@maango/vercel

AI agent permissions for Vercel. Block AI training crawlers, preserve search engine SEO, allow AI assistants browse-only access — enforced at the edge in real time.

npm install @maango/vercel

Quick start

Create middleware.ts in your project root:

// middleware.ts
export * from '@maango/vercel';

Set one environment variable on your Vercel project:

MAANGO_VERTICAL=ecommerce

That's it. Redeploy. AI training crawlers (GPTBot, ClaudeBot, Bytespider, CCBot, Google-Extended, etc.) now get a structured 403; Googlebot and human visitors pass through unchanged.

What gets blocked, what doesn't

| Category | Examples | Default behavior | |---|---|---| | Search engines | Googlebot, Bingbot, DuckDuckBot, Yandex | ✅ Allowed — your SEO is untouched | | AI search bots | Claude-SearchBot, OAI-SearchBot, PerplexityBot, Applebot | ✅ Allowed — referral traffic preserved | | AI assistants | ChatGPT-User, Claude-User, Perplexity-User, Meta-ExternalFetcher | ✅ Browse-only — can read, can't submit forms | | AI training crawlers | GPTBot, ClaudeBot, CCBot, Google-Extended, Bytespider | ❌ Blocked — your content stays out of training corpora | | Automation tools | curl, scrapers, headless browsers | 👀 Monitored — logged, not blocked | | Real humans | Chrome, Safari, Firefox, mobile browsers | ✅ Fast-pathed — never touch the policy engine |

Vertical presets

Pick the one closest to your site. Each preset comes with curated path-level rules.

| Vertical | What it's tuned for | |---|---| | ecommerce (default) | DTC stores, marketplaces, Shopify-style sites | | saas | B2B web apps with logins, dashboards, billing | | publisher | Blogs, news sites, paywalled content | | marketing | Landing pages, lead-gen, agencies | | regulated | Healthcare, legal, government (strictest) | | personal | Portfolios, resumes, personal blogs | | community | Forums, review sites, UGC platforms | | healthcare | Hospitals, clinics, telehealth | | legal | Law firms, legal directories | | government | Federal/state/local government sites | | education | Schools, universities, MOOCs |

Set it via env var:

MAANGO_VERTICAL=saas

Environment variables

| Var | Purpose | Default | |---|---|---| | MAANGO_VERTICAL | Which preset to use | ecommerce | | MAANGO_MODE | enforce (default) or monitor_only | enforce | | MAANGO_FAIL_OPEN | If something goes wrong: allow (true) or block (false) | true | | MAANGO_LOG_LEVEL | silent | errors | all | all | | MAANGO_DISABLED | Kill switch: true bypasses middleware | unset | | MAANGO_WEBHOOK_URL | If set, POST every event to your own analytics endpoint | unset |

What blocked agents see

HTTP/1.1 403 Forbidden
Content-Type: application/json
X-Maango-Decision: deny
X-Maango-Agent-Category: ai_training
X-Maango-Agent-Name: GPTBot

{
  "error": "agent_action_denied",
  "agent_category": "ai_training",
  "agent_name": "GPTBot",
  "documentation": "https://maango.io/agents/getting-allowed"
}

Existing middleware? Compose it

// middleware.ts
import { NextResponse, type NextRequest } from 'next/server';
import { maango } from '@maango/vercel';

export const config = {
  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
};

export async function middleware(req: NextRequest) {
  const decision = await maango(req);
  if (decision.shouldEnforce) return decision.response;

  // your own auth / redirects / a/b testing here
  return NextResponse.next();
}

Onboard risk-free

Want to watch traffic for a week before enforcing?

MAANGO_MODE=monitor_only

Every decision is logged in your Vercel function logs, but no requests are blocked. Flip to enforce once you're comfortable.

Compatibility

• Next.js 13.4+
• Vercel Edge Runtime (default)
• Node.js 18+

License

This package is licensed under the Maango Plugin License (see LICENSE). For commercial inquiries: [email protected]

Built by Maango.