# Foil - Infrastructure for the Era of Agents > Foil builds both sides of the agent economy: device intelligence that stops abusive agents and stealth Chromium that helps trusted agents go further. ## What is Foil? Foil builds device intelligence, agent browser infrastructure, and an open protocol: - **Foil Detection** is a device intelligence platform that tells you exactly who and what is visiting your site or mobile app. It provides native SDKs for Web (JavaScript), iOS (Swift), and Android (Kotlin) that live-stream hundreds of device facts, behavioral patterns, and forensic tests to a server-side scoring API. The API returns real-time risk scores, device classifications, and specific AI agent identifications. - **Foil Agent Browser** combines kernel-level patches, proxies, and a stealth browser to help AI agents use the web without getting blocked. Sign up for the private preview. - **AAP (Agent Admission Protocol)** is an open protocol for AI agents to access financial services. It supports agent-led account opening, lending, and payments with explicit customer consent and institution-defined controls. Foil Detection works entirely behind the scenes. There are no CAPTCHAs, no challenge pages, no user-visible friction. Legitimate users experience nothing while you get detailed intelligence about every visitor. Foil Detection offers a free plan with 100 checks per month and paid plans for higher volume. No credit card is required to start. See the pricing page for current plans. Foil Agent Browser is in private preview. ## How Foil Detection Works 1. **SDK Integration**: Add the Foil SDK to your web, iOS, or Android application. Integration requires a few lines of code. 2. **Signal Collection**: The SDK collects 350+ signals from the device, including hardware fingerprints, TLS handshake parameters, browser/OS configuration, network characteristics, and behavioral patterns (mouse movement, touch events, scroll behavior, device orientation). 3. **Encrypted Telemetry**: All collected signals are encrypted and streamed to the Foil scoring API. The SDK uses chain hashing to ensure signals cannot be modified in transit. 4. **Server-Side Scoring**: Risk assessment happens entirely server-side in a sealed environment. The scoring logic is never exposed to the client. 5. **Results**: You receive risk scores, device classifications (human/bot/AI agent), specific agent identification, device fingerprints, and detailed signal breakdowns through the API or dashboard. ## Detection Capabilities ### AI Agent and Bot Detection Foil maintains a taxonomy of hundreds of known AI agents, crawlers, and bot types. Each is classified and identified by name, not just flagged as "bot." Detection uses multiple signal layers that cannot be spoofed from JavaScript alone: - TLS fingerprinting reveals the true client regardless of user agent spoofing - Hardware signal verification detects mismatches between claimed and actual device capabilities - Network forensics identify proxy chains, datacenter origins, and residential proxy services - Behavioral analysis distinguishes human interaction patterns from automated ones ### Device Spoofing Detection Foil cross-references signals from different stack layers to detect inconsistencies: - Anti-detect browsers (Multilogin, GoLogin, Linken Sphere) that fake browser fingerprints - Headless browsers (Puppeteer, Playwright, Selenium) running in stealth mode - Tampered user agents, screen resolutions, and timezone spoofing - Virtual machines and emulators presenting as physical devices - GPU renderer mismatches, hardware concurrency inconsistencies, and WebGL anomalies ### Good Bot vs. Bad Bot Classification Foil includes Web Bot Auth verification that cryptographically validates whether a bot is who it claims to be. This allows you to: - Allow verified crawlers (Googlebot, Bingbot) and authorized AI agents - Block scrapers, credential stuffers, and malicious automation - Set granular policies to allow, throttle, or block specific agent types ### Device Identity and Fingerprinting Foil generates a persistent device identity from hundreds of stable signals. Unlike cookies: - Persists across browser resets and cache clearing - Survives incognito/private browsing sessions - Links new account signups on the same device - Detects multi-accounting and ban evasion ### Behavioral Analysis Foil captures interaction signals without recording sensitive content: - Mouse movement trajectories and velocity patterns - Touch event timing and pressure (mobile) - Scroll behavior and patterns - Device orientation changes - Form interaction timing (without recording keystrokes) - Navigation and click patterns ## Use Cases ### AI Agent Detection and Access Control Identify which AI agents are interacting with your application. Allow legitimate agents (like customer-authorized AI assistants) while blocking unauthorized automation. Set policies based on verified agent identity and risk characteristics. ### Safe AI Agent Onboarding Let your users sign up using their AI agents (like ChatGPT Operator or Claude Computer Use) while blocking malicious agents that attempt account