How it works

Every page or message you check goes through the same five steps.

1.You open a page

The browser extension reads the text, links and files on the page you are viewing. It only does this with your permission.

2.We gather the facts

Our server tidies up what the extension sent and collects evidence: where the links lead, who owns the website, and what is inside any images or attachments.

3.A fast first opinion

An AI model reads the evidence and quickly says whether the page looks like a scam, how sure it is, and why.

4.A second AI double-checks

A reviewer AI does not just trust the first opinion. It uses specialized tools to look up websites, phone numbers, brands and known scam reports, and tests every claim.

5.You get a clear answer

The extension shows whether the page is a scam, a risk score from 0 to 100, the type of scam, the warning signs it found, and what to do next.

The rest of this page is for software builders

Below is a technical tour of the AI models, code and servers. You do not need any of it to stay safe.

Check a message

I'm a builder, show me the details

TRANSPARENT AI

Want to learn how it's made?

Every check runs through the same pipeline. Drag the board to look around, click a block to flip it over, then run a trace to watch what each model and tool does.

INPUT · UIDETERMINISTICAI MODELAGENTDrag to pan · Click to flip

API server · Bun + Hono

INSPECTOR · STEP 01

Submission

INPUT

There are two front doors. The website takes pasted text or a file (image, PDF, audio, .txt, .eml); files go straight to S3 with a presigned URL so the API only ever sees an asset id. The extension's background worker sends the open page or Gmail message as text plus the page URL.

WHAT GOES IN

// website: file upload
POST /v1/assets/presign → { assetId, uploadUrl }
PUT  uploadUrl  (bytes to S3)
POST /v1/assets/:assetId/complete

WHAT COMES OUT

POST /v1/analyses
{
  "inputs": [
    { "type": "text", "content": "…" }
    // or { "type": "image" | "pdf" | "audio", "assetId" }
    // or { "type": "url", "url" }
  ],
  "context": {
    "source": "browser_extension",
    "pageUrl": "https://mail.google.com/…"
  }
}

WHAT HAPPENS, STEP BY STEP

The website proxies requests through its own /api routes; the extension calls the API from its background worker.
Email and page text is capped at 20,000 characters by the extension.
The API validates the body with analyzeRequestSchema and checks every asset is uploaded before starting.

SAMPLE TRACEidle

Press “Run a sample trace” to send an example phishing email through the pipeline. Lines use our real field and tool names; the values and timings are illustrative, not a recorded run.

Built withNext.jsBun + HonoVercel AI SDKOpenAIPostgreSQL + DrizzleRedisS3The trace uses a sample phishing email. Values are illustrative.