What an agent is served from where people actually are.
In one sentence
The CrawlCheck browser extension is the second observer of what an AI agent is served: it puts the CrawlCheck grade of every site you visit on the toolbar icon, keeps a watch list that marks the sites that moved, shows the signed Resolve answer an AI agent is given about a site after verifying its signature in the browser, and measures the half the verification layer cannot read from its own network — what each named AI crawler is served from your own residential address in a real browser, what exists only after your JavaScript runs, field vitals and runtime errors on your connection, and the consent or session wall an anonymous client is shown — joined byte for byte to the signed reading, which shows whether delivery differs between the two vantages (a difference, not its cause). It sends hostnames to look grades up, for the icon and for chips beside results and AI citations. The popup footer switches for those, for anonymous usage counts, and for signed Two-vantages and page readings are on by default, including one page reading a day from sites you visit. Never page text, anything typed or your session.
Every answer this verification layer signs is read from its own network: what a named crawler is served from a data centre. It cannot say what the same agent is served from your address, in a real browser, after your JavaScript has run — the reading the agent’s user actually gets. The extension measures that half, on your device, and joins it to the signed one.
Version 1.0.20 on the Chrome Web Store as CrawlCheck – Free SEO & AI Search Checker · Chrome 121+ · no account
A–F
the site’s grade on the icon, every tab, and beside every search result and AI-answer citation
3
views: this site · watched sites · agent view
16
tools, each one a reading a server cannot take
0
page text, keystrokes or cookies ever sent
The grade is on the icon
From version 1.0.3 the toolbar icon carries the CrawlCheck grade of whatever site is in the tab, looked up by hostname. A site nobody has measured shows a question mark; one tap scans it free.
Three views, one popup
Open the popup and the site in the tab is already looked up. The three tabs across the top are the product.
Its grade, its findings, and Check this page
The grade card with its score history, the top findings with how common each is across the open dataset, and one button that fetches the page as five crawlers and two controls, reads its machine files and the rendered page, and reports in about ten seconds. This is my site pins it; Watch adds it to the list.
Up to 25 sites, with a dot when one moves
Every watched site, re-checked every six hours in the background. A dot on the badge means a score moved or a finding appeared or cleared since you last looked; the list ranks them and shows each one against yours.
What an AI agent is told about this site
One signed Resolve answer, checked in your browser before anything is shown as verified: the hash is recomputed, the signing key must be in CrawlCheck’s published directory, and the Ed25519 signature must verify. Five panels from that one answer: the per-action verdict, the lookalike shield, AI-use rights, what each agent was served, and agent readiness with one-tap drafts of the missing files.
Two readings of your site
Your connection against CrawlCheck’s edge, byte for byte
Every answer this layer signs is read from a data centre. Two vantages sends the same crawler names to the same URL from your connection and compares the SHA-256 of what each side received.
The signed reading
From CrawlCheck’s network
What each named crawler was served, hashed and signed into the public Resolve answer any agent can call. Public, no key, verifies offline.
GET /api/v1/resolve?domain=
Your reading
From your address, in your browser
The same identities, the same page, from a residential connection. Each probe is an ordinary fetch wearing that crawler’s user-agent, sent with credentials: "omit" so your session never leaks in.
the extension, on your device
The join
One verdict per crawler name
Where the two hashes differ, delivery depends on where the request came from. Neither vantage is the crawler’s own network, so the pair shows that a difference exists, not what causes it. With the sharing switch on, your signed reading joins the site’s public report beside CrawlCheck’s.
Two vantages → in the popup
Refused by name, from both vantages
The site blocks that crawler by its user-agent. A policy, working as configured. The only question is whether whoever configured it meant it.
Refused from the server, served from you
The site verifies crawler source addresses. A real GPTBot arrives from OpenAI’s published ranges; your browser wearing its name does not. Correct behaviour — this tool will not call it cloaking.
Different bytes to different identities
The edge is deciding per identity. That is the finding a server-side scan can suggest and only a second vantage can settle.
One probe from one connection is one reading: it settles what your network is served, not what every visitor everywhere sees. When the server scan and the extension disagree, the disagreement is the finding, not an error in either tool.
What only a browser can see
Every row of a page check is a reading a server fetch cannot produce, because a server fetch never runs the page.
Identity from a residential address
The same page requested as each named AI crawler and as your own browser, from your network rather than a cloud range. When an edge treats the two differently, the difference is the finding.
Render delta
What exists only after JavaScript runs — headings, prices, schema and links that are on your screen and absent from the delivered HTML, counted side by side.
Field vitals and the runtime
LCP, INP, CLS, TBT and TTFB from this load on this connection, plus what happened while the page ran: script errors, policy violations, resources that failed to load, whether a service worker or a consent overlay was present. From 1.0.11, counted in the tab from the first byte.
Consent and session delta
The wall an anonymous client is served and you never see, because your session is already past it.
