Install the collector.

Install in three steps

1. 01

   Set your keys

   Your workspace shows an ingest key once, when you create it. Keep it in your secrets manager. We recommend setting the hash secret too. Generate it yourself with openssl rand -hex 32; we never see it. It is also what lets us tell real AI crawlers from fakes on your site. Without it we group callers less precisely and cannot check crawlers that claim to be a well-known AI bot. We never see a visitor's address or can derive one from the hash; the only full IPs we receive belong to crawlers claiming to be a known AI bot, so we can check them.

   PRIMETRA_INGEST_URL=https://ingest.primetra.ai/v1/eventsPRIMETRA_INGEST_KEY=<your-ingest-key>IP_HASH_SECRET=<output of: openssl rand -hex 32>

2. 02

   Add a collector

   Pick the one closest to your traffic. Full steps and a diagram for each are further down.

   Cloudflare WorkerNext.js middlewareMCP SDK

   $ npm install @primetra/collector-cloudflare

   export { default } from "@primetra/collector-cloudflare";

   All steps for Cloudflare Worker
3. 03

   See the first event

   Within a few minutes of the first bot visit, your workspace shows the collector as healthy. If it goes quiet later, we tell you.

   Install checkWhat you'll see

   CFCloudflare WorkerHealthy

   First event receivedSample eventClaudeBot· fetched / · ok (200)

Cloudflare Worker

Any site behind Cloudflare.

1. 01Add the package to a new Worker

   $ npm install @primetra/collector-cloudflare

2. 02Export the collector

   It passes every request to your origin unchanged and does its work after the response is on its way.

   export { default } from "@primetra/collector-cloudflare";

3. 03Route it in front of your site

   name = "primetra-collector"main = "src/index.ts"compatibility_date = "2026-10-01"routes = [{ pattern = "yourdomain.com/*", zone_name = "yourdomain.com" }][vars]PRIMETRA_INGEST_URL = "https://ingest.primetra.ai/v1/events"

4. 04Add the secrets and deploy

   $ npx wrangler secret put PRIMETRA_INGEST_KEY$ npx wrangler secret put IP_HASH_SECRET$ npx wrangler deploy

• Runs inside ctx.waitUntil, so it adds no latency to your responses.
• Any error inside the collector is swallowed. Your site never notices.

Next.js middleware

Next.js apps on Vercel or anywhere else.

1. 01Install the package

   $ npm install @primetra/collector-next

2. 02Add it to your proxy

   Next.js 16 calls this file proxy.ts. On older versions it's middleware.ts.

   import { primetraMiddleware } from "@primetra/collector-next";// Already have a proxy? Wrap it instead: export default withPrimetra(yourProxy);export default primetraMiddleware();export const config = {  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],};

3. 03Set the environment variables

   Add the three variables from “Set your keys” to your hosting provider, then redeploy.

• Sends in the background, after your response is on its way.
• Vercel log drains don't include request headers. Use the middleware, not a drain, if you want bot verification.

MCP SDK

Your own MCP server. Needed for “got data” and “came back”.

1. 01Install the package

   $ npm install @primetra/mcp

2. 02Instrument your server

   One call after you register your tools. It never changes your tool schemas.

   import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";import { instrument } from "@primetra/mcp";const server = new McpServer({ name: "your-server", version: "1.0.0" });// ...register your tools...instrument(server, {  ingestKey: process.env.PRIMETRA_INGEST_KEY!,  endpoint: process.env.PRIMETRA_INGEST_URL,  ipHashSecret: process.env.IP_HASH_SECRET,});

• Tool arguments are never sent by default. Redacted capture is opt-in and, today, local only: it labels probe calls on your server and sends the label, not the values.
• It records method, tool, client, duration and outcome (data, empty, error, rejected).

What leaves your stack

One exception: when a user agent claims to be a known vendor bot that publishes its addresses (GPTBot, Googlebot, ClaudeBot), the collector sends the full IP so we can check it against the vendor's published ranges. Our queue holds it only until that check; it is never stored.