# AI Usage Analyzer The AI Usage Analyzer classifies source code and websites as AI slop, sophisticated AI-assisted work, or genuine human work. It exists to end the practice of calling projects slop without evidence: every verdict is produced by a transparent, reproducible pipeline and published as a persistent report anyone can inspect. Open it from the **Tools** menu, or go straight to `/tools/isslop`. It is public: you do not need an account. Signed-in members keep their analysis history on their account; as a guest your history is bound to your browser session, and it is claimed by your account automatically the first time you visit the tool while signed in. ## The three verdicts The whole difference in one line: **slop ships the model's defaults, sophisticated AI ships the engineer's decisions, and human ships what no model would ever write.** This is the canonical definition; every check and every grade traces back to it. - **ai-slop**: untouched LLM defaults, shipped as-is. Low effort by definition, because the model's defaults are terrible. - **sophisticated-ai**: clear signs of AI, steered by a programmer who knows exactly what they are doing. The model typed; the engineer decided. - **human**: source code no AI would ever write that way. Opinionated, particular, unmistakably someone's. Using AI is not the crime; shipping its defaults is. That is why messy human code is explicitly not slop, and why clean, well-curated AI code is explicitly not slop either. ## Method Classification uses a two-axis model derived from published static-analysis research: - **Origin score (0-100)**: likelihood the code was AI-generated, computed from stylometric regularity (indentation variance, blank-line ratio, docstring uniformity), narration comments, AI tool signatures, and textbook naming. - **Quality deficit score (0-100)**: a saturating, severity-weighted aggregate of anti-pattern signals: hardcoded secrets, injection patterns, unresolved dependencies, placeholder and prompt-leak comments, swallowed errors, over-abstraction, duplication, convention deviation, and language-specific tells. The two axes intersect into five descriptive categories: `ai-slop`, `sophisticated-ai`, `human-clean`, `human-messy`, and `uncertain`. High-quality AI-assisted code is explicitly not slop, and messy human code is explicitly not slop. Vendored, generated, minified, binary, and lockfile content is excluded before analysis; minified bundles and framework build artifacts are still fingerprint-scanned for provenance markers. The headline grade is an **authenticity grade**. A high human percentage is positive and a high, recognizable AI-usage percentage is negative, because the badge certifies human authorship. The A-F grade is therefore driven primarily by detected AI usage and secondarily by quality deficit: even clean, well-curated AI code lowers the authenticity grade, and slop (AI plus anti-patterns) lowers it furthest. Per-file scores aggregate into a repository verdict weighted by SLOC and path criticality, with a confidence band. **Template provenance is part of the verdict.** A repository that is a recognisable, unmodified starter template or boilerplate (known template identity in its manifest, template marketing in its read-me, a kitchen-sink scaffold constellation) ships its scaffold's defaults, and the defaults share of the verdict rises accordingly - untouched boilerplates grade C-D rather than A and are categorized `ai-slop`, because shipping defaults as-is is the definition of slop no matter how clean the scaffold is. Every marker is listed in the report's Template Provenance section. A deterministic selection of representative files receives an additional AI review pass (the files are reviewed concurrently), and the final report is composed by the same model. When no AI backend is reachable the static engine remains fully authoritative. Images are reviewed too. Up to twenty images per source are analysed by a vision model (deterministically sampled when there are more, so the result stays stable), all concurrently. Each image gets its own A-to-F authenticity grade and a short explanation of the artifacts found (hands, garbled text, waxy skin, impossible lighting, warped geometry, the over-smooth diffusion look). The mean image AI-likelihood is folded into the overall score when images are present. The full plain-language catalog of every check lives on [AI Usage Analyzer: every check explained](/docs/isslop-checks.html). ## Pipeline 1. **Resolve**: every URL is probed with `git ls-remote`; git sources are shallow-cloned (depth 1) with an upfront size preflight and a hard 3 GB cancellation guard, other URLs are crawled to a bounded depth with file and byte caps. 2. **Inventory**: exclusion rules and language detection. 3. **Static analysis**: the multi-signal engine scores every file. 4. **AI review**: representative files are audited through the AI gateway. 5. **Image review**: qualifying images are graded by the vision model. 6. **Scoring**: two-axis aggregation, grade, human/AI percentages. 7. **Report**: findings are written to a persistent markdown report. The pipeline runs as an isolated subprocess that emits structured events; every event streams live to the page, so you see each file checked, each signal found, and the model reasoning in real time. Identical input content yields consistent output. Source workspaces are deleted as soon as an analysis terminates; only the persisted report and its evidence remain. ## Running an analysis 1. Paste a repository URL (`https://github.com/owner/repository`, `git@...`) or a website URL. 2. Press **Classify**. The live view opens immediately and streams every step. 3. When the analysis finishes, the report page shows the authenticity grade, the human/AI split, the full markdown report, the per-file results, the image review, and the badge embeds. You can run one analysis at a time. Targets that resolve to private or local addresses are refused. Completed analyses provide: - a persistent, publicly shareable report at `/tools/isslop/{uid}/report`, - a markdown download of the full report at `/tools/isslop/{uid}/report.md`, - a JSON API documented in the [Tools API group](/docs/api.html#tools), - an SVG badge at `/tools/isslop/{uid}/badge.svg` labeled `authenticity`, showing the human score and linking to the report, with ready-to-copy markdown and HTML embed snippets. Reports, badges and event trails are intentionally public capability URLs so badge holders can prove their score; only your personal history list is bound to your account or session. ## Caveats No detector is definitive. Results are calibrated guidance with explicit confidence levels, never proof of provenance.