Documentation▾
Agent Traffic Insights
Agent Traffic Insights answers a question most tools don't: which AI agents, crawlers, and bots are calling your API, what are they costing you, and can you say no to the ones you don't want?
As more traffic comes from AI agents and answer engines instead of browsers, a growing share of the requests hitting your API is automated — and undifferentiated in a normal access log. Agent Traffic Insights classifies that traffic, attributes it to the endpoint it called and a modeled cost, checks whether an agent is who it claims to be, and lets you block or rate-limit specific agents.
It lives in the app under Agent Traffic in the sidebar.
Scope: your Merlonix API
Agent Traffic Insights covers the requests made to your Merlonix API — the calls your integrations and any AI agents make to api.merlonix.com using your API key. It does not require you to install anything or change your own site; the attribution happens on requests Merlonix already sees.
What it shows
Every request is classified into a category:
| Category | What it means |
|---|---|
| AI agent | An autonomous agent acting on a task (for example, a coding or research agent calling your API). |
| AI crawler | A crawler that feeds an AI/answer engine's index. |
| Bot | A non-AI automated client (uptime checker, generic scraper, monitoring bot). |
| SDK / script | A first-party SDK or script — your own automation. |
| Human | An interactive, browser-shaped request. |
| Unknown | Not enough signal to classify confidently. |
For the window you pick (7, 30, or 90 days) the dashboard summarizes:
- Total requests and the share that is AI agent or crawler.
- Estimated cost — a modeled figure based on request volume and endpoint, so you can see which automated callers are the expensive ones. It is a planning number, not a bill.
- Error rate (5xx) and a requests-per-day trend.
- Denied requests — how many your control rules blocked or rate-limited.
- A by-category table and a top-agents table (agent, vendor, request count, identity, estimated cost, last seen).
Verified vs. spoofed identity
A User-Agent string is trivial to forge, so a request that says GPTBot isn't necessarily from OpenAI. Agent Traffic Insights forward-confirms identity where it can:
- Verified — the source IP forward-confirms to the vendor the User-Agent claims, via reverse DNS or the vendor's published IP ranges.
- Spoofed — the request claims a known agent but the source IP does not confirm. That is a security signal worth investigating, and it is surfaced prominently.
- Unverifiable — not enough information to confirm or deny.
Verification is informational — it never silently changes how a request is handled. A block or rate-limit rule you set still applies regardless of whether an agent verified.
Traffic control
Beyond visibility, you can act on what you see. A control rule matches on a dimension and takes an action:
| Dimensions | category (e.g. ai_crawler), vendor (e.g. OpenAI), or agent (e.g. gptbot). |
| Actions | Block — the matching agent gets 403 Forbidden. Rate limit — the agent gets 429 Too Many Requests once it exceeds your requests-per-minute cap. |
Rules apply to requests authenticated with an mk_live_ API key and take effect within about a minute. Add and remove them from the Traffic control panel on the Agent Traffic page; with no rules, traffic flows unrestricted.
Availability
Agent Traffic Insights is rolling out per workspace. If the Agent Traffic page shows "Agent Traffic Insights isn't enabled for this workspace," it is simply not active on your account yet — there is nothing for you to set up. Once it is enabled, the page fills in automatically as agent traffic is attributed; you never have to instrument anything.
Want it turned on, or have a traffic pattern you'd like to control? Get in touch.