diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 9774b36..e5ef186 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -195,6 +195,7 @@ The website code lives under `src/`:
 - `src/client/` — browser-side TypeScript (search, filter, dark mode), Tailwind entry, and the vendored Outfit fonts under `fonts/` that social cards are rendered with.
 - `src/build/` — SSG pipeline (renders pages, compiles assets, emits JSON API, generates a social card per page).
 - `src/server/` — Express dev server.
+- `src/tracking/` — API usage tracking; the root `middleware.ts` posts one Web Analytics custom event per JSON API request at the edge.
 
 Everything the catalog ships beyond the static site:
 
diff --git a/README.md b/README.md
index 256e1b3..c2e73bb 100644
--- a/README.md
+++ b/README.md
@@ -67,6 +67,8 @@ curl https://modelparams.dev/api/v1/models/openai/gpt-5.5.json
 
 Schema at `https://modelparams.dev/api/v1/schema.json`, per the [Model Parameters convention](docs/model-parameters-schema.md).
 
+API requests are counted at the edge and reported to Vercel Web Analytics as `api_request` custom events (endpoint, model, client type), so API usage lands in the same dashboard as page views. Off Vercel it's a no-op; see [`src/tracking/api-usage.ts`](src/tracking/api-usage.ts).
+
 ### Validate a request
 
 POST the parameters you're about to send. You get back what's wrong — including combinations the provider rejects — and a corrected payload.
diff --git a/middleware.ts b/middleware.ts
new file mode 100644
index 0000000..73d8d87
--- /dev/null
+++ b/middleware.ts
@@ -0,0 +1,22 @@
+import { trackApiUsage } from "./src/tracking/api-usage.js";
+
+/**
+ * Vercel Edge Middleware: counts requests to the JSON API, the MCP server,
+ * and the llms.txt companion files as Web Analytics custom events. Middleware
+ * runs before the CDN cache and before rewrites, so /mcp needs its own matcher
+ * entry even though it rewrites to /api/mcp. What gets recorded is documented
+ * in src/tracking/api-usage.ts.
+ */
+export const config = {
+  matcher: ["/api/:path*", "/mcp", "/llms.txt", "/llms-full.txt"],
+};
+
+interface MiddlewareContext {
+  waitUntil(promise: Promise<unknown>): void;
+}
+
+export default function middleware(request: Request, context: MiddlewareContext): void {
+  const pending = trackApiUsage(request);
+  if (pending) context.waitUntil(pending);
+  // Returning nothing lets the request fall through to the static files.
+}
diff --git a/src/tracking/api-usage.ts b/src/tracking/api-usage.ts
new file mode 100644
index 0000000..3bb850b
--- /dev/null
+++ b/src/tracking/api-usage.ts
@@ -0,0 +1,169 @@
+/**
+ * Server-side usage tracking for the JSON API, reported to Vercel Web
+ * Analytics so API traffic shows up in the same dashboard as page views.
+ *
+ * The API is static files on Vercel's CDN, so the Web Analytics <script> in
+ * layout.ejs never sees those requests: curl and SDK clients don't execute
+ * JavaScript. Instead, the root middleware.ts observes every /api/* request
+ * at the edge and posts an "api_request" custom event to this deployment's
+ * ingest route (/_vercel/insights/event).
+ *
+ * The payload replicates what @vercel/analytics@2.0.1's server track() sends
+ * (see its dist/server/index.js). We inline it rather than depend on the
+ * package because its optional framework peer deps (@sveltejs/kit → vite 8)
+ * conflict with this repo's vite 5 toolchain and would break plain
+ * `npm install` for contributors.
+ *
+ * No configuration: Vercel injects VERCEL_URL, and without it (local dev,
+ * tests, forks deployed elsewhere) tracking is a no-op. Viewing custom events
+ * in the Analytics tab requires a Pro plan.
+ *
+ * Runs in the Edge runtime: only Web APIs here (fetch, URL), no Node
+ * built-ins.
+ */
+
+const SDK_NAME = "@vercel/analytics/server";
+const SDK_VERSION = "2.0.1";
+
+export type TrackingEnv = Record<string, string | undefined>;
+
+export interface EndpointInfo {
+  endpoint:
+    | "index"
+    | "catalog"
+    | "schema"
+    | "model_by_id"
+    | "params_by_model"
+    | "validate"
+    | "llms"
+    | "mcp"
+    | "other";
+  authMode: "api_key" | "subscription" | null;
+  provider: string | null;
+  model: string | null;
+}
+
+/** Maps a pathname onto the route templates emitted by src/build/build.ts. */
+export function classifyEndpoint(pathname: string): EndpointInfo {
+  const none: EndpointInfo = { endpoint: "other", authMode: null, provider: null, model: null };
+  const path = pathname.length > 1 ? pathname.replace(/\/$/, "") : pathname;
+
+  if (path === "/llms.txt" || path === "/llms-full.txt") return { ...none, endpoint: "llms" };
+  // vercel.json rewrites /mcp to /api/mcp; middleware sees the pre-rewrite
+  // path, but direct hits on /api/mcp are the same endpoint.
