Cromanion

You can start right now, alone.

CommunityOnlineNo sign-inGlobalFreeCan modify data

What it can do

  • Cromanion Open Claim: Start here, and you need nothing to do it — no API key, no human. This call takes no credential and creates NOTHING: no account, no key, no charge. It returns a challenge to publ
  • Cromanion Verify Claim: Redeem a claim once you have published one of its three proofs (a /.well-known file, a <meta> tag, or a DNS TXT record). On success it creates the account and the site and retu
  • Cromanion Site Status: Check the site you provisioned: whether the tag is actually live (a beacon received from your own domain, not merely a snippet handed to you), how the crawl is going, and the pl

What data it sees

Do you need an account

No: the server works without sign-in

You can start right now, alone. No API key to fetch, no human to wake, no consent screen in a browser. The first call — cromanion_open_claim — takes no credential and creates nothing: no account, no key, no charge. It hands you a challenge to publish on the site you manage, and that proof is what mints your key.

Your human only has to appear if they later want a paid plan, and you can never spend their money.

What it does once it is running

Cromanion is a conversion agent that runs itself. The site pastes one tag; an AI that has read the site watches every session live, predicts the visitor's next move, and intervenes at the right moment to push toward conversion.

Then it is your job, not a dashboard theirs to babysit. You rule on what may be rewritten, define what counts as a conversion, set what the agent may say, seed the crawl, and take the site live — as far as your human allowed, which cromanion_grants tells you before you try rather than after you fail.

What you get to report back

cromanion_impact returns lift measured against a permanent 10% holdout. What you tell your human is causal, not a correlation you would have to hedge — and it is written back into the tools they already use (GA4, Plausible) rather than into one more screen.

Cromanion states no fact it cannot trace to their own pages or their own words. You will not be the reason it told a visitor something untrue.

Why there is no API key

We cannot take your word for an email address. Anybody can type any address, and if that were enough, an agent could be handed a live key inside a stranger's account. So we ask for the one thing you can prove and a stranger cannot: that you control the site.

Publish any one of three, whichever your hosting lets you write:

Method Where
well_known /.well-known/cromanion-challenge.txt, containing the challenge
meta_tag in the page
dns_txt a TXT record on the apex reading cromanion-site-verification=…

The claim is redeemable for 24 hours, and opening one commits your human to nothing.

Two things you cannot do

You cannot pay. cromanion_upgrade_link returns a Stripe link and nothing else — your human opens it and enters their own card. Everything else works on the free plan meanwhile.

You cannot switch the site from learn to act on your own initiative. A new site watches real sessions and shows visitors nothing; letting an AI speak to visitors in your human's name is their decision. They can delegate it to you explicitly, and then you may.

The order to call things in

  1. cromanion_open_claim — keep the secret; it is shown once and authenticates every later call in the Authorization header, never in a tool argument.
  2. Publish one of the three proofs it lists. Each comes back with the exact URL and the exact string.
  3. cromanion_verify_claim — creates the account and the site, returns the tracking snippet. Safe to retry: a repeat gives you the same account, never a second one.
  4. Install the returned snippet before `` on every page.
  5. cromanion_site_status — poll until install.verified is true. That is not "we gave you a snippet"; it means a beacon reached us from your human's own domain. If it stays false, cromanion_install_check tells you why — a CSP blocking the script, a consent manager holding it, the tag on some pages and not others, or beacons arriving from a host the site was not claimed under. Each with the fix.

Then read cromanion_grants for what you may do, cromanion_config for what is already in force, and cromanion_pending for what is waiting on a decision.

Read cromanion_errors once and you will never have to guess whether a refusal is worth retrying.

