Website report · 1 h ago

decuff.ai

“decuff · Uncensored open-weight AI — API for Claude Code & Codex”

Template-written 41 evidence items Code reader analysed 16 scripts
What this means for you

decuff only talked to its own servers while we watched.E1

  • An AI agent used the site and saw 1 of 2 claimed features working.E37E40E41E39
  • AI / agents: I sent "hello" from the homepage box and "test" from the playground. Each time the page sent POST /v1/chat/completions, but no model answer came back, only "You're out of credits. Your message is kept." Getting a reply seems to need a sign-up or paid credits.E37E40E41
  • A working app / platform: Clicking ASK opened the chat playground, and its backend set up an account session (POST /v1/accounts, GET /v1/account) without asking for an email. I could not test the API for Claude Code and Codex because it needs a dc_sk_ API key. The docs list the endpoints and setup steps.E37E39
  • Also noticed, Status page loads live service data: The /status page called /api/uptime and the API catalog. It showed "All systems operational" with 2 models listed.E38
  • Tech check: the site claims ai / agents and a working app / platform, and its public page shows matching evidence.E32E33E13E14E15
  • We saw no known analytics or advertising services load on the first visit.E1

Tech check

What the site says about itself, next to what its public page actually loads. Facts only, no verdict: you decide.

Evidence found

AI / agents

“…Breach Docs Sign in Start a chat live · 2 models ready AI, decuffed. Uncensored open-weight models. The models n…”E32

AI-looking endpoints: /v1/service, /v1/catalog, /assets/figures/cuff.jsonE13E14E15E16

Evidence found

A working app / platform

“…you agree to the terms and confirm you’re 18 or older. API for Claude Code & Codex Models & pricing No email · no…”E33

Calls to its own backend: /v1/service, /v1/catalog, /assets/figures/cuff.jsonE13E14E15E16

Calls its own backend /v1/service, /v1/catalog, /assets/figures/cuff.jsonE13E14E15E16
Wallet code none seen
Contract calls in its code none seen
Talks to AI services none seen
Live connections none seen

What the AI agent tried

An AI agent (claude-opus-5-5) used the site in our sandbox for 7 steps and saw 1 of 2 claimed features working. It can't connect a wallet, pay, sign or log in, so those features count as "couldn't test". What it reports is what it observed, not a verdict.

Couldn't test

AI / agents

I sent "hello" from the homepage box and "test" from the playground. Each time the page sent POST /v1/chat/completions, but no model answer came back, only "You're out of credits. Your message is kept." Getting a reply seems to need a sign-up or paid credits.E37E40E41

Seen working

A working app / platform

Clicking ASK opened the chat playground, and its backend set up an account session (POST /v1/accounts, GET /v1/account) without asking for an email. I could not test the API for Claude Code and Codex because it needs a dc_sk_ API key. The docs list the endpoints and setup steps.E37E39

Also noticed

Things the agent saw along the way that aren't among the site's claims. Not counted above.

Noticed

Status page loads live service data

The /status page called /api/uptime and the API catalog. It showed "All systems operational" with 2 models listed.E38

Noticed

Free trial not applied to the anonymous playground session

The docs say accounts made without email start with a 500,000-token free trial on Flash. Even so, the first and second messages from the automatically created playground session both returned an out-of-credits notice.E37E39E41

What it is

  • The Internet Archive first saved this site on 2026-10-14 (28 days ago).E34
  • The site describes itself as: “Uncensored open-weight models that never refuse, on one OpenAI/Anthropic-compatible endpoint. Instant key, no KYC, private by design. Free t”E2
  • It's built with React (common tools for building web apps).E8
  • Notable building blocks in its code: Firebase SDK.E9
  • In your browser it can copy text to your clipboard and saves small bits of data in your browser.E10E11
  • It has sections such as /models, /breach, /docs, /account, /playground and /status.E31
  • While loading, it called 8 endpoints on its own servers, such as /v1/service, /v1/catalog, /assets/figures/cuff.json and 5 more.E13E14E15E16

Where your data goes

On a first visit the page only talked to its own servers (decuff.ai, api.decuff.ai).

