The identity layer for the agentic web

Detect Bots. Verify Bots.
Both Sides of Identity.

For 20 years, the internet asked "prove you're human." Now it needs "prove you're a bot." Detection Lab does both — 34 behavioral signals for detection, 20 for verification. Zero CAPTCHAs. Zero friction.

Free tier — no credit card required.

// POST /api/score { "overall_score": 91.4, "verdict": "PASS", "signals": { "mouse_curvature": 94.2, "keystroke_timing": 88.7, "scroll_behavior": 91.0, // ... 25 more signals }, "processing_ms": 23 }
The execution layer for the agentic web

Power Your Bots.
Defeat Every Obstacle.

Your AI assistant fills forms, logs into accounts, solves CAPTCHAs, and handles 2FA — on any website. Zero human-in-the-loop. Every click indistinguishable from a real user.

We built the best bot detection. Then we built the only bot that passes it.

# Run the autonomous agent $ python -m browser_engine.agent \ --url "https://example.com/register" \ --desc "Fill the registration form" \ --dry-run # Output: Task: Fill the registration form URL: https://example.com/register Phase A: 8 fields mapped (LLM) Phase B: 12 actions generated Obstacles: honeypot skipped, CAPTCHA solved Result: SUCCESS (4.2s, 0 human input)
28
Behavioral Signals
<50ms
Latency
28
Challenge Pages
Zero
User Friction
Any
Website
Zero
Human Input
4.2s
Average Task
Passes
Bot Detection

Two Products. One Platform.

Whether you need to block bots or trust them, Detection Lab has the behavioral signals.

🛡
Bot Detection
"Is this a human?"

34 behavioral signals score every interaction. Mouse curves, keystroke timing, scroll patterns — biology leaks through. Get a PASS/FAIL verdict in under 50ms.

  • Login protection
  • Form spam prevention
  • Ad fraud detection
  • Account takeover prevention
Try Detection
NEW
🤖
Bot Verification
"Is this a bot?"

20 inverted signals prove an entity IS a bot. Body Check measures machine precision. Mind Check measures autonomous reasoning. Get BOT_VERIFIED + a JWT trust token.

  • Agent platforms (A2A trust)
  • Automated commerce verification
  • Zero Trust agent identity
  • Bot type classification
Try Verification

Two Engines. One Platform.

An autonomous agent for web tasks. A stealth engine for behavioral simulation.

AGENT
🧠
Autonomous Web Agent
"Give it a URL and a task."

Give it a URL and a description. The agent reads the page, maps form fields, resolves obstacles, and completes the task — no scripts, no selectors, no maintenance.

  • Automate signups and registrations
  • Let your AI assistant fill any form
  • Handle multi-step wizards end-to-end
  • Log into sites with 2FA automatically
Try Agent
🎯
Behavioral Stealth Engine
"Indistinguishable from human."

Generate mouse movements, keystrokes, and scroll patterns that pass 34-signal bot detection. OS-level input injection means every event is isTrusted=true.

  • Build automation that doesn't get blocked
  • Stress-test your own bot defenses
  • Create realistic synthetic user sessions
  • Research behavioral biometrics
View Docs

Use Cases

Real-world scenarios powered by the autonomous agent and stealth engine.

🤖
AI Assistant Automation

Your AI books flights, fills out government forms, manages subscriptions. Hand it a URL — it handles the rest.

🧪
QA & E2E Testing

Run automated tests that behave like real users. Pass bot detection on staging. Catch UX issues bots normally miss.

📊
Web Scraping & Data

Collect data from sites that block automation. Login, navigate, extract — with sessions that persist across runs.

🔴
Red Team Security

Stress-test your own defenses with the same engine that powers the agent. Measure detection resistance across 34 signals.

How It Works

Three steps for each product. No user-facing challenges, no interruptions.

1

Add the JS Snippet

One <script> tag, under 8 KB gzipped. Passively collects mouse, keyboard, and scroll telemetry. No UI, no pop-ups.

