Self-host Veridrop

Veridrop checks third-party AI API relays — the reseller gateways that claim to pass your requests straight through to Claude, GPT or Gemini. You give it a base URL, an API key and a model name; it fires a batch of probe requests and scores the answers against baselines captured from the official APIs. On Anthropic traffic the strongest evidence is cryptographic: thinking blocks carry a server-side signature a relay cannot forge, and that check weighs 25% of the Claude score. OpenAI and Gemini checks lean on protocol fields, message-id prefixes, stream versus non-stream consistency, usage-token fingerprints and capability tests for PDF reading, function calling and strict JSON output. Optional needle-in-a-haystack probes at 32k, 100k and 200k tokens (scaled to the advertised context ceiling) catch relays that quietly shrink the window they sold. Output is a weighted 0-100 score with a passed / marginal / failed verdict, and any critical finding caps the verdict regardless of the total. Operators can run the same engine themselves: a typer CLI with detect, compare and ping commands, plus a FastAPI web app served with uvicorn and a shipped systemd unit. There is no container image, so installation is git clone plus pip install and needs Python 3.10 or newer. The public instance at veridrop.app is free and needs no signup, keeps keys out of reports and logs, and aggregates community reports into a relay leaderboard funded by affiliate links and clearly labelled paid placement; the detection scores themselves are stated to be unaffected by payment.