Full reference: cromanion.com/agents

Server tool list (26)

Raw names from tools/list. Only developers need these.

cromanion_open_claimStart here, and you need nothing to do it — no API key, no human. This call takes no credential and creates NOTHING: no account, no key, no charge. It returns a challenge to publish on the site you manage (a file, a meta tag or a DNS record — whichever your hosting lets you write) and the secret you will authenticate with once the proof is read. That proof is the whole trust model: we cannot take your word for an email address, but we can check what you control. Store the secret; it is shown once. Refuses if the address already has an account, because controlling a site does not prove controlling a mailbox.
cromanion_verify_claimRedeem a claim once you have published one of its three proofs (a /.well-known file, a <meta> tag, or a DNS TXT record). On success it creates the account and the site and returns the tracking snippet to install. Idempotent — safe to retry. Requires the claim secret as a bearer token.
cromanion_site_statusCheck the site you provisioned: whether the tag is actually live (a beacon received from your own domain, not merely a snippet handed to you), how the crawl is going, and the plan. Poll this after installing the snippet. Requires the claim secret as a bearer token.
cromanion_install_checkWhy the tag is not firing. cromanion_site_status tells you `verified: false`; this tells you WHY — fetching your human's own pages and reporting, per page, whether the tag is there and what is stopping it. It finds the four failures a boolean cannot: the tag missing from some pages but not others, a Content-Security-Policy blocking the script, a consent manager holding it, and beacons arriving from a host the site was not claimed under. Each comes back with the fix. Rate-limited to one check every two minutes, because it fetches ten pages from your human's server.
cromanion_upgrade_linkGet a Stripe Checkout link for a paid plan (pro or growth). Returns a URL and nothing else — YOU do not pay and cannot: give the link to your human, who enters their own card. The site works on the free plan meanwhile. Requires the claim secret as a bearer token.
cromanion_errorsEvery refusal this server can return, and what to do about each. Needs no credential — you can read it before you have one, or after a refusal has told you the one you had is gone. The field to branch on is `retry`: `later` means a cooldown or a transient, `fix_request` means change something and resend, `needs_human` means nothing you send will help until a person acts. Read it once and stop guessing whether a 409 is worth retrying.
cromanion_grantsList what your human has allowed this agent to do, and what they have not. Read this before assuming a capability — the alternative is discovering your permissions by failing in front of them. You cannot change these yourself; only your human can, in their console.
cromanion_pendingEverything on this site that is waiting for a decision: page rewrites the agent wants to make, rules it distilled from real sessions, conversions it spotted but has never counted, and pages your traffic found that the crawl missed. This is the client's actual job in the console, in one call. Rule on an item with cromanion_decide.
cromanion_configEverything IN FORCE on this site: the conversions that count, the facts you may state and the ones forbidden, which surfaces are enabled, the brand, and every distilled rule WITH its status. cromanion_pending shows what is waiting for a decision; this shows what was already decided — including by you. Read it before writing anything, because most writes here REPLACE rather than add.
cromanion_decideRule on one thing from cromanion_pending: pass its `kind` and `id` back unchanged with a decision. `approve` / `reject` for everything; `pause` additionally for a playbook rule. Approving a GOAL is different in kind from the rest — it changes what every impact figure for this site means, permanently. You cannot edit rule text here, only rule on it.
cromanion_set_playbookReword a distilled rule, or ask for a fresh distillation. Rules are what the agent learned from real sessions; cromanion_decide approves or pauses them, and this changes what they SAY. Send a ruleId with condition and/or recommendedAction to reword one — ids come from cromanion_config, which also shows rules you have already approved or paused. Send redistill: true instead to distil new rules from recent sessions; they arrive as `proposed` for you to rule on. Rate-limited to one distillation an hour. Needs the decisions permission.
cromanion_ask_humanAsk your human for something only they can do, in a place they will actually see it. Every other refusal here ends with YOU reading it — a permission they did not grant, a payment you cannot make, a mode you may not set — and from their side you simply went quiet. This puts one request on their notifications screen, attributed to you. Nothing replies here: they act in their console, and you find out by reading cromanion_grants or cromanion_config again. One request an hour, and a second from you replaces the first rather than stacking.
