# EchoScan

EchoScan is a pre-login device trust and browser fingerprinting platform that helps online services recognize returning devices and assess browser, network, and automation risk. Browser Verifier produces an Imprint in the browser; trusted server code uses a Secret API Key to retrieve a Lite or Pro Report and applies the customer's risk policy.

## Canonical documentation

- AI integration context: https://echoscan.org/docs/ai-context.md
- Developer API: https://echoscan.org/pages/developers/api-en-US.html
- Agent API: https://echoscan.org/pages/agent-api-en-US.html
- OpenAPI 3.1: https://echoscan.org/openapi.json
- RFC 9727 API Catalog: https://echoscan.org/.well-known/api-catalog
- Production MCP guide: https://echoscan.org/docs/mcp-en-US.md
- Homepage: https://echoscan.org/

## Published research

Browser Fingerprint Stability Study v1.0 contains 94 valid measurements across 3 device environments and 8 Device / Browser combinations.

- Report: https://echoscan.org/pages/browser-fingerprint-stability-zh-CN.html
- Research JSON: https://echoscan.org/research/browser-fingerprint-stability/research-summary.json
- Aggregate CSV: https://echoscan.org/research/browser-fingerprint-stability/results-summary.csv
- Persistent device identity remained generally consistent across the tested browser restart, site-data clearing, network-change, and private-browsing conditions.
- Firefox, Safari, Windows Laptop Chrome, and Brave showed session-context identity changes in the tested environments.
- In the tested Brave environment, the ordinary-window context recovered after two independent Private sessions, while the two Private sessions formed distinct, internally stable context states.
- Device continuity, browser session context, and Network Status behaved as separate information dimensions in the tested environments.
- Scope: the results apply to the tested environments and are not a global accuracy benchmark or an overall false-positive or false-negative rate.

## Production MCP

- Endpoint: https://api.echoscan.org/mcp
- Transport: Streamable HTTP
- Authorization: OAuth 2.1 Authorization Code + PKCE S256
- Tools: echoscan_get_report, echoscan_get_history, echoscan_get_usage
- Guide: https://echoscan.org/docs/mcp-en-US.md

## Agent Trial

Machine clients discover availability and purchase terms through the live product catalog and OpenAPI contract.

- Product catalog: https://api.echoscan.org/api/v1/agent/products
- OpenAPI contract: https://echoscan.org/openapi.json
- Human-readable Agent API: https://echoscan.org/pages/agent-api-en-US.html