nalinbhardwaj / botscent

# Botscent
Botscent tells your site if an AI agent is browsing it, and which agent.
Website · Docs · Install with one prompt
- **Names the agent.** Instinct, Muse, OpenAI Dot, Grok Bot, Claude for Chrome, ChatGPT for Chrome, Manus, Devin, Codex and more.
- **About 5 KB.** 0 dependencies. Starts in about 5 ms on a budget phone. Measured in CI.
- **Sends nothing.** No network requests, no cookies, no storage.
- **When an agent visits:** hide ads, change prices, log agents, simplify pages or block agents.
- **TypeScript and Python.** Next.js, React, Vue, Nuxt, SvelteKit, Astro, Express, Hono, Cloudflare Workers, Netlify, Vercel, FastAPI, Django and Flask.
 [code] 
## How it works
Botscent has two halves. Each returns a verdict: `agent` or `human`, with the agent's name when the evidence shows it.
- **The server half** reads the request headers. It checks a Web Bot Auth signature, a user-agent token and your host's verified-bot field. It verifies signatures against keys bundled in each release. It calls no service.
- **The page half** watches the page for marks that agents leave: the automation flag, agent cloud browsers, extension markers, and input on a hidden page. After it finds an agent, the page verdict stays `agent`.
The server half finds agents that sign or declare their requests. The page half finds agents inside a person's browser.
## Install with one prompt
Paste this prompt into Claude Code, Cursor, Codex or Copilot:
 [code] 
The agent follows the quickstart below.
## Quickstart
 [code] 
Each framework below has a tested app in `examples/`. After the install, run `npx botscent check ` (Verify).
### Next.js
 [code] 
Before Next.js 15.3, render ` ` from `botscent/react` once in the root layout.
 [code] 
 [code] 
If you already have a proxy, wrap it. Do not replace it: `export const proxy = withBotscent(existingProxy)`, with `withBotscent` from `botscent/next`. Before Next.js 16, wrap the middleware the same way.
 [code] 
In a route handler, get the request's own verdict with `await inspect(request)`, from `botscent/server`.
### React, Vue, Nuxt, SvelteKit, Astro
 [code] 
 [code] 
 [code] 
 [code] 
 [code] 
SvelteKit and Nuxt have no server adapter. To get the request's own verdict in a route, call `inspect`:
 [code] 
 [code] 
### A plain script tag
 [code] 
The script has no inline code and no `eval`. With a strict Content Security Policy, allow the script's origin in `script-src` (`'self'` if you serve it). Or put a nonce on the tag and use `'strict-dynamic'`. A bundled import needs no change.
The script adds `window.botscent` (`verdict`, `subscribe`, `reportHeaders`, `diagnostics`, `start`, `VERSION`). It sends a `botscent` event on each verdict change.
### Express, Hono, Cloudflare Workers, Netlify, Vercel
 [code] 
 [code] 
 [code] 
 [code] 
 [code] 
### Python: FastAPI, Starlette, Django, Flask
 [code] 
 [code] 
 [code] 
 [code] 
## Verify
 [code] 
`check` does three things:
1. It requests the page twice: once with its own user agent, a