@echoranked/tracker

Server-side AI crawler tracking for EchoRanked, plus the cookieless visitor snippet.

AI crawlers mostly request raw HTML and never run your frontend JavaScript, so a browser snippet cannot see them. This package reports those requests from your server instead. EchoRanked classifies the crawler, verifies its source IP against the operator's published ranges, and shows what each bot fetched — and what it got back.

npm install @echoranked/tracker

Generate an ingest key under Project settings → Connections, keep it in a server-side environment variable, then install whichever adapter matches your stack.

Cloudflare Workers, Hono, Deno, Bun (recommended)

Wrapping the handler is the only shape that sees the response, so it is the only one that can record the status a crawler received.

import { withCrawlerTracking } from "@echoranked/tracker/fetch";

export default {
  fetch: withCrawlerTracking(handler, {
    endpoint: "https://app.echoranked.com/api/crawlers/collect",
    ingestKey: env.ECHORANKED_INGEST_KEY,
  }),
};

Express / Node

import { crawlerMiddleware } from "@echoranked/tracker/node";

app.use(
  crawlerMiddleware({
    endpoint: "https://app.echoranked.com/api/crawlers/collect",
    ingestKey: process.env.ECHORANKED_INGEST_KEY!,
  }),
);

Next.js middleware

Middleware runs before the response exists, so it reports the path, host and referrer but no status. Wrap your route handlers with /fetch as well if you want to see which pages return errors to crawlers.

import { NextResponse } from "next/server";
import { crawlerMiddleware } from "@echoranked/tracker/next";

const track = crawlerMiddleware({
  endpoint: "https://app.echoranked.com/api/crawlers/collect",
  ingestKey: process.env.ECHORANKED_INGEST_KEY!,
});

export function middleware(request, event) {
  track(request, event);
  return NextResponse.next();
}

Any other backend

One POST per batch, up to 50 events:

POST /api/crawlers/collect
Authorization: Bearer <ingest key>
Content-Type: application/json

{"events":[{"ua":"…","path":"/pricing","ip":"…","status":200,"host":"example.com"}]}

What is sent, and what is not

Asset requests (/_next/*, CSS, images, fonts) are filtered out before anything is posted: they are not page fetches, and counting them would make every number larger and less true. robots.txt, llms.txt, llms-full.txt and sitemaps are always reported — a crawler reading them is the signal you published them for.

Nothing about your human visitors is sent, no cookies are set, and the IP is used only to verify the crawler against its operator's published ranges.