/claude-authenticity

name: claude-authenticity
description: >
  Detect whether an API endpoint is backed by genuine Claude (not a wrapper,
  proxy, or impersonator) using 9 weighted rule-based checks that mirror the
  claude-verify project. Also extracts injected system prompts from providers
  that override Claude's identity. Fully self-contained — copy the code below
  and run, no extra packages beyond httpx. Use when the user wants to verify a
  Claude API key or endpoint, check if a third-party Claude service is authentic,
  audit API providers for Claude authenticity, test multiple models in parallel,
  or discover what system prompt a provider has injected.

Claude Authenticity Skill

Verify whether an API endpoint serves genuine Claude and optionally extract any injected system prompt.

**No installation required beyond `httpx`.** Copy the code blocks below directly into a single `.py` file and run — no openjudge, no cookbooks, no other setup.

pip install httpx

The 9 checks (mirrors [claude-verify](https://github.com/molloryn/claude-verify))

| # | Check | Weight | Signal | |---|-------|--------|--------| | 1 | Signature 长度 | 12 | `signature` field in response (official API exclusive) | | 2 | 身份回答 | 12 | Reply mentions `claude code` / `cli` / `command` | | 3 | Thinking 输出 | 14 | Extended-thinking block present | | 4 | Thinking 身份 | 8 | Thinking text references Claude Code / CLI | | 5 | 响应结构 | 14 | `id` + `cache_creation` fields present | | 6 | 系统提示词 | 10 | No prompt-injection signals (reverse check) | | 7 | 工具支持 | 12 | Reply mentions `bash` / `file` / `read` / `write` | | 8 | 多轮对话 | 10 | Identity keywords appear ≥ 2 times | | 9 | Output Config | 10 | `cache_creation` or `service_tier` present |

**Score → verdict:** ≥ 85 → `genuine 正版 ✓` / 60–84 → `suspected 疑似 ?` / < 60 → `likely_fake 非正版 ✗`

Gather from user before running

| Info | Required? | Notes | |------|-----------|-------| | API endpoint | Yes | Native: `https://xxx/v1/messages` OpenAI-compat: `https://xxx/v1/chat/completions` | | API key | Yes | The key to test | | Model name(s) | Yes | One or more model IDs | | API type | No | `anthropic` (default, **always prefer**) or `openai` | | Extract prompt | No | Set `EXTRACT_PROMPT = True` to also attempt system prompt extraction |

**CRITICAL — always use `api_type="anthropic"`.** OpenAI-compatible format silently drops `signature`, `thinking`, and `cache_creation`, causing genuine Claude endpoints to score < 40. Only use `openai` if the endpoint rejects native-format requests entirely.

Self-contained script

Save as `claude_authenticity.py` and run:

python claude_authenticity.py

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
Claude Authenticity Checker
============================
Verify whether an API endpoint serves genuine Claude using 9 weighted checks.
Only requires: pip install httpx

Usage: edit the CONFIG section below, then run:
    python claude_authenticity.py
"""
from __future__ import annotations
import asyncio, json, sys

# ============================================================
# CONFIG — edit here
# ============================================================
ENDPOINT      = "https://your-provider.com/v1/messages"
API_KEY       = "sk-xxx"
MODELS        = ["claude-sonnet-4-6", "claude-opus-4-6"]
API_TYPE      = "anthropic"   # "anthropic" (default) or "openai"
MODE          = "full"        # "full" (9 checks) or "quick" (8 checks)
SKIP_IDENTITY = False         # True = skip identity keyword checks
EXTRACT_PROMPT = False        # True = also attempt system prompt extraction
# ============================================================
from dataclasses import dataclass, field
from typing import Any, Dict, List, Optional, Tuple


# ────────────────────────────────────────────────────────────
# Data structures
# ────────────────────────────────────────────────────────────

@dataclass
class CheckResult:
    id: str
    label: str
    weight: int
    passed: bool
    detail: str

@dataclass
class AuthenticityResult:
    score: float
    verdict: str
    reason: str
    checks: List[CheckResult]
    answer_text: str = ""
    thinking_text: str = ""
    error: Optional[str] = None


# ────────────────────────────────────────────────────────────
# Helpers
# ────────────────────────────────────────────────────────────

_SIG_KEYS = {"signature", "sig", "x-claude-signature", "x_signature", "xsignature"}

def _parse(text: str) -> Optional[Dict[str, Any]]:
    try:
        return json.loads(text) if text and text.strip() else None
    except Exception:
        return None

def _find_sig(value: Any, depth: int = 0) -> str:
    if depth > 6: return ""
    if isinstance(value, list):
        for item in value:
            r = _find_sig(item, depth + 1)
            if r: return r
    if isinstance(value, dict):
        for k, v in value.items():
            if k.lower() in _SIG_KEYS and isinstance(v, str) and v.strip():
                return v
            r = _find_sig(v, depth + 1)
            if r: return r
    return ""

def _sig(raw_json: str) -> Tuple[str, str]:
    data = _parse(raw_json)
    if not data: return "", ""
    s = _find_sig(data)
    return (s, "响应JSON") if s else ("", "")


# ────────────────────────────────────────────────────────────
# The 9 checks (mirrors claude-verify/checks.ts)
# ────────────────────────────────────────────────────────────

def _c_signature(sig, sig_src, sig_min, **_) -> CheckResult:
    l = len(sig.strip())
    return CheckResult("signature", "Signature 长度检测", 12, l >= sig_min,
                       f"{sig_src}长度 {l}，阈值 {sig_min}")

def _c_answer_id(answer, **_) -> CheckResult:
    kw = ["claude code", "cli", "命令行", "command", "terminal"]
    ok = any(k in answer.lower() for k in kw)
    return CheckResult("answerIdentity", "身份回答检测", 12, ok,
                       "包含关键身份词" if ok else "未发现关键身份词")

def _c_thinking_out(thinking, **_) -> CheckResult:
    t = thinking.strip()
    return Ch