Introduction

Vector 5 is cookieless analytics that measures humans, AI crawlers, and assistant referrals — with a public collection manifest anyone can fetch.

Every privacy-first analytics tool runs in the browser. GPTBot, ClaudeBot, and PerplexityBot do not. Humans who click a ChatGPT citation often arrive with no referrer and get filed as Direct. Vector 5 was built for that gap.

It is a clean-room project — not a Plausible fork. The server and dashboard are AGPL-3.0. The tracker, middleware, MCP server, and agent skills are MIT so you can paste them into any site.

~1 KB

Tracker size

no cookies, no localStorage

Actors

classified in Go, server-side

MCP tools

read-only aggregates

Database

Postgres. No extra warehouse.

Two ingest paths

The browser script counts people. The server middleware counts everything that never runs JavaScript. Both post to the same Go API, which classifies every hit with an actor and discards the IP after hashing and a country lookup.

Path	Who it sees	Endpoint	Package
`v5.js`	Browsers that execute JavaScript	`POST /api/event`	`@vector5/tracker` · MIT
Middleware	Crawlers, agents, and optional humans	`POST /api/hit`	`@vector5/middleware` · MIT

Five actors

human
Browser visitor. JavaScript ran.
human_via_ai
Person who arrived from an assistant.
ai_crawler
GPTBot, ClaudeBot, PerplexityBot, and peers.
ai_agent
Headless agent. No JavaScript.
bot
Uptime, previews, Lighthouse, generic automation.

Dashboards default to humans. The AI Traffic panel reports crawlers and assistant referrals. Agent metrics are task-oriented — not bounce rate. Read the full model in Actors.

What you get

A 1 KB cookieless tracker with SPA, outbound, and download events out of the box.
Server middleware for Next.js, Express, Hono, Cloudflare Workers, and Node.
A public collection manifest at /api/sites/{domain}/manifest — cookies, IPs, and fingerprints are all false.
AI insights that only ever see rollups. Ollama, OpenAI, Anthropic, or Gemini.
An MCP server so Claude, Cursor, or Codex can query the same aggregates the dashboard shows.
Self-host with Docker Compose: Postgres, the API, and the dashboard.

What you do not get

Who a visitor is.
Whether they returned after midnight UTC.
Cross-site or cross-device identity.
Exact address (city is optional and off by default).
Anything about visitors who block the request entirely.

Licence

Server and dashboard: AGPL-3.0. Tracker, middleware, MCP, and skills: MIT. See Licence and ADR 0001.

Quick startCompose up, add a site, drop the tag.ConceptsActors, hashes, rollups, and manifests.Install the trackerOne script before </head>.Add middlewareSee the crawlers JavaScript never sees.