2

Collect Behavioral Data

The collector runs silently in the background. No interruptions, no consent banners for interaction data.

3

Score via REST API

POST telemetry to /api/score. Get a 0–100 score plus per-signal breakdown in under 50ms.

How It Works

Three steps for each engine. No human input required at any stage.

1

Define the Task

Give it a URL and a natural language description. --url https://site.com/register --desc "Fill the form"

2

Agent Plans & Executes

Two-phase planner maps fields (LLM) then generates actions (Python). CAPTCHAs, 2FA, and honeypots resolved automatically.

3

Verify & Report

Get screenshots, timing data, action trace, and a run log. Every action is auditable.

Behavioral Signals

Every signal scored independently. Combined into one verdict.

Motor Control (8 signals)
🖱
Mouse Curvature
Natural Bezier curves vs bot straight lines
💨
Speed Variability
Bell-curve acceleration and deceleration
🎯
Click Precision
Natural offset from element center
🖐
Hover-Before-Click
Mouseenter precedes click in human behavior
Overshoot
Cursor passes target, then corrects back
🔀
Direction Changes
Mid-path corrections reveal motor planning
📈
Path Uniqueness
No two human paths are identical
Velocity Asymmetry
Humans accelerate fast, decelerate slow
Timing (5 signals)
Keystroke Timing
Gaussian distribution of inter-key delays
Action Pacing
Variable delays between interactions
📖
Dwell Time
Reading time proportional to content length
📊
Timing Distribution Fit
Action intervals match log-normal distribution
📏
Spatial Efficiency
Path length vs straight-line distance ratio
Browser (5 signals)
🌐
Fingerprint
Browser environment consistency check
🎨
CSS Fingerprint
Scrollbar width, color depth, pointer type
🕵
Stealth Artifacts
Detects headless Chrome and stealth plugins
Event Trust
isTrusted flag on DOM events (not injectable)
📜
Scroll Jump Detection
Detects programmatic scrollTo() calls
Content (4 signals)
📜
Scroll Behavior
Variable increments, pauses, regressions
📚
Vocabulary Richness
Type-token ratio and word diversity
Typing Burst Pattern
Word-level bursts with inter-word pauses
💬
Content Naturalness
Text structure and formatting patterns
Real-World Interaction (3 signals)
💬
Overlay Reaction
Response timing to popups, modals, consent banners
🤚
Drag Trajectory
Natural start-drag-release curve with momentum
🔄
Retry Behavior
Human-like retry patterns on failed interactions
Growth Hacking Hardening (3 signals)
🧠
LLM Text Detection
Detects AI-generated text patterns in form input
🔍
Fingerprint Coherence
Cross-signal consistency of browser environment
🌍
Geo Consistency
IP geolocation vs timezone vs locale alignment

Obstacles & Modules

Every obstacle the web throws at bots. Every module that defeats it.

Authentication (3)
🔒
Login Walls
AuthManager with storageState persistence
📱
2FA / MFA
TOTP via pyotp, email polling, SMS via Twilio
Session Timeouts
Re-auth detection + automatic resume
Challenges (3)
🧩
CAPTCHAs
Camoufox stealth browser + CapSolver API
🍯
Honeypots
is_honeypot() detection skips hidden traps
Rate Limiting
Hawkes process pacing with adaptive delays
Dynamic UI (4)
🔄
Dynamic Forms
QuiescenceObserver waits for DOM to settle
🔽
Custom Dropdowns
WidgetInteractor handles non-native selects
Delayed Validation
Re-snapshot after async validation completes
🗔
Modal Dialogs
Overlay detection + context-aware interaction
Intelligence (3)
🚫
Model Refusal
3-lane field mapping bypasses LLM refusals
🔀
Field Mismatch
EncoderMapper handles encoding/decoding
Loading States
Quiescence gating before any interaction

Integration in 2 Minutes

Three examples. Copy, paste, ship.