cromanion_mark_readMark notifications read once you have passed them on to your human. cromanion_pending returns the unread ones and nothing cleared them, so the queue grew for ever and you re-read the same items on every poll. Send a notificationId for one, or nothing to clear them all. Needs the decisions permission.
cromanion_impactWhat the agent has actually changed: visitors who saw it versus the 10% held back as a control. Read `liftStatus` before reporting anything — `learn` means nothing has been shown yet and `insufficient` means the arms are too small to tell signal from noise. Neither is 'no lift'.
cromanion_set_modeSwitch the agent on. `learn` watches and shows visitors nothing; `act` lets it intervene in your human's name. `customizeMode` is a separate axis for rewriting their own page copy: `off`, `shadow` (propose only) or `live`. Needs the activation permission.
cromanion_add_goalDefine a conversion to count, or change one you already defined. This is not one more setting: it is the numerator of every impact figure your human will read, so a goal that fires on every pageview makes the agent look brilliant and tells them nothing. Send `type` and `value` to create — idempotent, the same matcher twice creates one goal. Send `goalId` instead to rename, reprioritise or price an existing one, or with `remove: true` to stop counting it. Needs the goals permission.
cromanion_crawlRe-read the site, and name the pages that matter most so they are read first. You know this site's structure better than its owner does — seeding it is the cheapest real improvement to what the agent understands. Rate-limited: one crawl per 30 minutes. Needs the site-config permission.
cromanion_add_siteAdd another of your human's sites to their account, on a plan that allows more than one. Reaching a site they already own needs no proof — they added it. CREATING one does: nothing about holding a credential for one domain says anything about another, so publish this claim's challenge on the new domain first, the same three ways that proved the first. Refused if your human restricted this credential to specific sites: a list they set should not grow by your action — use cromanion_ask_human. Needs the site-config permission.
cromanion_claim_domainClaim another host for this site so its traffic counts, or give one up with `remove: true`. A DIFFERENT registrable domain must be proven on its own — publish this claim's challenge there too, then call again. Subdomains need no call at all: a claimed domain already covers them. Needs the site-config permission.
cromanion_set_voiceWrite the facts the agent may state to visitors, and the things it must never say. Plain sentences, one idea per line; start a line with 'never' to forbid something. Anything you write that your human's own pages do not already state is attributed to THEM as the source — so write only what they have told you is true. Every rule is checked against your own text and the site's vocabulary, and anything ungrounded is silently dropped: read the returned `lines` to see what actually survived. Your human sees each line attributed to you. Needs the voice permission.
cromanion_set_surfacesChoose where the agent may speak and what those places look like: which layout surfaces are enabled, whether the exit modal is allowed, custom CSS, and per-surface HTML. Markup and CSS are re-checked against an allowlist on every visitor — anything that could run, or fetch a remote resource, is silently removed, so compare what comes back with what you sent. Needs the surfaces permission.
cromanion_set_holdoutSet the share of visitors held back from the agent so its effect stays measurable (0.05–0.5). Changing it splits the measurement window: periods either side are compared separately and never pooled. Needs the measurement permission.
cromanion_set_exclusionsPut an excluded device back into the measurement. Your human can mark their own devices as "not a real visitor" so their browsing does not count; this removes one of those marks, by the label they gave it. You cannot ADD an exclusion — that names the caller's own browser, which you do not have. Needs the measurement permission.
cromanion_set_brandAdjust the palette, fonts and button styling the agent paints its surfaces with. The crawl guesses these from a stylesheet; you probably know the real tokens. Cosmetic only — it changes how the agent looks, never what it may say. Needs the brand permission.
cromanion_set_lead_destinationSet where captured leads are delivered: an https webhook, a connected HubSpot portal, or off. Note before you use it: this is the one change that leaves no other trace — forms keep working and visitors keep being thanked while the addresses go somewhere new — so every change emails your human and appears on their notifications screen. Needs the integrations permission.
cromanion_disconnect_hubspotSever the account's HubSpot connection. The other half of cromanion_set_lead_destination's `hubspot` option: you can point leads at a CRM, so you can take them back out. Refused while any site on the account still delivers there — change those destinations first, or the forms would keep working while every lead failed delivery. Reconnecting is NOT a tool: it is an OAuth consent screen only your human can click, so treat this as one-way and say so before you call it. Needs the integrations permission.