Open-source AI traffic detection for websites

Know when ChatGPT, Claude, Perplexity, and Gemini visit your site.
Cryptographic verification. Zero false positives.

Website • Documentation • Security • Community

When users copy a URL from ChatGPT, Claude, or Perplexity:

• ❌ No referrer header (browser security blocks it)
• ❌ No UTM parameters (AI doesn't add them)
• ❌ Google Analytics shows "Direct Traffic"

This traffic is invisible. For many sites, it's 15-30% of visitors.

Loamly detects AI traffic using RFC 9421 cryptographic signatures — the same standard used by OpenAI, Anthropic, and Google for their AI agents.

Loamly offers multiple deployment options based on your needs:

Tier 1 (Managed Proxy) is recommended for root domains that can't use CNAME records. We handle SSL, caching, and verification automatically.

Package	Description	npm
@loamly/edge	Detect AI bots at the edge (Cloudflare Worker)
@loamly/tracker	JavaScript tracker for websites

Just point your domain's A record to our edge proxy:

your-domain.com  A  37.16.7.18

We handle SSL (Let's Encrypt), RFC 9421 verification, and proxying to your origin automatically. Perfect for root domains that can't use CNAME. Security details →

Deploy our edge detector to your Cloudflare account:

git clone https://github.com/loamly/loamly.git
cd loamly/packages/edge

# Set your secrets
npx wrangler secret put LOAMLY_WORKSPACE_ID
npx wrangler secret put LOAMLY_WORKSPACE_API_KEY

# Deploy
npx wrangler deploy

Script tag:

<script defer data-domain="your-site.com" src="https://app.loamly.ai/t.js"></script>

NPM:

npm install @loamly/tracker

import { loamly } from '@loamly/tracker'

loamly.init({ domain: 'your-site.com' })
loamly.track('signup_started')
loamly.conversion('purchase', 99.99)

When ChatGPT or Claude visits your site, they sign their requests with Ed25519 signatures:

Signature: sig1=:MEQCIFvN...base64...:
Signature-Input: sig1=("@method" "@target-uri" "@authority");created=1734567890;keyid="..."

We verify these signatures against OpenAI's public keys (JWKS). No heuristics. No false positives.

User → your-domain.com
    → Loamly Proxy (or Cloudflare Worker)
    → Verify RFC 9421 Signature
    → Forward to Origin (unchanged)

• 🔒 No cookies (uses sessionStorage)
• 🔒 No IP storage (hashed for deduplication, then discarded)
• 🔒 GDPR compliant by default
• 🔒 No consent banner needed for basic analytics

See our Security & Trust documentation.

Your Website
└── <script src="app.loamly.ai/t.js">
    ├── Navigation Timing detection
    ├── Behavioral ML classification  
    ├── Focus/Blur analysis
    └── Event tracking
              │
              ▼
Edge Verification (Cloudflare Worker or Managed Proxy)
├── RFC 9421 signature verification
├── Ed25519 cryptographic validation
├── AI bot User-Agent detection
└── Cookie attribution
              │
              ▼
Loamly Platform (or self-hosted)
├── Temporal matching (Bayesian)
├── Bot crawl correlation
├── Dashboard
└── AI brand monitoring

You can self-host everything. See the self-hosting guide.

We love contributions! See CONTRIBUTING.md.

# Clone
git clone https://github.com/loamly/loamly.git
cd loamly

# Install
pnpm install

# Build all packages
pnpm build

# Development mode
pnpm dev

• GitHub Discussions — Questions & ideas
• GitHub Issues — Bug reports

MIT © Loamly

loamly.ai · Security · Twitter