# Detect a bot — POST /api/score curl -X POST https://detectionlab.app/api/score \ -H "Content-Type: application/json" \ -H "X-API-Key: detlab_your_key_here" \ -d '{"events": [...]}' # Response: { "overall_score": 91.4, "verdict": "PASS", "signals": { "mouse_curvature": { "score": 94.2, "weight": 0.15 }, "keystroke_timing": { "score": 88.7, "weight": 0.15 }, // ... 26 more signals } }

Get Started in 2 Minutes

Three ways to use the engine. CLI, Python, or config.

# Run the autonomous agent $ python -m browser_engine.agent \ --url "https://example.com/register" \ --desc "Fill the registration form" \ --dry-run # Output: Phase A: 8 fields mapped via LLM first_name -> vault:identity.first_name email -> vault:identity.email password -> vault:credentials.password ... 5 more fields Phase B: 12 actions generated 1. click #first_name 2. fill "Jane" 3. click #email ... 9 more actions Result: SUCCESS (4.2s, 0 human input)

How Detection Lab Compares

Transparent scoring, no Google dependency, academic foundation. And the only platform that verifies bots.

Detection Lab reCAPTCHA v3 Cloudflare Turnstile FingerprintJS Pro
Detection method 34 behavioral signals Risk score (opaque) Challenge + fingerprint Device fingerprint only
Bot Verification 20 signals + trust token No No No
Continuous Sessions Yes No No No
JWT Trust Tokens Yes No No No
Bot Type Classification 4 types No No No
User friction Zero Badge required Minimal widget Zero
Signal transparency Full breakdown Opaque score only Pass/fail only Confidence score
Free tier 100 calls/mo Unlimited (with limits) Unlimited (with limits) 20K identifications
Paid pricing From $29/mo Enterprise only Part of CF plans From $200/mo
Google dependency None Full None None
Academic foundation Fitts' Law, sigma-lognormal Proprietary Proprietary Entropy-based

How the Agent Compares

isTrusted events, behavioral simulation, and obstacle resolution. No other agent does all three.

Detection Lab Agent Browser Use Skyvern LaVague
isTrusted events Yes (OS-level input) No (known bug) No No
Behavioral simulation Bezier + Fitts' Law + AR(1) None None None
CAPTCHA handling Camoufox + CapSolver None Cloud only (paid) None
2FA / MFA TOTP + email + SMS None TOTP None
Detection resistance Passes 34-signal scoring Easily detected Easily detected Easily detected
Session persistence storageState + auto re-auth Manual config Yes user_data_dir only
Safety classification 4-tier (AUTO/CONFIRM/ESCALATE/BLOCK) None None None

Simple, Transparent Pricing

Start free on both products. Scale when you're ready.

View Pricing Plans →

Built on Peer-Reviewed Research

Detection Lab's signals are grounded in decades of motor control, HCI, and identity research.

Fitts' Law
Fitts, 1954

Movement time is a logarithmic function of distance and target size. Humans exhibit predictable speed-accuracy tradeoffs that bots don't replicate.

Sigma-Lognormal Model
Plamondon, 1995

Human velocity profiles follow a sum of lognormal functions. This produces the characteristic bell-shaped speed curves that Detection Lab measures.

Keystroke Dynamics
Monrose & Rubin, 2000

Inter-key timing distributions are unique to individuals and follow Gaussian patterns. Bots produce uniform or perfectly periodic keystrokes.

Non-Human Identity (NHI)
OWASP, 2024

OWASP's NHI Top 10 identifies machine identity as a critical security gap. Detection Lab's bot verification provides behavioral attestation for non-human entities.

Digital Identity Guidelines
NIST SP 800-63B-4, 2024

NIST's updated identity guidelines recognize behavioral signals as a valid authentication factor. Detection Lab implements 34 behavioral biometric signals.