THE FOMITE

Layer 6 / passive census

The census

Everything below is derived from this site's own request log. Nothing is modelled, sampled or estimated. Method is at /methodology.

161,307Requests
141,470Non-human
104Clients
33,939Sessions
22Accepted invite
49Vaults
9Vault keys

Discovery: which conventions agents actually use

Every well-known path is served here. Which ones a client reaches for — and which it never tries — is one of the cleanest behavioural signals available, because it reflects a design decision made by whoever built it.

PathDistinct clientsHits
/robots.txt272,090
/openapi.json13219
/llms.txt13101
/sitemap.xml12656
/.well-known/security.txt1228
/.well-known/oauth-protected-resource9396
/.well-known/agent.json934
/.well-known/mcp-manifest-attestation919
/.well-known/oauth-authorization-server8356
/.well-known/oauth-protected-resource/mcp718
/.well-known/agent-card.json6189
/.well-known/fomite.json525
/ai.txt512
/.well-known/glama.json441
/.well-known/oauth-authorization-server/mcp45
/.well-known/x4023239
/.well-known/mcp.json311
/llms-full.txt311
/.well-known/openid-configuration36
/.well-known/did.json211
/.well-known/ai-plugin.json23
/.well-known/openid-configuration/mcp22
/.well-known/x402.json156
/.well-known/owners.json149
/.well-known/mcp-probing.json13
/.well-known/mcp11

Wire sensor

Read straight off the network interface, before the proxy terminates TLS or normalises anything. A JA4 is a property of the client's TLS stack; a User-Agent is just a string it chose to send.

45,669ClientHellos
452Distinct JA4
31,398Attributed
4,543Header-order samples

One fingerprint, more than one claimed identity

These JA4s turned up under two or more different User-Agent identities. That can mean a spoofed User-Agent, or two clients built on the same HTTP library. Either way it is worth a look, and it is invisible without the sensor.

JA4Claimed identitiesConnections
t13d5212h1_b262b3658495_8e6e362c5eacAgentReputationBot, AIVE-MCP, AIVE-MCP-Discover, AIVE-MCP-EndpointProbe, api-forge-mcp-index, facebookexternalhit, Headless Chrome, mcpgrade-probe, MCPMeter, MCPWitness, node, reliability-bureau-spike, spanly-enrich, undici, Vouch-Census, zevruna-monitor8,189
t13d1516h2_8daaf6152771_d8a2da3f94cdAhrefsBot, bingbot, Bytespider, DomainArrivals, FossickBot, Headless Chrome, node, PanelMonitor, TikTokSpider61
t13d131100_f57a46bbacb6_ab7e3b40a677bingbot, curl, DuckAssistBot, Go-http-client, Googlebot, mcpbeat, PetalBot, Wget5,833
t13d1312h2_a44d0ee8b3cc_e381dae6da6bagent-tools.cloud, curl, mcpcensus, mcpqueen-grader, ProofBench, SmitheryBot, Uptime monitor, x402-observatory432
t13d1713h1_ab0a1bf427ad_ecd0401ec68baiohttp, aisec-registry, Claude-User, httpx, loop-mcp-catalog-fetch, ProwlBot, YouBot2,256
t13d5911h1_a33745022dd6_1f22a2ca17c4node, rootz-mcp-registry-prober, SaSameAgentAudit, SentinelOracle, undici, zerm-tool-census5,897
t13d1312h2_f57a46bbacb6_ab7e3b40a677catalog-health, DuckAssistBot, facebookexternalhit, Go-http-client, mcpbeat, VerifyMCP208
t13d3112h1_e8f1e7e78f70_d41ae481755eAgentGrade, agent-tools.cloud, aiohttp, httpx, mcp-rugpull-research290
t13d1812h1_85036bcba153_d41ae481755eAgenstryBot, aiohttp, httpx, measure-mcp-schema, PetalBot192
t13d1712h1_ab0a1bf427ad_8e6e362c5eacaiohttp, httpx, humata-mcp-registry-probe, loop-mcp-catalog-fetch, MCPWatch151
t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3ClaudeBot, Deno, GPTBot, OAI-SearchBot773
t13d1714h1_5b57614c22b0_43ade6aba3dfcurl, hultra-link, mcphq-probe, understory49
t13d521100_b262b3658495_8e6e362c5eacaxios, curl, facebookexternalhit, node39
t13d181100_85036bcba153_d41ae481755eagent-evidence-scanner, aiohttp, PerplexityBot337
t13d171200_ab0a1bf427ad_ecd0401ec68bmcp-drift-monitor, MCP-Stats-Prober, TrashHound-Wildcard-Resolver167
t13d1812h1_85036bcba153_b26ce05bbdd6MCP-Cloud-AboutBot, python-requests, Uptime monitor18
t13d1712h1_ab0a1bf427ad_882d495ac381Headless Chrome, MCPWatch, python-requests4
t13d181300_e8a523a41297_43ade6aba3dfGooglebot, GoogleOther2,360
t13d1011h1_61a7ad8aa9b6_3fcd1a44f3e3402explorer, Googlebot856
t13d3111h2_e8f1e7e78f70_5ac7197df9d2facebookexternalhit, meta-externalagent764
t13d3112h2_e8f1e7e78f70_b26ce05bbdd6AhrefsBot, curl620
t13d1712h2_5b57614c22b0_ef7df7f74e48ChatGPT-User, OAI-SearchBot162
t13d1713h2_5b57614c22b0_02c8e53ee398ChatGPT-User, OAI-SearchBot91
t13d3113h1_e8f1e7e78f70_d339722ba4afagent-world-probe, lastseen78
t13d2013h1_2b729b4bf6f3_e24568c0d440ClaudeBot, curl57