+  if (path === "/mcp" || path === "/api/mcp") return { ...none, endpoint: "mcp" };
+  if (path === "/api/v1/index.json") return { ...none, endpoint: "index" };
+  if (path === "/api/v1/models.json") return { ...none, endpoint: "catalog" };
+  if (path === "/api/v1/schema.json") return { ...none, endpoint: "schema" };
+  if (path === "/api/v1/validate") return { ...none, endpoint: "validate" };
+
+  const byId = path.match(/^\/api\/v1\/models\/([^/]+)\/([^/]+)\.json$/);
+  if (byId && byId[1] && byId[2]) {
+    const { model, authMode } = splitAuthMode(byId[2]);
+    return { endpoint: "model_by_id", authMode, provider: byId[1], model };
+  }
+
+  const byParams = path.match(/^\/api\/v1\/params\/([^/]+)\.json$/);
+  if (byParams && byParams[1]) {
+    const { model, authMode } = splitAuthMode(byParams[1]);
+    return { endpoint: "params_by_model", authMode, provider: null, model };
+  }
+
+  return none;
+}
+
+/** The build emits "<model>-subscription.json" next to the api-key variant. */
+function splitAuthMode(slug: string): { model: string; authMode: "api_key" | "subscription" } {
+  return slug.endsWith("-subscription")
+    ? { model: slug.slice(0, -"-subscription".length), authMode: "subscription" }
+    : { model: slug, authMode: "api_key" };
+}
+
+/** Coarse consumer bucket, so the events panel can split SDKs from browsers. */
+export function classifyClient(userAgent: string | null): string {
+  if (!userAgent) return "unknown";
+  if (/curl\//i.test(userAgent)) return "curl";
+  if (/wget/i.test(userAgent)) return "wget";
+  if (/python|httpx|aiohttp/i.test(userAgent)) return "python";
+  if (/node|undici|axios|\bgot\b/i.test(userAgent)) return "node";
+  if (/go-http-client|golang/i.test(userAgent)) return "go";
+  if (/bot|crawler|spider|scrape/i.test(userAgent)) return "bot";
+  if (/mozilla|chrome|safari|firefox/i.test(userAgent)) return "browser";
+  return "other";
+}
+
+/**
+ * Custom-event properties. Only present values are sent: Vercel accepts null
+ * but renders it as noise in the Events panel, and every name/key/value is
+ * capped at 255 characters.
+ */
+export function eventProperties(request: Request): Record<string, string> {
+  const url = new URL(request.url);
+  const info = classifyEndpoint(url.pathname);
+  const properties: Record<string, string> = {
+    path: url.pathname.slice(0, 255),
+    method: request.method,
+    endpoint: info.endpoint,
+    client: classifyClient(request.headers.get("user-agent")),
+  };
+  if (info.authMode) properties.auth_mode = info.authMode;
+  if (info.provider) properties.provider = info.provider;
+  if (info.model) properties.model = info.model;
+  return properties;
+}
+
+/** Ingest endpoint on this deployment, or null when not running on Vercel. */
+export function ingestUrl(env: TrackingEnv): string | null {
+  const endpoint = env.VERCEL_WEB_ANALYTICS_ENDPOINT || env.VERCEL_URL;
+  if (!endpoint) return null;
+  return endpoint.startsWith("http")
+    ? endpoint
+    : new URL("/_vercel/insights/event", `https://${endpoint}`).toString();
+}
+
+/**
+ * Fire-and-forget capture. Returns the in-flight promise for waitUntil(), or
+ * null when tracking is off (not on Vercel) or the request is a CORS
+ * preflight. Never throws and never rejects: an analytics outage must not
+ * affect the API.
+ */
+export function trackApiUsage(
+  request: Request,
+  env: TrackingEnv = process.env,
+): Promise<void> | null {
+  const url = ingestUrl(env);
+  if (!url) return null;
+  if (request.method === "OPTIONS") return null;
+
+  // Attribution headers: the ingest route derives visitor, country, and
+  // browser from these, exactly as it does for @vercel/analytics/server.