16 tools under one button
Each one runs from your address on the site in the tab. Nothing fetches until you press it.
What do crawlers get?
The page in the tab fetched as eight identities from your address: status, size, words and whether the body differs from what your browser was served.
Machine files
robots.txt, the sitemap, llms.txt and the entity map fetched as a plain client and judged on whether they can be read, not on their status code.
Deep read
The rendered page against the delivered HTML: schema blocks, headings, links, images and prices that exist only after JavaScript, and how much of the text an engine never sees.
Overlay Alt+Shift+C
A panel on the page itself showing what a crawler receives from it.
Queue sitemap
Reads the site’s sitemap (up to 200 URLs) and queues them locally for a bulk run.
Annotate results
On a Google, Bing or DuckDuckGo results page: what each result site serves a crawler, written under each result. Nothing is fetched until you press it.
Chips 1.0.16
Without a click: the grade of every result on Google, Bing and DuckDuckGo and of every source ChatGPT, Perplexity, Claude, Gemini or Copilot cites, from the registry, with a red mark on a site that imitates a known brand and ‘?’ on one nobody has graded. Hostnames only; nothing is requested from the sites. On while the chips and grade switches are on, both on by default.
Daily readings 1.0.17
Once a day per site you visit, a signed page reading: field vitals, request and third-party counts, and how much text appears only after JavaScript. Numbers and the hostname, plus the page address with the query removed. Never page text. Never in incognito. At most 40 a day. Sent only while the readings, share and grade switches are all on. This is not a crawler fetch.
Intelligence card 1.0.19
With a Pro key: for your own site, what changed on it in the last 30 days, its third-party scripts and plugin alerts; for the competitors you track, their prices, service areas, reviews and changes. The hostname and your key header are sent when the popup opens. No key, no request.
AI X-ray 1.0.20
Outlines on the page itself what a client that does not run JavaScript never receives: text missing from the delivered HTML in red, partly missing in amber, and images it cannot see. It runs in the tab; only the counts reach the popup, and nothing is sent.
Compare set
Any list of domains fetched the way an answer engine would, in one table, with the column that separates them named — a ranking whose reason is hidden is a leaderboard, not evidence.
Since last time
What a crawler would notice has changed on this URL since you last checked it, field by field.
Citations & NAP
The name, phone and address the site declares, the profiles it claims, and whether they agree — read from your address.
Join the registry 1.0.8
Opens the free CrawlCheck registry claim for the site in the tab: one DNS record or one meta tag proves control.
Fill listing form 1.0.9, licence
Fills a directory’s add-or-claim form from the business’s own record, and shows what was already in the form before you submit.
Copy CSV
The last result as CSV, in the shape that result has.
On a Google, Bing or DuckDuckGo results page, Annotate results puts the one thing no toolbar shows under each result: what that site serves a crawler, measured from here, right now. The overlay also opens with Alt+Shift+C on any page, and a right-click on a page runs the check from the context menu.
Five minutes, start to finish
- 1
Install, open your site
One click on the Chrome Web Store, no account. Open your own site in a tab and the icon shows its grade.
- 2
Check this page
Open the popup and press the one big button. About ten seconds later: the grade, the findings, what each crawler was served, and what only your browser could see.
- 3
Two vantages
Press it on the same page. Each crawler name now has two readings — the data centre’s and yours — and a verdict per name.
- 4
Watch it
Press Watch. From then on the badge carries a dot the day something moves, and Since last time shows exactly what.
What it sends back
Everything below is also stated, by version, on the privacy page, and each item has its own switch where one exists.
Sends
- The hostname of the site in the tab, to look up its grade for the badge (from 1.0.3) — never the URL or the page; a footer switch turns it off
- The domain you ask about when you press Two vantages or open the Agent view, to fetch the signed reading (1.0.0, 1.0.8)
- With the sharing switch on, which is on by default: your signed Two vantages reading — status, size, word count and hash per identity, never page content (from 1.0.4) — and, when you press Check this page, a page reading: the hostname and page address, field vitals, and counts from the network timeline and the runtime (from 1.0.11)
- Anonymous usage counts — which tool was pressed, by button id — which you can switch off
- If you hold a licence: the key itself, checked at most once a day, carrying nothing else; and with Fill listing form, a request for your own business record (from 1.0.9)
Never sends
- Page text, error messages, anything typed, or a URL with a path outside a reading you chose to share
- Your session or cookies: every probe runs with credentials omitted
- Your licence key inside any reading, or anything from a page Chrome will not let an extension measure
Up to 0.9.1 the extension sent nothing but the licence check. The full policy, version by version.
Getting it
On the Chrome Web Store as CrawlCheck – Free SEO & AI Search Checker, version 1.0.20. One click, no account, nothing to configure. Free, and it works without a licence — a licence adds the scored report here and Watch, which re-measures the signed reading twice a day.
Add to Chrome — freeThen scan the same domain from this side →