Method and data corrections, newest first. When a number changes because the method changed, we say so here rather than silently revising history.
/live and /canaries no longer list consecutive event rows. They show near-real-time aggregates for the last hour and a deterministic 1-in-100 sample of observations (60-minute delay, minute timestamps, country level, no addresses, user agents or paths). Canary pages show funnels and delayed story cards. Event-level data moved to the Professional plan.
Traffic without a verified identity is now broken down by tool family (from SSH client idents, user-agent families, leak-scanner paths, post-login commands and technique tags), protocol, stage, behaviour cluster and source network (IPtoASN, public domain). Matching happens at query time on stored evidence; no source is contacted.
API keys now carry a plan (Researcher, Professional, Enterprise; no prices). Read-only keys return aggregates and a bounded CC BY 4.0 sample but no event rows; event rows need the events scope. Quotas are metered per key. CC BY 4.0 now applies only to the public sample dataset.
A read-only Model Context Protocol endpoint at /api/mcp exposes the public aggregates (overview, threats, research, bot profiles, live pulse, unknown traffic) to agents. It never returns event rows, addresses or payloads.
The home-page AI tiers are now derived from each event's own evidence record rather than a coarser roll-up, so verified / inferred / claimed splits can shift for the same underlying traffic. Denominators are unchanged.
A spoofed AI claim now counts only when an AI identity claim is contradicted by evidence. The /research row is renamed “Spoofed identity claim (any known bot)” to match what is counted.
Vendor names that have not been verified are now labelled “claimed identity” everywhere they appear; “verified identity” is reserved for identities checked against published network evidence.