Runs before the response. On a Node server the agent is one middleware before your routes.
On a Node server the agent is one middleware before your routes. Express is shown; Fastify, Koa and Hono take the same four lines.
server.js — Before your routes. Node 18+ (it needs global fetch).
import { reflexa } from './reflexa-agent.js'
const agent = reflexa({ token: process.env.REFLEXA_TOKEN })
app.use(async (req, res, next) => {
try {
const url = `https://${req.headers.host}${req.originalUrl}`
const out = await agent.ahead(new Request(url, { headers: req.headers }))
if (!out) return next()
res.status(out.status)
out.headers.forEach((v, k) => res.setHeader(k, v))
res.send(await out.text())
} catch {
next() // the agent never stands between a visitor and a page
}
})Get reflexa-agent.js and the site's token from the dashboard's Agent page, put the token in REFLEXA_TOKEN, deploy. Then press Check the connection in the dashboard: it fetches the domain proof from your real domain and the agent is live.
What it does not: it never sees the page, so robots.txt and Organization data are not switches here — the agent says so instead of pretending. Connect the site's repository in the dashboard and the agent commits those, and a page's title, description, opening and FAQ, itself.
How installing the agent works, in general → · what the agent does and never does →
No. Installing puts the agent in place and binds it to the site by its token; nothing is applied. Every switch is your click in the dashboard and every word it writes is shown to you first.
Remove the file and redeploy. Whatever was last switched on stops being served on the next request. Your checks and the agent's memory stay in your Reflexa account.
Counts every AI visit, page by page. Serves /llms.txt. Serves the domain proof that binds the token to this host. It never sees the page, so robots.txt and Organization data are not switches here — the agent says so instead of pretending. Connect the site's repository in the dashboard and the agent commits those, and a page's title, description, opening and FAQ, itself.
Yes — it belongs to this one site and should live in an environment variable, never in a file you commit. It grants nothing beyond this site, and the domain proof refuses it from any other host.
The 23 checks run from outside before anything is installed — you see what the agent would do before it does it.