signatures: refresh 2026 endpoints, capture real TLS fingerprints - #8
Open
jaschadub wants to merge 1 commit into
Open
signatures: refresh 2026 endpoints, capture real TLS fingerprints#8jaschadub wants to merge 1 commit into
jaschadub wants to merge 1 commit into
Conversation
Web-verified accuracy pass over the detection signature database. Python signatures/*.json and the Rust assets copy stay byte-identical; all files re-signed with the current SchemaPin key and verified in both dirs. llm_domains (107 -> 114): - remove squatted/never-real/shut-down hosts: api.xai.com, api.suno.ai, api.endpoints.anyscale.com, text.octoai.run, api.lepton.ai - fix stale hosts: api-inference.huggingface.co -> router.huggingface.co, models.inference.ai.azure.com -> models.github.ai, gateway.ai.vercel.app -> ai-gateway.vercel.sh, api.luma-labs.com -> api.lumalabs.ai - add 2026 providers: MiniMax .io/.minimaxi.com, api.moonshot.ai, Tencent Hunyuan, BytePlus ModelArk, Kling, Hume, Chutes, Poe, Tinker, Nebius .com agent_infra_domains (99 -> 154): - fix NXDOMAIN/rebranded: api.chroma.com -> api.trychroma.com, api.zep.us -> api.getzep.com, cloud.getzep.com -> app.getzep.com, api.bolt.new -> bolt.new, api.langtrace.ai -> app.langtrace.ai, mcp.run -> turbomcp.ai, mcp.composio.dev -> rube.app - remove dead: api.supermaven.com, api.continue.dev, mcphub.tools, api.opik.dev - add vendor-hosted remote MCP servers (Figma, Vercel, Slack, Square, Wix, Webflow, Intercom, Canva, Neon, Datadog, New Relic, Honeycomb, ...), new coding agents (Devin, Kiro, Zed, Cline, Roo, OpenHands, Warp, JetBrains, Trae, Jules, Gemini CLI backends), observability (Laminar, Galileo, Patronus, Vellum, ...), and registries/memory (Klavis, Letta, supermemory) - generic apex domains that would false-positive on normal use excluded domain_suffixes: add .mcp.cloudflare.com (per-service MCP subdomains) tls_fingerprints: replace placeholder JA3/JA4 with real values captured from each client's actual ClientHello (requests, httpx, aiohttp, node fetch, rust reqwest/rustls), computed through the detector's own compute_ja3/ja4 so stored values match detection exactly. Add scripts/resign_signatures.py to re-sign changed JSONs and sync .json+.sig into the Rust crate assets in one step. Fix a clippy useless-borrow warning in main.rs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Web-verified accuracy pass over the detection signature database. Python
signatures/*.jsonand the Rust assets copy stay byte-identical; all files re-signed with the current SchemaPin key and verified in both dirs (Rusttest_signaturespasses at runtime).LLM API domains (107 → 114)
api.xai.com,api.suno.ai,api.endpoints.anyscale.com,text.octoai.run,api.lepton.aiapi-inference.huggingface.co→router.huggingface.co,models.inference.ai.azure.com→models.github.ai,gateway.ai.vercel.app→ai-gateway.vercel.sh,api.luma-labs.com→api.lumalabs.ai.io/.minimaxi.com,api.moonshot.ai, Tencent Hunyuan, BytePlus ModelArk, Kling, Hume, Chutes, Poe, Thinking Machines Tinker, Nebius.comAgent-infra domains (99 → 154)
api.trychroma.com, Zep→api.getzep.com/app.getzep.com,api.bolt.new→bolt.new,api.langtrace.ai→app.langtrace.ai,mcp.run→turbomcp.ai,mcp.composio.dev→rube.appapi.supermaven.com,api.continue.dev,mcphub.tools,api.opik.devdomain_suffixes: added.mcp.cloudflare.comTLS fingerprints
Replaced placeholder JA3/JA4 with real values captured from each client's actual ClientHello (requests, httpx, aiohttp, node fetch, rust reqwest/rustls), computed through the detector's own
compute_ja3/ja4so stored values match detection exactly.Tooling
scripts/resign_signatures.pyto re-sign changed JSONs and sync.json+.siginto the Rust crate assets in one step.main.rs.Verification
Python: 113 tests pass, ruff clean. Rust:
test_signatures(embedded signatures verified at runtime) + clippy clean.