# No magic. Just rules you can read.

> Punchline sees every request to your site before the page is sent, decides what made it, and shows you exactly why.

## Field notes on who's reading your site.

- **Signed agent:** Shows its ID at the door. Gets in. (why: signature verified; tier: verified)
- **Impostor:** Nice mustache. Wrong address. (why: claims a crawler name, address doesn't match; tier: inferred, high)
- **Crawler:** Reads every page. Buys nothing. (why: declared name, published address; tier: declared)
- **Fetcher:** In and out. Never runs your tag. (why: non-browser client; tier: inferred, high)

## At the edge, not in the browser

Punchline runs in your site's server-side request handling (Next.js) or in a Cloudflare Worker in front of your site. Every request passes through it, including the ones that never run JavaScript. Nothing is added to your pages, and the event is sent after your page has gone out, so visitors don't wait for it.

On Squarespace and Wix, which can't run server code, a small snippet does the same job from the page. It sees fewer agents, and your reports say so.

## Every visit gets a label, and the label shows its work

- **Signed agents:** the request carries a cryptographic signature (Web Bot Auth) from a known operator such as OpenAI.
- **Declared agents and crawlers:** the visitor says it's GPTBot, ClaudeBot or Googlebot, and its IP address matches that company's published ranges.
- **Impostors:** the visitor claims a well-known crawler's name, but its address doesn't match.
- **Fetchers:** tools such as curl and Python's requests library, or clients asking for plain text or llms.txt.
- **Headless browsers:** browsers driven by automation.
- **Patterns:** a regular browser from a cloud data center, or requests at a machine-like steady pace. These are lower confidence, and you can leave them out.
- **People sent by AI:** visitors who clicked through from an AI assistant.

Each label records which rules fired and the evidence, so you can check any number. Choose how strict to be: confirmed only, confirmed plus likely, or everything.

## What you see

- Overview: people versus agents over time.
- Agents by operator, with each session rebuilt from the requests it made (from server records, never screen recordings).
- Accounts: which companies' agents and people researched you, by intent (pricing, security, comparisons), for sales.
- Top pages by visitor type, and AI referrals.
- GA4 reconciliation: how your Google Analytics numbers compare, and why they differ.

## From agent research to the journeys and companies it leads to

- **Agents in someone's browser** share that person's connection and browser, so their research joins the person's visit the same day, using the daily visitor hash. No cookie, and nothing stored on the device.
- **Companies,** when your server sends the domain of a work email someone gave you with a form event. We keep the domain, never the address, and ignore personal mail like gmail.com. That person's day, and any agent working in their browser that day, then belongs to the company.
- **Agents in the cloud** carry their operator's signature, which names OpenAI or Anthropic, never the buyer. Punchline counts them and shows what they read, but doesn't pretend to know who sent them.
- **Handoff links** close that gap when an agent builds something: a quote, a booking, a configuration. Your site gives the agent a link to pass on, and when its person opens it, their visit joins the agent's work and whatever they do next. In our tests, agents passed these links on every time they finished the task. [Handoff links](https://www.punchlineanalytics.com/docs/handoffs)

Every connection carries its evidence and confidence, and the Where agents run report shows how much of your agent traffic can be connected at all.

## Serving agents, not just counting them

With the edge install, you can turn on markdown for AI agents: assistants fetching your pages get a markdown version made from the same HTML response people get. Same facts, different format. Search engines and people always get your HTML, and anyone can ask for the markdown by adding .md to a URL.

## What's hard to see

Some AI agents work inside a person's own browser, and from the server they look just like that person. Punchline's optional snippet spots many of them from automation traces and input patterns (counts only, never keystrokes or text). Where it can't tell, Punchline counts what it can verify and labels everything else plainly.

[See your whole funnel](https://www.punchlineanalytics.com/reveal)