How do I measure what AI agents do on my website?

What counts as observed activity

Crawler requests, identifiable assistant referrals and instrumented tool calls have different meanings. Nearby requests form a burst, but do not reveal a question; a browser tool call does not prove who initiated it.

Keep the event source, page or tool and evidence level alongside each count.

Step 1: browser snippet

Add your site and install the snippet. It records recognized assistant referrals, supported browser WebMCP activity and goal attempts. It sets no cookies and does not store raw network addresses. Remote MCP calls and confirmed outcomes require separate server integrations.

<script defer data-domain="example.com" src="https://agenttracking.co/agent.js"></script>

Step 2: your server log for crawlers

Most crawler requests do not run JavaScript. Upload an origin access log or send it through the authenticated log endpoint. Supported bot claims are checked against current published ranges; absent or failed verification is shown separately and is not proof of malicious intent.

curl -sS -X POST https://agenttracking.co/api/logs/example.com \
  -H "Authorization: Bearer wmt_your_token" \
  -H "Content-Type: text/plain" --data-binary @/var/log/nginx/access.log

Step 3: read the evidence

Overview separates referrals, fetch claims, verified HTML requests, observed tool calls, browser attempts and server receipts. Agents shows source and verification status; Tools shows technical outcomes; Pages shows requested paths.

A burst needs distinct relevant paths close together in one import batch. It does not reveal a question or intent.

Step 4: use protected exports

Authorized readers can query site metrics as JSON or through the MCP read endpoint. Ask for verified fetches and observed tool failures, keeping unknown bot identity explicit.

{ "mcpServers": { "agent-tracking": { "url": "https://agenttracking.co/api/mcp",
  "headers": { "Authorization": "Bearer wmt_your_token" } } } }

In short