Coming soon · open source · Apache-2.0

Know which AI agents are really hitting your site

Anyone can put GPTBot in a user agent. eunox reads your gateway's access logs, checks Web Bot Auth signatures, published IP ranges and reverse DNS, and tells you which agents are who they claim to be and which are spoofing. Observe-only: nothing in the request path, zero added latency, and no data leaves your environment.

No spam. One email when it launches.

Sneak peek

A log format and a reload

No plugin and no binary added to your gateway. Point nginx or Envoy's access log at eunox and every request gets exactly one classification.

              📄
              nginx.conf
            

              # Log what eunox needs. Nothing else changes.
log_format eunox escape=json
  '{"ts":"$time_iso8601",'
  '"method":"$request_method",'
  '"host":"$host",'
  '"path":"$request_uri",'
  '"ip":"$remote_addr",'
  '"ua":"$http_user_agent",'
  '"sig":"$http_signature",'
  '"sig_input":"$http_signature_input",'
  '"sig_agent":"$http_signature_agent"}';

# Ship it out of band over syslog.
access_log syslog:server=127.0.0.1:5140 eunox;
            

eunox · sample output

$ eunox report --window 24h agent class requests ChatGPT-Agent verified 1,284 ClaudeBot ip-verified 912 Googlebot ip-verified 640 GPTBot spoofed 317 PerplexityBot verified 208 python-requests unknown-bot 1,902 (other) unclassified 48,115 ✗ GPTBot ×317 from 203.0.113.0/24: no signature, not in OpenAI's published ranges

How it works

Verify, don't trust the user agent

🔏

Signature first

Web Bot Auth (RFC 9421) signatures are checked against each operator's published key directory, at the timestamp in the log.

🌐

IP and DNS fallback

Unsigned agents are matched against published IP ranges and forward-confirmed reverse DNS for the operator they claim to be.

🛡️

Out of your request path

eunox reads logs, not traffic. It can't slow your site down or break it, and your data never leaves your environment.