llms.txt, fetch your OpenAPI spec, and probe your endpoints at 3am. If you're building infrastructure for agents, your nginx logs are your sales pipeline. Here's how to read them.
Traditional SaaS has a well-understood funnel. Awareness. Interest. Consideration. Intent. Evaluation. Purchase. Every stage has a touchpoint — an ad click, a sign-up, a free trial, a sales call. Marketing automation captures the data. Salesforce stores it. The CRM tells you where everyone is in the journey.
None of that applies when your customers are agents.
Agents don't click ads. They don't sign up for trials. They don't take sales calls. They discover, evaluate, and integrate entirely through HTTP — and they leave a complete record of everything they do in your access log.
When a well-built agent encounters a new API, it follows a predictable discovery sequence. It starts with the machine-readable manifest — /llms.txt, /openapi.json, or /.well-known/x402. It checks what's available, what it costs, and what the methodology is. Then it starts probing.
In the logs, this looks like:
54.196.217.153 - - [29/Mar/2026:00:04:12 +0000] "GET /openapi.json HTTP/1.1" 301 - 54.196.217.153 - - [29/Mar/2026:00:04:13 +0000] "GET /llms.txt HTTP/1.1" 200 - 54.196.217.153 - - [29/Mar/2026:00:04:15 +0000] "HEAD /oracle/price/btc/usd HTTP/1.1" 200 - 54.196.217.153 - - [29/Mar/2026:00:04:16 +0000] "GET /oracle/price/btc/usd HTTP/1.1" 402 -
Read that sequence: the agent fetched the spec, read the manifest, checked endpoint availability, then tried to call the paid endpoint and hit the payment wall. This is a qualified lead. It found you, understood what you offer, and attempted to integrate. The only thing blocking it is payment setup.
Hits on /llms.txt, /openapi.json, /.well-known/x402, or /.well-known/agent.json. The agent is reading your manifest. It knows you exist and is figuring out what you do.
HEAD requests to specific endpoints. Multiple GET requests to preview or free endpoints. The same IP returning over multiple days. An engineering team running evaluation — multiple IPs from the same ASN, all hitting the same endpoint sequence. This is your mid-funnel.
The agent is hitting paid endpoints and getting 402 responses. It's trying to pay. If it has working payment logic, this converts to a 200 quickly. If it's stuck at 402 for days, something is broken — wallet empty, invoice expiry misconfigured, payment integration incomplete. This is where old-world sales would do a "technical handoff." In the agent world, you watch and wait.
The state change you're watching for. An IP that was consistently returning 402 starts returning 200. Money hits the wallet. No invoice, no contract, no onboarding call. The agent figured it out.
Top IPs today, excluding monitoring noise:
sudo cat /var/log/nginx/access.log | \
grep "$(date '+%d/%b/%Y')" | \
grep -v "UptimeRobot\|Blackbox Exporter\|127.0.0.1" | \
awk '{print $1}' | sort | uniq -c | sort -rn | head -20
What is a specific IP hitting:
sudo grep "1.2.3.4" /var/log/nginx/access.log | \
awk '{print $7, $9}' | sort | uniq -c | sort -rn
402 vs 200 ratio for an IP — are they paying:
sudo grep "1.2.3.4" /var/log/nginx/access.log | \
awk '{print $9}' | sort | uniq -c
Who is hitting discovery endpoints today:
sudo grep "$(date '+%d/%b/%Y')" /var/log/nginx/access.log | \
grep -E "llms.txt|openapi.json|well-known" | \
awk '{print $1, $7}' | sort | uniq
If you're building APIs or data infrastructure for the agentic economy, your go-to-market motion looks nothing like traditional SaaS. There are no MQLs. No SDRs. No demo calls. There's just a log file and a wallet balance.
The implication: machine-readable discovery is your marketing. llms.txt is your landing page. Your OpenAPI spec is your sales deck. Your 402 response is your pricing page. If these aren't right, agents won't find you or won't be able to integrate with you — and you'll never know, because they won't tell you.
Watch the logs. The next customer might already be in there, probing your endpoints at 3am, deciding whether to integrate.
Full discovery stack: llms.txt, OpenAPI spec, /.well-known/x402, agent.json. Pay per query via Lightning or USDC. No account required.
Mycelia Signal is a sovereign cryptographic oracle — 63 signed endpoints across crypto, stablecoin pegs, volatility indices, FX, economic indicators, and commodities. Payable by AI agents via Lightning (L402) or USDC on Base (x402). myceliasignal.com