Basic request
Confirm that Chat Completions basic requests can return stably.
OpenAI API relay detection
Protocol / capability
Verify OpenAI API relay protocol and capabilities
pangolin checks Chat Completions shape, tool calls, streaming consistency, and usage fingerprints for GPT pretenders.
Chat Completions
Function Calling
Structured Output
usage fingerprint
OpenAI has no Claude-style server anti-forgery signature, so this page focuses on high-confidence protocol and capability checks.
OpenAI highlight: catch protocol leaks and capability cuts
Evaluate whether GPT-compatible endpoints follow OpenAI shapes and truly pass through key capabilities.
- Protocol shapeChecks id, object, choices, finish_reason, usage, and other Chat Completions fields.
- Capability pass-throughFunction Calling and Structured Output probes to spot shell-only relays.
- Usage fingerprintToken metering and field residue that betray Claude / Gemini backends wrapped as GPT.
Not crypto-grade identity proof — but enough to catch most adapter leaks and missing capabilities.
Checks that will run
Updates with Scan depth above. Full mode covers all applicable checks. Long-context probes need an extra opt-in.
model consistency
Compare the request model and response model fields to see if they match.
function call
Check tool_calls, function name, parameter JSON and call structure.
Structured output
Verify that JSON Schema / strict output constraints are in effect.
Protocol normativeness
Verify the shape of fields such as id, object, choices, finish_reason, usage, etc.
streaming consistency
Compare stream and non-stream text and token usage for consistency.
Token billing
Check prompt / completion / total token metering relationship.
Official comparison of the same title
The same question compares input consumption and response behavior between channels and official (or baseline).
Accurate command reproduction (anti-casing)
The model is asked to reproduce a fixed mark verbatim, checking how deterministic the instructions are followed.
System conflict testing
Compare user only to explicit system+user, checking whether fixed words are overridden by hidden directives.
Minimalist Input Token Audit
Use minimalist requests to observe whether input_tokens is abnormally high and identify implicit System injection.
Extreme reasoning ability (number theory counting)
Use canned reasoning questions to check whether verifiable answers are correct.
Hide injection detection
Randomized variants cross-check for abnormal signals such as nonce leaks, fixed replies, and suspicious cache reuse.
Security rejection and policy stability
Check if the security policy is stable using denial-of-answer scenarios and rewriting/encoding/progressive variants.