Runs before the response. On Vercel the agent is one middleware file at the project root.
On Vercel the agent is one middleware file at the project root. It runs at the edge before the response, with any framework or none.
middleware.js — At your project root. Works with or without a framework.
import { next } from '@vercel/edge'
import { reflexa } from './reflexa-agent.js'
const agent = reflexa({ token: process.env.REFLEXA_TOKEN })
export default async function middleware(request, context) {
try {
return (await agent.ahead(request, context)) ?? next()
} catch {
return next() // never let the agent take the site down
}
}
export const config = { matcher: '/:path*' }Get reflexa-agent.js and the site's token from the dashboard's Agent page, put the token in REFLEXA_TOKEN, deploy. Then press Check the connection in the dashboard: it fetches the domain proof from your real domain and the agent is live.
What it does not: it never sees the page, so robots.txt and Organization data are not switches here — the agent says so instead of pretending. Connect the site's repository in the dashboard and the agent commits those, and a page's title, description, opening and FAQ, itself.
How installing the agent works, in general → · what the agent does and never does →
No. Installing puts the agent in place and binds it to the site by its token; nothing is applied. Every switch is your click in the dashboard and every word it writes is shown to you first.
Remove the file and redeploy. Whatever was last switched on stops being served on the next request. Your checks and the agent's memory stay in your Reflexa account.
Counts every AI visit, page by page. Serves /llms.txt. Serves the domain proof that binds the token to this host. It never sees the page, so robots.txt and Organization data are not switches here — the agent says so instead of pretending. Connect the site's repository in the dashboard and the agent commits those, and a page's title, description, opening and FAQ, itself.
Yes — it belongs to this one site and should live in an environment variable, never in a file you commit. It grants nothing beyond this site, and the domain proof refuses it from any other host.
The 23 checks run from outside before anything is installed — you see what the agent would do before it does it.