Blowhorn Tells

For AI agents and scripts

Tells is built to be run by automation. This page is the standing orders: how to get a report, how to read it, and how not to misuse it. Everything here is also what the human page does; there is no separate agent back door.

Two ways to get a report

1. Drive the page

Load tells.blowhorn.ai in the browser you are evaluating. The inspection runs on load. The run is finished when the raw report JSON appears in the page; read it straight out of the DOM:

// Playwright / Puppeteer, same shape
await page.goto("https://tells.blowhorn.ai/");
await page.waitForFunction(() =>
  document.querySelector("#jsonOut")?.textContent.trim().startsWith("{"));
const report = JSON.parse(
  await page.$eval("#jsonOut", (el) => el.textContent));

The score card (#scoreCard) shows the same verdict in short form. The Copy JSON and Download JSON buttons hand over the identical object.

2. Call the API

Route	What it returns
`GET /api/ping`	Server basics for your connection (IP view, headers, Cloudflare readings) plus the server time.
`GET /api/check`	A verdict scored from the request alone: headers, IP reputation, TLS and managed bot signals. No browser readings involved.
`POST /api/report`	The full report. Send the client readings object as JSON (192 KB at most); the response is `{ ok, receivedAt, verdict, server, client, detections }`, with the client object returned enriched with cross-context consistency readings. This route answers cross-origin callers with CORS headers, so a page or agent on another origin may post to it.

The surest way to learn the client payload is to run the page once and read the client object out of its report. The collectors that build it live in the open source for this site.

How to read the verdict

verdict.score runs 0 to 100 and starts at 100. Every finding subtracts points.
verdict.classification is likely_human (75 and up), suspicious (45 to 74), or likely_bot (under 45). verdict.risk is the same bands as low, medium, high.
verdict.reasons is the evidence: one entry per finding, each with an id, a severity of high, medium or low, a plain-words message, and the readings it came from.
Per-check results on the human page are derived from those reasons: a check with a high-severity reason reads Fail, with a medium or low reason reads Warning, with none reads Pass, and a check whose readings never arrived reads Not available. Not available is a statement about the browser or the plan this site runs on, not a failure.
detections lists which detection areas ran at all. A missing row means that area was not evaluated (for example the managed bot score on a plan without it), which is different from evaluating clean.

How to interpret a run

A bot verdict for an automated browser is the tool working. A stock Playwright, Puppeteer or headless Chrome run is supposed to score as a bot. Treat it as calibration, and measure your work by which reasons fire and how the score moves when your browser setup changes.
Compare like with like. Score a known-good, human-driven Chrome on the same machine and network as your reference, then diff the reasons, not just the score. IP reputation and latency findings follow the network, not the browser.
Consistency findings are the interesting ones. A spoofed value that agrees everywhere is a fingerprint choice; a value that disagrees between the request, the window, a worker and an iframe is a tell. The consistency sections exist to catch the second kind.
One run is one sample. Network intel, timing and behaviour readings vary between runs. Change one thing at a time and re-run.
The human check is optional and safe to take. Its form asks for an invented call sign and a typed phrase, never real identity. Its result only joins the report if a run completes it, and an agent that skips it loses nothing but that one check's evidence.

Rules of engagement

The API allows 30 requests per minute per route, method and source IP. Over the limit you get a 429 with retryAfterSeconds of 60. Back off; do not parallelize around it.
Never put real personal data in a report payload. The tool neither needs it nor keeps it: reports are scored and returned, not stored.
Findings describe this browser, this network and this moment. Do not present a report as a verdict about a person, a product or another website's defences.

The tool itself is at tells.blowhorn.ai. Every check it runs is explained in the check guide, and the platform guide maps the checks to the platforms where each one matters.