How key features work

AI features

Parts of the site talk to AI services or AI endpoints (/v1/chat/completions). Text you type there may be sent to them.E26

/v1/chat/completions

Sign-in and accounts

Sign-in and account features show up in its code or traffic (/v1/account and /v1/account/sign-out).E29E30

/v1/account/v1/account/sign-out

Loading its content

Its content loads from its own API while you browse (/v1/service, /v1/catalog, /assets/figures/cuff.json, /assets/figures/slide.json and 2 more).E13E14E15E16E17

/v1/service/v1/catalog/assets/figures/cuff.json/assets/figures/slide.json/assets/figures/tag.json/assets/figures/cylinder.json

Drawing and editing in the browser

The page draws and edits graphics in your browser using the canvas.E12

canvas

Saving data on your device

It saves data in your browser (localStorage), so some things persist between visits.E11E7

local_storagelocalStorage

Cookies and storage

Names only. We never store the values.

localStorageE7: decuff-theme

Pages and API calls

Pages it links to

//models/breach/docs/account/playground/status/terms/contact/privacy/aup

Endpoints

Called while loading (seen) or named in the code (code).

api.decuff.ai/v1/serviceseenE13
api.decuff.ai/v1/catalogseenE14
decuff.ai/assets/figures/cuff.jsonseenE15
decuff.ai/assets/figures/slide.jsonseenE16
decuff.ai/assets/figures/tag.jsonseenE17
decuff.ai/assets/figures/cylinder.jsonseenE18
decuff.ai/assets/figures/cliff.jsonseenE19
decuff.ai/assets/figures/weights.jsonseenE20
/assets/figures/cuff.jsoncodeE21
/api/uptimecodeE22
/v1/policycodeE23
/api/ecodeE24
/api/flagscodeE25
/v1/chat/completionscodeE26
/api/rcodeE27
/v1/keyscodeE28
/v1/accountcodeE29
/v1/account/sign-outcodeE30

Evidence

Every sentence above points to one of these. Code references show the file, line:column and the short identifier that matched, never the site's code itself.

