FAQ

A relay (also called a mirror or proxy) is a third-party forwarding service that sends your requests to OpenAI, Anthropic, or Google and returns the response. Common reasons: blocked access to official domains in some regions, wholesale pricing, or one unified interface for multiple providers.

Three common reasons: ① Access to anthropic.com / openai.com may require a VPN in some regions; ② Some relays resell pooled wholesale quotas at 30–70% below official list price; ③ Some relays expose Claude, GPT, and Gemini through a single OpenAI-compatible API so you maintain one integration.

Official APIs have fixed fields, signatures, and error formats. Relays differ enormously — some pass through 1:1, others rewrite usage fields, strip thinking blocks, substitute models, or inject extra system prompts. pangolin detects what actually happens in the middle.

Legally it's a gray area and depends on the arrangement. Practical risks: ① Exit risk — relays can shut down, raise prices, or disappear with prepaid balance; be cautious with large top-ups; ② Responses may not match the official API — relays may swap models, strip capabilities, or misreport tokens, hurting downstream reliability; ③ Prompts may be logged — for confidential or user data, avoid unknown relays. Start small, pick reputable operators, and consider going direct for high-stakes use.

pangolin has tested many relays. Five common traps (all seen in the wild): ① Silent model substitution — you pay for GPT but get Claude or another cheaper model. The surface response looks fine, but tone, reasoning, and habits diverge — risky for production work. ② Advanced features break — strict JSON, PDF input, tool calling, and similar capabilities often fail when the backend model was swapped for a cheaper one that doesn't support them. ③ Billing numbers you can't trust — the same prompt may cost different amounts each run; some relays hide token usage entirely, so you can't reconcile charges that may exceed official pricing with no audit trail. ④ Models listed but not available — a relay may advertise dozens of models, then return model_not_found for some. pangolin preflight checks before you wait half a minute for an all-zero report. ⑤ Rules change without notice — a key that worked yesterday may suddenly require an upgrade, hit group limits, or get banned. Test with a small balance and run pangolin before large top-ups.

Three angles: ① Protocol fields (id prefixes, object, finish_reason match official specs); ② Capability fingerprints (thinking signature, PDF multimodal, function-calling shape); ③ Injection resistance and usage (system conflicts, minimal input audit, foreign usage traces). pangolin combines these into multi-tier checks — full mode runs ~18 items for Claude.

Five common ones: ① Run Kiro / Amazon Q / Bedrock as a Claude stand-in; ② Route GPT requests to a Claude backend (usage fields leak claude_* residue); ③ Swap GPT-4o for GPT-4o-mini to cut cost; ④ Strip thinking blocks, PDF multimodal, and other advanced capabilities; ⑤ Inject extra system prompts or hidden preambles to rewrite identity or behavior.

No. Modern models are trained to answer identity questions, and relays can inject system prompts so the model says "I'm Claude." pangolin weights identity checks at only 5% — a weak auxiliary signal. Trust encrypted signals like thinking signature instead.

Kiro and Amazon Q are Amazon's Claude stand-in gateways. Their responses lack Claude thinking signatures — they use AWS Bedrock's simplified interface, which does not return server-side signatures. pangolin scores thinking_signature at 0 and fails the overall check.

Check the usage field. Native OpenAI has only prompt_tokens, completion_tokens, and total_tokens. If you see claude_cache_creation_5_m_tokens, usage_source: anthropic, or similar, the relay is almost certainly doing protocol conversion. pangolin flags that fingerprint as critical.

When extended thinking is enabled, Claude returns a server-generated encrypted signature in the signature field, typically 500–2000 characters. Anthropic generates it server-side with cryptographic verification — relays cannot realistically forge it. pangolin weights it at 25% as a core detector.

Four checks: ① Run pangolin and confirm thinking signature scores 100; ② Look for foreign fields in usage beyond claude_*; ③ Compare stream vs non-stream behavior (relays often treat paths differently); ④ Confirm message ids use msg_ / toolu_ / srvtoolu_ prefixes.

Full mode shows ~18 UI cards (1:1 with detectors). Core weight remains thinking signature (25%); the rest covers identity / behavior / knowledge, instruction reproduction, system conflicts, minimal input audit, channel and tokenizer, tool use, streaming consistency, token usage, and official same-prompt comparison; full mode adds PDF and optional long-context probes. quick focuses on core authenticity and injection resistance; standard adds protocol completeness and official comparison; full deepens capability checks.

Known API drift on Claude Opus 4.7 — with adaptive thinking + streaming + summarized, SSE streams may omit thinking blocks while non-stream works. pangolin's thinking_signature detector falls back to non-stream for reliability.

Detection sends real requests. Standard mode runs ~12 API calls, ~3000–5000 tokens total (depending on whether thinking triggers). At Haiku ~$0.012, Sonnet ~$0.05, Opus ~$0.20. pangolin itself is free — you pay upstream token charges.

Depends. Common causes: ① Invalid or exhausted API key (invalid banner shown); ② Relay doesn't support your chosen model (preflight returns 422); ③ Genuinely poor relay. Read each detector's details, not just the total score.

The usage field is the clearest signal. True native OpenAI has only prompt_tokens, completion_tokens, and total_tokens. claude_cache_creation_5_m_tokens, usage_source: anthropic, or input_tokens / output_tokens (Anthropic naming) strongly indicate protocol conversion. pangolin marks these critical and fails the detector.

