Botscent

Detect AI agents on your site.

Botscent tells your site if an AI agent is browsing it, and which agent.

Star on GitHub77

5 KB · 0 deps · 5ms startup · MITCopies a setup prompt for your AI coding tool

Tested with

FAQ

How it works

What does Botscent detect?

AI agents that use a browser for someone, like Claude for Chrome, ChatGPT's agent, Codex, Muse, Manus, Devin and Grok Bot. It also detects crawlers, fetchers and HTTP clients that say what they are. If the evidence shows which agent it is, Botscent names it.

How does it work?

It has two parts. The server part reads what each request declares: a Web Bot Auth signature (checked against the keys in each release), a user-agent token, or your host's verified-bot field. The page part is a 5 KB script. It looks for the marks that agent browsers and extensions leave: the automation flag, the shape of their cloud browsers, the markers they draw, and input that arrives while the page is hidden. Both parts return the same object: { type, agent_name?, reasons }.

What does “human” mean?

Botscent found no agent evidence. It does not prove a person is there.

Privacy and performance

Does it send or store data?

No. The page script makes no network requests and sets no cookies or storage. It keeps the rules that matched, not the values it read. The server part reads request headers only. Nothing leaves the page unless your code sends it. Privacy lists every probe.

How fast is it?

About 5 KB gzipped, 0 dependencies. It starts in about 5 ms on a budget phone's CPU, with no long tasks. CI measures this on every change.

Using the verdict

Is it a bot blocker?

Not by itself. Botscent tells you what it sees, and your code decides what to do: block, adapt or log. A good start is to log verdicts for a week. If you change prices for agents, check the pricing rules where you sell.

Can I use it to allow or block access?

Only with the server's verdict and isVerified. It is true when a signature matches the signer's published keys. Anyone can send a name, and page scripts can fake a page result. Use those to adapt and to measure, not for access. The trust model has the details.

Cost, license, who

What does it cost?

Nothing. MIT license. No account, key or service.

Who builds it?

Nalin Bhardwaj (nibnalin.me). A fun hack, tested against real runs of each agent.

It missed an agent. What do I do?

Open a GitHub issue with the agent's name and how you ran it.

More in the docs.