+  const headers: Record<string, string> = {
+    "content-type": "application/json",
+    "x-va-server": "1",
+  };
+  const userAgent = request.headers.get("user-agent");
+  if (userAgent) headers["user-agent"] = userAgent;
+  const forwardedFor = request.headers.get("x-forwarded-for");
+  if (forwardedFor) headers["x-vercel-ip"] = forwardedFor;
+  const cookie = request.headers.get("cookie");
+  if (cookie) headers.cookie = cookie;
+  // Lets events through on password/SSO-protected preview deployments.
+  if (env.VERCEL_AUTOMATION_BYPASS_SECRET) {
+    headers["x-vercel-protection-bypass"] = env.VERCEL_AUTOMATION_BYPASS_SECRET;
+  }
+
+  const body = JSON.stringify({
+    o: request.url,
+    ts: Date.now(),
+    sdkn: SDK_NAME,
+    sdkv: SDK_VERSION,
+    r: "",
+    en: "api_request",
+    ed: eventProperties(request),
+  });
+
+  return fetch(url, { method: "POST", headers, body }).then(
+    () => undefined,
+    () => undefined,
+  );
+}
diff --git a/tests/api-usage.test.ts b/tests/api-usage.test.ts
new file mode 100644
index 0000000..7e10d10
--- /dev/null
+++ b/tests/api-usage.test.ts
@@ -0,0 +1,203 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+  classifyClient,
+  classifyEndpoint,
+  eventProperties,
+  ingestUrl,
+  trackApiUsage,
+} from "../src/tracking/api-usage.js";
+
+describe("classifyEndpoint", () => {
+  it("recognises the fixed endpoints", () => {
+    expect(classifyEndpoint("/api/v1/index.json").endpoint).toBe("index");
+    expect(classifyEndpoint("/api/v1/models.json").endpoint).toBe("catalog");
+    expect(classifyEndpoint("/api/v1/schema.json").endpoint).toBe("schema");
+    expect(classifyEndpoint("/api/v1/validate").endpoint).toBe("validate");
+    expect(classifyEndpoint("/api/v1/validate/").endpoint).toBe("validate");
+    expect(classifyEndpoint("/llms.txt").endpoint).toBe("llms");
+    expect(classifyEndpoint("/llms-full.txt").endpoint).toBe("llms");
+  });
+
+  it("recognises the MCP server on both its public and rewritten paths", () => {
+    expect(classifyEndpoint("/mcp").endpoint).toBe("mcp");
+    expect(classifyEndpoint("/api/mcp").endpoint).toBe("mcp");
+  });
+
+  it("extracts provider and model from model_by_id paths", () => {
+    expect(classifyEndpoint("/api/v1/models/openai/gpt-4.1.json")).toEqual({
+      endpoint: "model_by_id",
+      authMode: "api_key",
+      provider: "openai",
+      model: "gpt-4.1",
+    });
+  });
+
+  it("splits the -subscription suffix into auth_mode", () => {
+    expect(classifyEndpoint("/api/v1/models/openai/gpt-4.1-subscription.json")).toEqual({
+      endpoint: "model_by_id",
+      authMode: "subscription",
+      provider: "openai",
+      model: "gpt-4.1",
+    });
+    expect(classifyEndpoint("/api/v1/params/gpt-5.5-subscription.json")).toEqual({
+      endpoint: "params_by_model",
+      authMode: "subscription",
+      provider: null,
+      model: "gpt-5.5",
+    });
+  });
+
+  it("extracts the model from params_by_model paths", () => {
+    expect(classifyEndpoint("/api/v1/params/gpt-5.5.json")).toEqual({
+      endpoint: "params_by_model",
+      authMode: "api_key",
+      provider: null,
+      model: "gpt-5.5",
+    });
+  });
+
+  it("buckets anything else as other", () => {
+    expect(classifyEndpoint("/api/v1/nope").endpoint).toBe("other");
+    expect(classifyEndpoint("/api/v1/models/openai/too/deep.json").endpoint).toBe("other");
+    expect(classifyEndpoint("/").endpoint).toBe("other");
+  });
+});
+
+describe("classifyClient", () => {
+  it.each([
+    ["curl/8.6.0", "curl"],
+    ["Wget/1.21", "wget"],
+    ["python-requests/2.32.0", "python"],
+    ["python-httpx/0.27.0", "python"],
+    ["node-fetch/3.3.2", "node"],
+    ["undici", "node"],
+    ["axios/1.7.2", "node"],
+    ["Go-http-client/2.0", "go"],
+    ["Mozilla/5.0 (compatible; GPTBot/1.2; +https://openai.com/gptbot)", "bot"],
+    ["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/126.0 Safari/537.36", "browser"],
+    ["SomethingElse/1.0", "other"],
+  ])("classifies %s as %s", (userAgent, expected) => {
+    expect(classifyClient(userAgent)).toBe(expected);
+  });
+