75 is in the pass range, but any critical issues (especially multiple protocol criticals) downgrade verdict to marginal — yellow circle, risk warning. Usually the API works but the relay is converting protocols; you may not be on real GPT.

OpenAI strict mode should return pure JSON, not Markdown code fences. If you get ```json {...} ```, either the relay didn't pass response_format through, or the underlying model (likely not GPT) doesn't understand strict mode. pangolin uses the markdown_json_seen flag to distinguish the two.

The model field is just a string; relays can set anything. Verify with other signals: ① pangolin protocol detector scans usage fingerprints; ② Behavioral differences (GPT tends concise, Claude more polite and verbose); ③ Token CV across repeated calls (model_consistency detector).

pangolin lists how many models on that key match the protocol. If you're on OpenAI but see 0 GPT models, a yellow card explains the key has X Claude / Y Gemini models instead — one click to switch and test there.

Three causes: ① Relay proxies only some Gemini models (many carry 3.x preview only, not 2.5); ② Name mismatch (gemini-2.5-flash vs models/gemini-2.5-flash); ③ Model retired. pangolin preflight catches dead models in ~500ms and suggests alternatives.

At least 64, ideally 128+. Gemini 3 enables thinking by default, consuming 30–60 reasoning_tokens before text. If max is too small (<32), thinking fills the budget and you get empty text with finish_reason=length. pangolin detectors use 64–384.

No. Only the OpenAI-compatible path (POST /chat/completions) remains — it covers most third-party relays and Google's official /v1beta/openai endpoint. Legacy Gemini Native reports can still be opened.

Three tiers: ① Must support gemini-2.5-flash or gemini-3-flash-preview (2026 stable); ② pangolin protocol score ≥ 80; ③ usage has no foreign residue outside gemini_* (no silent protocol conversion). pangolin sorts model lists by recommendation.

Yes. Set base_url to https://generativelanguage.googleapis.com/v1beta/openai and api_key to your Google AI Studio AIza... key. The official compatible endpoint works as a baseline to compare third-party relays.

Three steps: ① Open the site and go to the Claude / OpenAI / Gemini check page; ② Enter relay base_url + api_key and pick a model (dropdown lists what's available for that key); ③ Click Start — report in 30–60s. Share via /r/{job_id} (kept about 90 days by default) or download JPG.

quick covers core authenticity, connectivity, and injection probes — good for fast triage; standard adds protocol completeness, tool calling, streaming consistency, token usage, and official same-prompt comparison — default recommendation; full adds behavior fingerprint, knowledge accuracy, PDF, and optional long-context probes. Claude pages run thinking signature in all modes.

Weighted total: ≥85 excellent (green) / 70–84 pass (light green) / 50–69 marginal (yellow) / <50 fail (red). Any detector critical issue caps verdict at marginal (yellow) even above 70. Expand each detector's sub_checks for details.

Anyone with the link (anonymous, unencrypted). Reports never store your API key in plain text — only redacted form (sk-y7xU••••••0h). Don't share URLs for private relays. Opt-in private reports are planned.

Yes — fully open source. clone → pip install -e .[web] → uvicorn web.server:app. CLI works standalone: relay-detector detect --base-url ... --api-key ... --mode full. See README.

No. The full key lives only in an in-memory holder during execution; it is cleared after success, failure, cancel, or interrupt — never written to job records, logs, or disk. For user/upstream-controlled values and dynamic keys, we remove the raw key and canonical urllib.parse.quote(key, safe=''), quote_plus(key, safe='') forms; %XX hex is case-insensitive. Fixed protocol/schema keys are kept. We do not promise to catch non-canonical percent-encoding of unreserved bytes, Base64, encryption, or arbitrary transforms.

cctest.ai also claims not to upload keys, but closed source — unverifiable. pangolin is fully open: clone and run (git clone ... && uvicorn web.server:app) or audit server code on GitHub.

Yes, but little. Standard mode ~12 real requests, 3000–5000 tokens total. Roughly Haiku $0.012, Sonnet $0.05, Opus $0.20 — paid to upstream (relay or official), not pangolin.

Reports contain: ① base_url (API key fragments removed if embedded); ② redacted api_key; ③ detection results. No name, email, or IP. To delete a report, open a GitHub issue.

cctest covers Claude only with black-box anti-evasion checks but shallow dimensions. pangolin covers three protocols (Claude / OpenAI / Gemini), encrypted thinking signature, cross-protocol auto-switch, pre-submit dead-model detection, full open source, and OpenAI adapter fingerprints for "GPT that's actually Claude."

hvoy supports three protocols but shallow checks (mostly protocol compliance). pangolin adds encrypted thinking signature on Claude (unique), protocol-conversion fingerprints on OpenAI (usage_source etc. at critical level), and Gemini support for thinking-by-default models — deeper coverage.

Those are subjective reviews or ad-driven rankings; pangolin is objective technical testing. Use both: shortlist on reputation, then verify with pangolin.

pangolin recommends five hard checks: ① thinking signature ≥ 100; ② protocol critical_issue_count = 0; ③ stream / non-stream usage consistent; ④ model id matches requested model (model_consistency pass); ⑤ completion_tokens CV < 0.10 across repeats (stability).