AGPL-3.0 licensed
mostlylucid.botdetection NuGet downloads

The engine is open source.

Start it, point it at your site, and leave it to protect one self-hosted node with sensible defaults. Your request data stays in your infrastructure.

67
detectors
~150µs
per request
AGPL-3.0
licensed
Star on GitHub Browse FOSS releases See the ASP.NET controls live Install in 30 seconds

What's in the engine

67 detectors
Across protocol, behavior, content, network, and AI layers
129-dim session vectors + HNSW similarity search
Markov-chain transition probabilities, sub-millisecond ANN
Anonymous entity resolution (L0-L5)
Progressive identity across rotation attempts
Leiden clustering
Emergent bot networks by behavioral similarity
Local dashboard with config editor (read)
Same dashboard you see at /dashboard, running on this site
SQLite persistence out of the box
No external DB required for single-node deployments
Optional Ollama / LlamaSharp local LLM escalation
Ambiguous verdicts can route to a locally-hosted model
Simulation packs (WordPress honeypot etc.)
HMAC-canary-embedded fake responses for active engagement
Zero PII
HMAC-SHA256 hashed signatures, PII-stripped user agents

How it sees you

Live · Your Detection Bot
13:59:31 · 0ms

Top Bots

Name Bot % Threat Hits 1h Seen
GB internet-measurement.com 3595 {l:92,100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,75,75,75,67} 9h 59m
GB internet-measurement.com 100 {l:0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,33} 10h 59m
US Googlebot 53 {l:0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33} 3h 37m
IN Unclassified 48 {l:0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,10,16,14,43} 1h 51m
CA Chrome 124 Windows 46 {l:0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,61} 6h 54m
1–5 of 143
1 …

The binaries

Pick the install method that suits your setup. Every option comes from the same source code and includes verification details for people who want to check them.

stylobot
CLI / gateway, the headline binary
brew install scottgal/stylobot/stylobot
stylobot-gateway
YARP detection proxy in a Docker container
docker run -p 8080:8080 scottgal/stylobot-gateway
stylobot-all
Gateway + dashboard in one container, simplest deploy
docker run -p 8080:8080 scottgal/stylobot-all
stylobot-sidecar
36 MB native AOT detection sidecar (gRPC + REST)
docker run -p 5090:5090 scottgal/stylobot-sidecar
stylobot-ui
Remote dashboard viewer. SignalR live-feed against a gateway
docker run -p 5095:8080 scottgal/stylobot-ui
mostlylucid.botdetection
NuGet package. Embed as ASP.NET Core middleware
dotnet add package mostlylucid.botdetection

Running it in production

The CLI exposes daemon control directly. Under systemd or launchd it runs as a forking service. 

stylobot 5080 http://localhost:3000 -d  # fork to background
stylobot status                          # check health
stylobot stop                            # SIGTERM the daemon
Sample systemd unit 
[Service]
Type=simple
ExecStart=/usr/bin/stylobot 5080 http://localhost:3000 --mode production
Restart=on-failure

Why you can trust the binaries

  • SLSA provenance attestations on every release. Verify with gh attestation verify stylobot-linux-x64.tar.gz --owner scottgal.
  • sigstore-signed. Every binary is rekor-logged so you can audit the signing chain back to the GitHub Actions run.
  • Cloudsmith-signed apt repo. apt update verifies the repo signature on every fetch.
  • Homebrew formula strips macOS quarantine for you. The tarball download also ships with a clear-quarantine.sh helper.
  • All build logs are public on GitHub Actions. You can trace any binary back to the exact source commit.

Where the paid plans take over

FOSS is for the simple setup you can start and leave alone. Choose a paid plan when you need fine-grained controls, detailed reporting, shared access, more than one gateway, or formal compliance records.

  • Paid
    Hot-reload config editing
    FOSS dashboard reads policy; paid unlocks live writes without restart.
  • Paid
    PostgreSQL + pgvector persistence
    Shared, durable storage for multi-node deployments, longer retention, and investigation tools. FOSS includes SQLite for one node.
  • Paid
    Cross-gateway fleet management
    Push live settings, share reputation, and see the health of every gateway from one place.
  • Paid
    Compliance reports and audit logs
    Keep the evidence, retention controls, and reports needed for formal reviews.
  • Paid
    Monitoring packs
    ASP.NET hot-reload now; WordPress (Q3 2026), Magento (Q4 2026), Umbraco to follow. Every paid tier includes the OTel pack, with the Traffic Shape pack to follow. See pack pricing.

Need live control, shared data, or a fleet view?

Commercial plans add the control, reporting, and shared access that a set-and-forget setup does not need.

See pricing