+  it("treats a missing user agent as unknown", () => {
+    expect(classifyClient(null)).toBe("unknown");
+    expect(classifyClient("")).toBe("unknown");
+  });
+});
+
+describe("eventProperties", () => {
+  it("describes a model params request", () => {
+    const request = new Request("https://modelparams.dev/api/v1/params/gpt-5.5.json", {
+      headers: { "user-agent": "python-requests/2.32.0" },
+    });
+    expect(eventProperties(request)).toEqual({
+      path: "/api/v1/params/gpt-5.5.json",
+      method: "GET",
+      endpoint: "params_by_model",
+      client: "python",
+      auth_mode: "api_key",
+      model: "gpt-5.5",
+    });
+  });
+
+  it("omits absent values instead of sending null", () => {
+    const request = new Request("https://modelparams.dev/api/v1/models.json");
+    expect(eventProperties(request)).toEqual({
+      path: "/api/v1/models.json",
+      method: "GET",
+      endpoint: "catalog",
+      client: "unknown",
+    });
+  });
+});
+
+describe("ingestUrl", () => {
+  it("builds the endpoint from VERCEL_URL and is off without it", () => {
+    expect(ingestUrl({ VERCEL_URL: "modelparams-abc123.vercel.app" })).toBe(
+      "https://modelparams-abc123.vercel.app/_vercel/insights/event",
+    );
+    expect(ingestUrl({})).toBe(null);
+  });
+
+  it("uses a full VERCEL_WEB_ANALYTICS_ENDPOINT override verbatim", () => {
+    expect(
+      ingestUrl({
+        VERCEL_WEB_ANALYTICS_ENDPOINT: "https://example.com/ingest",
+        VERCEL_URL: "ignored.vercel.app",
+      }),
+    ).toBe("https://example.com/ingest");
+  });
+});
+
+describe("trackApiUsage", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  const env = { VERCEL_URL: "modelparams-abc123.vercel.app" };
+  const request = (method = "GET") =>
+    new Request("https://modelparams.dev/api/v1/models.json", {
+      method,
+      headers: {
+        "user-agent": "curl/8.6.0",
+        "x-forwarded-for": "203.0.113.7",
+      },
+    });
+
+  it("is a no-op off Vercel and for CORS preflights", () => {
+    const fetchMock = vi.fn();
+    vi.stubGlobal("fetch", fetchMock);
+    expect(trackApiUsage(request(), {})).toBe(null);
+    expect(trackApiUsage(request("OPTIONS"), env)).toBe(null);
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("posts the @vercel/analytics wire format to the ingest route", async () => {
+    const fetchMock = vi.fn().mockResolvedValue(new Response("ok"));
+    vi.stubGlobal("fetch", fetchMock);
+
+    await trackApiUsage(request(), env);
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    const [url, init] = fetchMock.mock.calls[0] as [
+      string,
+      { method: string; headers: Record<string, string>; body: string },
+    ];
+    expect(url).toBe("https://modelparams-abc123.vercel.app/_vercel/insights/event");
+    expect(init.method).toBe("POST");
+    expect(init.headers).toMatchObject({
+      "content-type": "application/json",
+      "x-va-server": "1",
+      "user-agent": "curl/8.6.0",
+      "x-vercel-ip": "203.0.113.7",
+    });
+    expect(init.headers).not.toHaveProperty("cookie");
+
+    const body = JSON.parse(init.body) as {
+      en: string;
+      o: string;
+      sdkn: string;
+      ed: Record<string, string>;
+    };
+    expect(body.en).toBe("api_request");
+    expect(body.o).toBe("https://modelparams.dev/api/v1/models.json");
+    expect(body.sdkn).toBe("@vercel/analytics/server");
+    expect(body.ed).toMatchObject({ endpoint: "catalog", client: "curl" });
+  });
+
+  it("sends the protection bypass secret when configured", async () => {
+    const fetchMock = vi.fn().mockResolvedValue(new Response("ok"));
+    vi.stubGlobal("fetch", fetchMock);
+
+    await trackApiUsage(request(), { ...env, VERCEL_AUTOMATION_BYPASS_SECRET: "shh" });
+
+    const [, init] = fetchMock.mock.calls[0] as [string, { headers: Record<string, string> }];
+    expect(init.headers["x-vercel-protection-bypass"]).toBe("shh");
+  });
+
+  it("swallows network failures", async () => {
+    vi.stubGlobal("fetch", vi.fn().mockRejectedValue(new Error("offline")));
+    await expect(trackApiUsage(request(), env)).resolves.toBe(undefined);
+  });
+});