get_self_view

ai.tunnelmind/data · Verify this server

P83 Gate 1. The caller is the subject: every fact here comes from the TLS handshake and headers the caller has already sent, so there is no render, no browser, and nothing to authorize. Three surfaces: - `client` — user-agent, HTTP protocol, TLS version/cipher, ClientHello length, the pre-hashed JA3/JA4 input components, header order. - `state` — how many cookies were sent (never their values), Referer, DNT, Global Privacy Control. - `network` — address, ASN and operator, coarse geography, edge colo, and the four-lens verdict on the caller's own IP. Every field carries a coverage state from the same three-value vocabulary as `/v1/verify`: `observed_clean`, `never_observed`, `degraded`. There is no fourth state. Fields that run inside a page — localStorage, canvas fingerprinting, cookie values — are reported `never_observed` with reason `not_observable_server_side`, because they are outside a server's vantage rather than missing. `claim_vs_conduct` compares the claimed user-agent against the shape of the request itself and returns `consistent`, `mismatch`, or `unverifiable`, with the evidence listed. It is deliberately narrow: JA4 requires Cloudflare Enterprise + Bot Management, so there is no portable fingerprint to look up in a public corpus, and this check only reports contradictions it can demonstrate from the request in hand. `unverifiable` is the honest default and is never dressed up as a pass. Use this tool when: - You want to know what a server learns about your client without asking you anything. - You are checking whether a client's user-agent claim matches its conduct. Do NOT use this tool when: - You need facts about some OTHER host — that is `POST /v1/verify/{node}`. Must be called directly at `data.tunnelmind.ai`. Behind a proxy, the connection properties describe the proxy, not the caller. `?receipt=true` attaches a signed Receipt v1.0 committed to the transparency log.