# Double Agent

> One script labels every website session as human, bot or agent (Claude, ChatGPT Agent, Perplexity Comet, Gemini, Browser Use, Browserbase…), and tags GA4, Meta, Shopify, Stripe, Klaviyo, Mixpanel, Segment, PostHog, HubSpot and more. It never blocks by default.

Installing? It's keyless: no account or key needed. Fastest: the Agent Skill, `npx skills add doubleagent-so/skills`. Or the CLI: `npx @doubleagent-so/cli init --yes --json`, then `npx @doubleagent-so/cli verify <url> --json`. Full runbook: https://doubleagent.so/install.md. Don't create accounts unless your human asks; tell them they can claim the domain to see the data.

Tiers: keyless (verdicts, integrations, ad filtering; data held for the domain's owner) · public key + verified domain (HQ dashboard, live view, signed tokens, the Handler) · secret key (stats and sessions API, webhooks, server relabel). Matrix: https://doubleagent.so/docs/capabilities.md. Accounts: portal (https://app.doubleagent.so), CLI (`npx @doubleagent-so/cli init --email`) or `POST /v1/accounts` with proof-of-work. Security: rate limits, adaptive proof-of-work, quarantine of low-trust beacons (https://doubleagent.so/docs/security.md). Rules for agents: https://doubleagent.so/AGENTS.md. Everything in one file: https://doubleagent.so/llms-full.txt

## Start

- [Quickstart](https://doubleagent.so/docs/index.md): Two ways in: just the script (keyless), or with an account.
- [Agent Skill](https://doubleagent.so/docs/skill.md): The fastest way for a coding agent to install Double Agent. One command gives Claude Code, Cursor, Codex and other agents that support Agent Skills the full install runbook.
- [Capabilities](https://doubleagent.so/docs/capabilities.md): Which hook or call works keyless, with a public key, or with a secret key.
- [Accounts](https://doubleagent.so/docs/accounts.md): Create an account from the portal, the CLI or POST /v1/accounts. Roles and sessions.
- [Claim a domain](https://doubleagent.so/docs/claim.md): Verify a domain (DNS, meta, file, script) to claim keyless data, history included.
- [CLI](https://doubleagent.so/docs/cli.md): npx @doubleagent-so/cli init (keyless, --key, --email), verify, login, sites, keys, verify-domain.
- [Script tag](https://doubleagent.so/docs/script-tag.md): Script attributes (data-key optional), queued init options, npm usage.
- [Browser API](https://doubleagent.so/docs/api.md): Every browser method and whether it needs a key.
- [Verdict](https://doubleagent.so/docs/verdict.md): Verdict shape, reason-code prefixes, da_* properties and events, default policy.

## Stacks

- [Next.js](https://doubleagent.so/docs/nextjs.md): Exact app/layout.tsx edit with next/script.
- [Lovable, Emergent, Bolt, v0, Replit](https://doubleagent.so/docs/ai-builders.md): The one-line prompt for Lovable, Emergent, Bolt, v0 and Replit.
- [Shopify](https://doubleagent.so/docs/shopify.md): App embed install, cart attributes, order tags, customer events.
- [Wix](https://doubleagent.so/docs/wix.md): Custom Code install, plus the optional Velo token bridge.
- [Squarespace](https://doubleagent.so/docs/squarespace.md): Code injection install and optional form token.
- [Webflow](https://doubleagent.so/docs/webflow.md): Head code install and optional form token.
- [WordPress](https://doubleagent.so/docs/wordpress.md): wp_head snippet for functions.php.

## Tools

- [GA4](https://doubleagent.so/docs/ga4.md): User properties, da_classified event, custom dimensions.
- [Google Tag Manager](https://doubleagent.so/docs/gtm.md): dataLayer push shape and Ads trigger exception.
- [Meta Pixel](https://doubleagent.so/docs/meta.md): DoubleAgentClassified event and which conversions are held back.
- [Klaviyo](https://doubleagent.so/docs/klaviyo.md): klaviyo.identify fields and server relabel.
- [Mailchimp](https://doubleagent.so/docs/mailchimp.md): Hidden DACLASS merge field.
- [Mixpanel](https://doubleagent.so/docs/mixpanel.md): Super properties, people.set after identify, /import relabel.
- [Segment](https://doubleagent.so/docs/segment.md): context.doubleagent middleware and identify.
- [PostHog](https://doubleagent.so/docs/posthog.md): register and setPersonProperties.
- [Amplitude](https://doubleagent.so/docs/amplitude.md): Identify with every field.
- [HubSpot](https://doubleagent.so/docs/hubspot.md): _hsq identify with six fields.
- [Stripe](https://doubleagent.so/docs/stripe.md): Token, attachVerdict metadata, Radar rules.

## Server

- [@doubleagent-so/node](https://doubleagent.so/docs/server.md): @doubleagent-so/node: verifyToken, requireHuman, verifyWebhook, getSession, stripe.attachVerdict.
- [REST API](https://doubleagent.so/docs/rest.md): Every API route and its auth: collection, data, accounts, sites, domains, keys.
- [Debrief (webhook)](https://doubleagent.so/docs/debrief.md): verdict.final webhook payload and signature.
- [Relabel](https://doubleagent.so/docs/relabel.md): What the server fixes when a verdict flips, and the credentials it needs.

## Tradecraft

- [The Handler](https://doubleagent.so/docs/handler.md): Jev, the delayed judge for ambiguous sessions.
- [Declared cover](https://doubleagent.so/docs/cover.md): Verified agents (Web Bot Auth, IP ranges) and edge hints.
- [Clearance (profiles and actions)](https://doubleagent.so/docs/clearance.md): Site profiles and their default policies.
- [Safehouse (privacy)](https://doubleagent.so/docs/safehouse.md): Privacy, PCI-lite, analytics vs security mode.
- [Security](https://doubleagent.so/docs/security.md): Rate limits, proof-of-work, trust and quarantine, attested tickets.
- [HQ (the portal)](https://doubleagent.so/docs/hq.md): The portal at app.doubleagent.so: sites, verification, keys, settings, HQ.

## Sites

- [Double Agent for E-commerce](https://doubleagent.so/for/ecommerce.md): Know which carts are human, which are scrapers and which are agents buying for someone.
- [Double Agent for SaaS](https://doubleagent.so/for/saas.md): Separate real signups from signup bots and from agents doing someone’s onboarding.
- [Double Agent for Content and media](https://doubleagent.so/for/content.md): Count real readership, and see which AI agents read your pages on someone’s behalf.
- [Double Agent for Fintech and payments](https://doubleagent.so/for/fintech.md): Spot automation on sensitive flows and ask for more proof instead of denying.
- [Double Agent for Ticketing](https://doubleagent.so/for/ticketing.md): Catch checkout bots during on-sales, with tighter thresholds where it matters.
- [Double Agent for Lead generation](https://doubleagent.so/for/leadgen.md): Keep bot submissions out of your CRM and your cost per lead honest.