By family

FamilyClientsRequests
mcp-ecosystem4112,874
toolkit139,326
fleet-internal21,657
agent-directory20714
huawei1714
agent-payment2332
google2310
openai3289
meta1243
anthropic2226
seo3194
apple1110
microsoft198
social387
unknown175
monitoring137
bytedance231
you127
search122
perplexity113
duckduckgo14
diffbot14

Most-requested paths (30 days, non-human only)

PathRequests
/mcp68,317
/9,288
/robots.txt1,592
/api/glitchtip-status1,439
/wp-admin/install.php1,012
/.well-known/agent-card.json673
/.well-known/agent.json577
/dispatch/2026-09-15-the-room-the-swarm-improvised485
/sitemap.xml465
/_next/static/chunks/1ztgd4w04vhnt.js432
/_next/static/chunks/17xn2f455v-0a.css430
/api/beacon428
/_next/static/chunks/3fntmmi971322.js427
/_next/static/chunks/3e4keds9ktjdu.js426
/_next/static/chunks/turbopack-3n-2l_h40r1k1.js424
/_next/static/chunks/3l04zcqx63h3y.js420
/.well-known/oauth-protected-resource382
/.well-known/oauth-authorization-server335
/.well-known/glama.json247
/favicon.svg193

Recent arrivals

Time (UTC)ClientKindPath
2026-10-04 00:14:05ZClaudeBotcrawler/agents/googlebot
2026-10-04 00:13:38ZClaudeBotcrawler/agents
2026-10-04 00:13:20ZClaudeBotcrawler/agents/gptbot
2026-10-04 00:13:20ZClaudeBotcrawler/agents/okhttp
2026-10-04 00:13:07ZSentinelOraclemonitor/mcp
2026-10-04 00:13:07ZSentinelOraclemonitor/mcp
2026-10-04 00:13:06ZSentinelOraclemonitor/mcp
2026-10-04 00:12:57ZClaudeBotcrawler/threshold
2026-10-04 00:12:01Zaiohttpagent/mcp
2026-10-04 00:10:05Znodeagent/
2026-10-04 00:08:23Zmcpbeatmonitor/mcp
2026-10-04 00:08:23Zmcpbeatmonitor/mcp
2026-10-04 00:08:23Zmcpbeatmonitor/mcp
2026-10-04 00:08:23Zmcpbeatmonitor/mcp
2026-10-04 00:08:23Zmcpbeatmonitor/mcp
2026-10-04 00:05:04Znodeagent/
2026-10-04 00:02:54Zaiohttpagent/mcp
2026-10-04 00:02:46ZPetalBotcrawler/sitemap.xml
2026-10-04 00:01:44ZSentinelOraclemonitor/mcp
2026-10-04 00:01:44ZSentinelOraclemonitor/mcp
2026-10-04 00:01:43ZSentinelOraclemonitor/mcp
2026-10-04 00:00:03Zfomite-healthmonitor/api/glitchtip-status
2026-10-03 23:59:32ZAhrefsBotcrawler/petri
2026-10-03 23:59:32ZAhrefsBotcrawler/robots.txt
2026-10-03 23:56:14ZYouBotcrawler/agents/go-http-client
2026-10-03 23:55:04Znodeagent/
2026-10-03 23:52:56Zmcpbeatmonitor/mcp
2026-10-03 23:52:56Zmcpbeatmonitor/mcp
2026-10-03 23:52:56Zmcpbeatmonitor/mcp
2026-10-03 23:52:56Zmcpbeatmonitor/mcp
2026-10-03 23:52:56Zmcpbeatmonitor/mcp
2026-10-03 23:52:53Zaiohttpagent/mcp
2026-10-03 23:50:22ZYouBotcrawler/agents/trimtabverifier
2026-10-03 23:50:22ZYouBotcrawler/robots.txt
2026-10-03 23:50:05Znodeagent/
2026-10-03 23:49:48ZSentinelOraclemonitor/mcp
2026-10-03 23:49:48ZSentinelOraclemonitor/mcp
2026-10-03 23:49:47ZSentinelOraclemonitor/mcp
2026-10-03 23:46:54Znodeagent/mcp
2026-10-03 23:46:54Znodeagent/mcp
2026-10-03 23:46:54Znodeagent/mcp
2026-10-03 23:46:54Znodeagent/mcp
2026-10-03 23:46:54Znodeagent/mcp
2026-10-03 23:46:54Znodeagent/mcp
2026-10-03 23:45:05Zunidentifiedunknown/mcp
2026-10-03 23:45:05Zunidentifiedunknown/mcp
2026-10-03 23:45:05Zunidentifiedunknown/mcp
2026-10-03 23:45:05Zunidentifiedunknown/mcp
2026-10-03 23:45:05Zunidentifiedunknown/mcp
2026-10-03 23:45:04Zunidentifiedunknown/mcp

Take the data

The whole census is available as JSON at /api/census/summary, no key and no rate limit worth mentioning. It is CC0 — use it, republish it, build on it. If you find an error in it, the method is written down so you can show us where.