A contract scanner that refuses to guess

Every AI contract tool I have tried answers with confidence. Ask about a clause that is not in the document, and you get a plausible paragraph with an article number that does not exist. The failure is not that the answer is wrong. The failure is that the wrong answer looks exactly like the right one.

Contract Scan is a small tool that does the opposite, and I want to describe precisely where it stops instead of what it promises. It takes a text PDF or a plain text file and returns two risk flags for free, then five flags with the exact wording to fix for $5 in USDC. That is the whole product. The interesting part is the refusals.

What happens when it cannot read

The file is the first thing that can be wrong, so the tool answers about the file before answering about the contract:

• An image-only scan returns 422 with "the file looks like a scan, no extractable text". It does not run OCR and it does not guess at clauses it cannot see.
• An empty file returns no text found. A whitespace-only file returns 422 as well.
• A file over 8 MB returns 413 with the limit, not a 500 after two minutes of silence.
• A PDF that is not a PDF returns the exception class in the message, so you know whether the problem is encryption, a broken stream or the wrong file entirely.

None of this is impressive engineering. It is just the difference between "I could not analyse this" and a confident paragraph about a contract the service never read.

The free pass is rules, not a model

The five risk types are fixed: auto-renewal, unlimited liability, penalties and forfeitures, unilateral change, and a distant forum or arbitration. The preview runs deterministic patterns over the extracted text. The same document produces the same flags on every call, in milliseconds: ten contracts take about 4 ms on the server.

Determinism matters for a boring reason. If a scanner is a model wrapped in a prompt, two runs on the same contract can disagree, and then the output is not a document you can attach to an email to the other side. It is a conversation you had with a service.

The paid report adds a model pass on top of the rules, because live contracts are written in wording no regex anticipates: "liable for all damages", "courts of Delaware", "indemnify". Every flag in the report carries source: rules or source: model, so you can see which mechanism produced it. A flag with no provenance is an opinion with a timestamp.

We published the accuracy, including the failure

This is the part that most tools skip. The rules were measured on ten contracts written as real documents, for a named reader: a tenant in Moscow, a client in New York, an employee in St Petersburg. Each contract had risks planted deliberately, and each flag was checked against the quoted wording rather than eyeballed.

The first measurement, before any of this was announced:

Both thresholds were missed, and the misses were not random. Russian contracts scored 11 of 18 (61 %) against 14 of 16 (88 %) for English ones, because the English rules were written from live contracts and the Russian ones from a dictionary of legal phrases. Nine of nine misses traced back to three holes: Russian morphology, English synonyms for a penalty, and the concept of a "home court", which is not a risk at all when you are the local party.

The same exercise found two ways the scanner could answer "clean" on a dangerous contract: a cp1251-encoded text file silently lost all Cyrillic, and a PDF longer than 40 pages was cut off at page 40. A silent clean is the worst output a scanner can produce, worse than an error.

Both are fixed, with tests, in the same day's commits. The rules now return 35 of 35 planted risks with 0 false flags on that corpus — and that sentence needs a caveat the size of the corpus: the fixes were written against these ten documents, so the second number is a regression baseline, not an accuracy promise. It says the holes are closed. It does not say the next hundred contracts will score the same, and it is pinned in the test suite precisely so that it cannot quietly drift.

If you count risks outside the declared five-type checklist — a five-year non-compete, "as is" with no warranty, termination without a cure period — the ceiling was 61 % on the original run. That is the honest limit of a five-template triage, and it should never be confused with a legal review.

What happens to the file

Files are processed in memory and discarded when the request ends. Only aggregate counters survive: how many operations ran, not the documents. There is no account, so there is no account to leak. Payment is 5 USDC on Base to the address shown on the page; you paste the transaction hash and the page says so when the hash is wrong instead of pretending it worked.

What it is not

It is a reading aid with quoted wording. It is not legal advice, it does not know which side of the contract you are on, and it does not promise an outcome. When the document cannot be read, it says so; when the rules miss, the published number says so for it.

Two free flags, five in the report, and the accuracy table above are all on the page:

https://ailegal.legal/contract-scan