Documentation

Everything you need to run inspections and interpret the results responsibly.

Getting started

1. Create a free account.
2. Open New inspection and choose a content type: text, website, document, image, code or repository.
3. Submit. The inspection is queued and processed in the background; the results page updates automatically.
4. Review the findings, export a PDF or JSON report, or share an expiring link.

Reading a report

Every report has the same sections:

• AI-generation likelihood (0–100) - produced only by the configured detection model. Below 35 is labelled human-like, 35–65 mixed, above 65 AI-like. These are display thresholds, not calibrated probabilities.
• Reliability - low, moderate or high, based on how much material was analysed and the model’s own confidence.
• Provenance - C2PA Content Credentials found in the file. We read the manifest’s claims but do not yet verify its signature.
• Metadata evidence - what EXIF, XMP, PNG text, document properties or page generator tags say about the producing tool.
• Heuristic signals - stylometric and code-pattern observations with locations. They are context and never change the score.
• Limitations - conditions that reduce reliability for this specific inspection.

A high likelihood is a reason to look more closely, not a conclusion. A low one does not prove human authorship. Never sanction a person on a detection score alone.

Detection providers

Likelihood scores come from pluggable providers, configured per content type (text, code, image). Each provider is an HTTP endpoint - an external detection API or a model you host yourself - that implements this contract:

POST <DETECTION_TEXT_ENDPOINT>
Authorization: Bearer <DETECTION_TEXT_API_KEY>
Content-Type: application/json

{ "modality": "text", "segments": [{ "id": "p1", "text": "…" }] }
{ "modality": "image", "mimeType": "image/png", "data": "<base64>" }

200 OK
{ "score": 0.82, "confidence": 0.7,
  "segments": [{ "id": "p1", "score": 0.82 }],
  "model": "my-detector", "version": "1.2" }

Scores must be between 0 and 1; invalid responses are rejected and reported as a model error. When no provider is configured, the report shows the likelihood as unavailable. A deterministic mock provider exists for local development only and cannot be enabled in production.

Content types & limits

Security & privacy

• Uploads are validated by their content (magic bytes), not only their extension.
• ZIP archives are checked for path traversal, entry counts, sizes and compression ratios before extraction.
• Uploaded code and documents are parsed as data. Nothing is ever executed.
• Website fetching blocks private, loopback, link-local and cloud-metadata addresses, validates every redirect and DNS answer, and caps size.
• Uploaded files are deleted automatically after 7 days; deleting an inspection removes its stored content immediately.
• Passwords are hashed with PBKDF2; sessions and API keys are stored only as hashes.

The inspector crawler

Website inspections fetch pages with the user agent AIInspectorLabBot/1.0, only when a signed-in user requests it, and never more than 10 pages per inspection. Questions about the crawler: contact us.