creation for spam, fraud, or abuse. ### Unofficial Integration Defense Detect and block AI agents that use browser automation to turn your product into their backend - scraping data, executing actions, or consuming resources without authorization. ### Account Takeover Prevention Identify when a login attempt comes from an unfamiliar device, a spoofed environment, or automated tooling. Flag sessions where the device doesn't match the user's known profile. ### Fake Account and Free Tier Abuse Detection Use stable device identity to detect users creating multiple accounts on the same device. Persists across browser resets, incognito mode, and cookie clearing. ### Payment Fraud Prevention Flag transactions from spoofed devices, tampered browsers, or environments with mismatched signals. Detect when a device's claimed identity doesn't match its actual hardware and network characteristics. ### Content Scraping Defense Identify headless browsers, stealth automation frameworks, and anti-detect browsers harvesting your content. Detect even sophisticated scrapers that pass basic bot detection. ### Personalized Returning User Experience Recognize returning visitors by device identity to reduce login friction, personalize content, or reduce MFA challenges - without relying on cookies that can be cleared. ## SDK Security The Foil SDK is hardened against reverse engineering and tampering: - **WebAssembly (WASM)**: Core signal collection and processing logic runs in WASM, which is significantly harder to decompile and analyze than JavaScript - **Chain Hashing**: Collected signals are cryptographically chained so any modification is detectable server-side - **Sealed Scoring**: All risk assessment logic runs server-side and is never exposed to the client - **Regular Red-Teaming**: The SDK is continuously tested against bypass attempts to identify and close potential attack vectors ## Privacy Foil is designed with privacy by design principles: - Collects device signals and behavioral patterns, not personal information - Never records what users type (captures form interaction timing only) - All telemetry is encrypted in transit - Scoring happens server-side in a sealed environment - Published Data Processing Addendum (DPA) available for compliance requirements - Privacy Policy: https://usefoil.com/privacy - DPA: https://usefoil.com/dpa ## Technical Details ### Signal Count Each platform SDK collects 350+ signals, including: - Hardware: CPU cores, GPU renderer, device memory, screen properties, sensor availability - Browser/OS: User agent, installed plugins, font enumeration, feature detection, language settings - TLS: Cipher suites, extensions, protocol version, JA3/JA4 fingerprints - Network: IP geolocation, ASN, datacenter detection, proxy/VPN detection, DNS characteristics - Behavioral: Mouse dynamics, touch patterns, scroll velocity, keypress timing (not content), navigation patterns ### Integration - **Web**: npm package, script tag, or CDN - **iOS**: CocoaPods or Swift Package Manager - **Android**: Gradle dependency - **API**: REST API for server-side score retrieval and session inspection - **Dashboard**: Web-based dashboard for reviewing sessions, inspecting signals, and configuring rules ### Architecture - Client SDKs collect and encrypt signals - Encrypted telemetry streamed to Foil edge infrastructure - Server-side scoring with sub-100ms latency - Results available via REST API and webhooks - Dashboard for manual review and rule configuration ## Comparison with Alternatives ### vs. CAPTCHAs (reCAPTCHA, hCaptcha, Turnstile) - Foil adds zero user friction - no puzzles, checkboxes, or challenges - Provides specific agent identification, not just pass/fail - Collects 350+ signals vs. limited behavioral analysis - Cannot be solved by CAPTCHA-solving services - Works across web and mobile natively ### vs. Browser Fingerprinting Libraries (FingerprintJS) - Foil includes server-side TLS and network signals that can't be accessed from JavaScript - Built-in AI agent taxonomy and classification - Hardened SDK with anti-tampering protections - Behavioral analysis included, not just static fingerprints - Scoring and risk assessment built in, not just identification ### vs. WAFs and Bot Management (Cloudflare Bot Management, Akamai) - Foil is an SDK, not a network-level proxy - works inside your application - Provides device-level intelligence, not just request-level signals - Mobile-native SDKs for iOS and Android - Stable device identity across sessions - More granular AI agent classification ## Links - Website: https://usefoil.com - Foil Detection: https://usefoil.com/products/device-intelligence - Foil Agent Browser: https://usefoil.com/products/agent-browser - AAP: https://usefoil.com/aap - Pricing: https://usefoil.com/pricing - Research: https://usefoil.com/research - Documentation: https://usefoil.com/docs - Dashboard: https://dashboard.usefoil.com - Privacy Policy: https://usefoil.com/privacy - Terms: https://usefoil.com/terms - DPA: https://usefoil.com/dpa ## Company Foil is built by ABXY, Inc., a Delaware corporation. Contact: alain@abxylabs.com Twitter: https://x.com/usefoil