E1
Page title: decuff · Uncensored open-weight AI — API for Claude Code & Codex
page title · https://decuff.ai/
E2
Page description: Uncensored open-weight models that never refuse, on one OpenAI/Anthropic-compatible endpoint. Instant key, no KYC, private by design. Free tokens to s
page description · https://decuff.ai/
E3
Site name: decuff
page site_name · https://decuff.ai/
E4
Main heading: AI, DECUFFED.
page h1 · https://decuff.ai/
E5
30 request(s) to decuff.ai
types: 15 script, 6 fetch, 5 font
GET https://decuff.ai/ · script · 30 requests · network recording
E6
2 request(s) to api.decuff.ai
types: 2 fetch
GET https://api.decuff.ai/v1/service · fetch · 2 requests · network recording
E7
localStorage: 1 key(s) saved in your browser
localStorage keys: decuff-theme · values not stored
E8
React detected by the code reader (react-runtime)
confidence: medium
decuff.ai/assets/index-BxwcazBZ.js · “react-runtime” · the code reader
E9
Firebase SDK found in the code
decuff.ai/assets/index-BxwcazBZ.js @ 25:26802 · “firebaseapp.com” · pattern scan
E10
Uses the browser ability: clipboard_write
can copy text to your clipboard
decuff.ai/assets/index-BxwcazBZ.js @ 25:31237 · “clipboard.writeText(” · pattern scan
E11
Uses the browser ability: local_storage
saves small bits of data in your browser
decuff.ai/assets/index-BxwcazBZ.js @ 15:14029 · “localStorage.setItem(” · pattern scan
E12
Uses the browser ability: canvas
draws graphics on a canvas
decuff.ai/assets/figures/cliff/live.js @ 2784:21 · “getContext("webgl"” · pattern scan
E13
The page called /v1/service on api.decuff.ai (GET)
GET https://api.decuff.ai/v1/service · fetch · network recording
E14
The page called /v1/catalog on api.decuff.ai (GET)
GET https://api.decuff.ai/v1/catalog · fetch · network recording
E15
The page called /assets/figures/cuff.json on decuff.ai (GET)
GET https://decuff.ai/assets/figures/cuff.json · fetch · network recording
E16
The page called /assets/figures/slide.json on decuff.ai (GET)
GET https://decuff.ai/assets/figures/slide.json · fetch · network recording
E17
The page called /assets/figures/tag.json on decuff.ai (GET)
GET https://decuff.ai/assets/figures/tag.json · fetch · network recording
E18
The page called /assets/figures/cylinder.json on decuff.ai (GET)
GET https://decuff.ai/assets/figures/cylinder.json · fetch · network recording
E19
The page called /assets/figures/cliff.json on decuff.ai (GET)
GET https://decuff.ai/assets/figures/cliff.json · fetch · network recording
E20
The page called /assets/figures/weights.json on decuff.ai (GET)
GET https://decuff.ai/assets/figures/weights.json · fetch · network recording
E21
Code reader found the endpoint /assets/figures/cuff.json
how: call:fetch
decuff.ai/assets/s2-home-uo-GxbFm.js @ 74:686 · “/assets/figures/cuff.json” · the code reader
E22
Code reader found the endpoint /api/uptime
how: call:fetch
decuff.ai/assets/index-BxwcazBZ.js @ 106:33709 · “/api/uptime” · the code reader
E23
The code names the endpoint /v1/policy
decuff.ai/assets/index-BxwcazBZ.js @ 15:492 · “/v1/policy” · pattern scan
E24
The code names the endpoint /api/e
decuff.ai/assets/index-BxwcazBZ.js @ 15:11738 · “/api/e” · pattern scan
E25
The code names the endpoint /api/flags
decuff.ai/assets/index-BxwcazBZ.js @ 15:11750 · “/api/flags” · pattern scan
E26
The code names the endpoint /v1/chat/completions
decuff.ai/assets/index-BxwcazBZ.js @ 25:8368 · “/v1/chat/completions” · pattern scan
E27
The code names the endpoint /api/r
decuff.ai/assets/index-BxwcazBZ.js @ 25:13140 · “/api/r” · pattern scan
E28
The code names the endpoint /v1/keys
decuff.ai/assets/index-BxwcazBZ.js @ 106:51262 · “/v1/keys” · pattern scan
E29
The code names the endpoint /v1/account
decuff.ai/assets/index-BxwcazBZ.js @ 106:51829 · “/v1/account” · pattern scan
E30
The code names the endpoint /v1/account/sign-out
decuff.ai/assets/index-BxwcazBZ.js @ 106:53026 · “/v1/account/sign-out” · pattern scan
E31
13 links to pages on the same site
page links · https://decuff.ai/ · /, /models, /breach, /docs, /account, /playground, /status, /terms, /contact, /privacy, /aup
E32
The site says: “…Breach Docs Sign in Start a chat live · 2 models ready AI, decuffed. Uncensored open-weight models. The models n…”
page text · https://decuff.ai/ · …Breach Docs Sign in Start a chat live · 2 models ready AI, decuffed. Uncensored open-weight models. The models n…
E33
The site says: “…you agree to the terms and confirm you’re 18 or older. API for Claude Code & Codex Models & pricing No email · no…”
page text · https://decuff.ai/ · …you agree to the terms and confirm you’re 18 or older. API for Claude Code & Codex Models & pricing No email · no…
E34
The Internet Archive first saved decuff.ai on 2026-10-14 and has snapshots from 2 different days
page web archive · https://web.archive.org/web/20261014010133/decuff.ai
E35
Agent step 1: view
AI agent step 1 · view on /
E36
Agent step 2: type Ask anything, in full ← “hello”
AI agent step 2 · type on /
E37
Agent step 3: click ASK
AI agent step 3 · click on /playground · page called GET api.decuff.ai/v1/service, GET api.decuff.ai/v1/catalog, GET api.decuff.ai/v1/sandboxes/service, POST api.decuff.ai/v1/accounts, GET api.decuff.ai/v1/account, POST api.decuff.ai/v1/chat/completions
E38
Agent step 4: click STATUS
AI agent step 4 · click on /status · page called GET api.decuff.ai/v1/service, GET api.decuff.ai/v1/catalog, GET decuff.ai/api/uptime
E39
Agent step 5: go /docs
AI agent step 5 · go on /docs · page called GET api.decuff.ai/v1/service, GET api.decuff.ai/v1/catalog, GET api.decuff.ai/v1/account
E40
Agent step 6: go /playground
AI agent step 6 · go on /playground · page called GET api.decuff.ai/v1/service, GET api.decuff.ai/v1/catalog, GET api.decuff.ai/v1/account, GET api.decuff.ai/v1/sandboxes/service
E41
Agent step 7: type Message ← “test”
AI agent step 7 · type on /playground · page called POST api.decuff.ai/v1/chat/completions

Limits

  • We only see what your browser sees: code and requests on a first visit, without logging in or accepting cookie banners. What the servers do with data is invisible from outside.
  • Site code is usually minified (compressed), so names are partly lost and some code may be only partly analysed.
  • Some trackers only load after you accept cookies or log in, so the real list can be longer.
  • We visited from a server in the United States. Sites load different trackers and cookie banners in different countries (visitors in the EU usually get a consent banner first).
  • The tech check compares the site's own words with what its public page loads. Work done on servers, in private code or in separate apps isn't visible here, so 'nothing found' means not visible on the public page, not that it doesn't exist.
  • This text was written from fixed templates because no AI writer was available. It uses exactly the same evidence.
  • The code reader hit its size budget on parts of 5 large bundle file(s); those parts weren't fully analysed.

Facts, not judgements: this page describes what the code and traffic show, not anyone's intent. Not financial advice. Case id VYeThmfF.