeBot, Claude-User, Claude-SearchBot, Claude-Web, anthropic-ai, PerplexityBot, Perplexity-User, Google-Extended, GoogleOther, Gemini Deep Research, Applebot-Extended, Bytespider, CCBot, Amazonbot, Meta-ExternalAgent, Meta-ExternalFetcher, FacebookBot, Bingbot, DuckAssistBot, YouBot, MistralAI-User, cohere-ai, Diffbot, Timpibot, Omgili, PetalBot, AI2Bot, img2dataset, Kangaroo Bot, iAskBot, Browser Use, OpenAI Operator, Claude Computer Use. Missing one? Write to hi@webmcp-tool.com.