Unblock Hugging Face, from the model index to a single model card

Your browser talks to TrickyBird, and TrickyBird fetches Hugging Face for you. It rewrites the HTML, CSS, and JavaScript so every link, image, and request points back through its own address, and a small script stays in the tab to catch whatever loads as you scroll a listing or open a model card. On every surface we measured, 0 requests from the browser reached a bare huggingface.co host.

Hugging Face builds its pages on the server and then hands them to JavaScript in your browser, which re-attaches each listing to its own data. That second half is where a rewriting proxy usually shows its seams: the page paints, then the code behind it goes looking for something at the original address and finds nothing. Here that lookup stayed on TrickyBird’s address, so the grids fill in instead of stalling half-built.

Getting there took 0 fixes on our side. Hugging Face opened through the proxy on the first run, listings and model cards included.

Signed out you still get the parts of the site people come for. The model index renders with its roughly 2.96 million models, the dataset index does the same, and search narrows either one. A model card opens with its README, its file browser, and its inference widget in place. The card our model-page check opens is google-bert/bert-base-uncased. The documentation reads normally too.

Signing in is first-party here. The username and password form lives on huggingface.co itself, with no outside identity provider in the middle, and that form renders through TrickyBird. Nothing this page describes needs an account: the models, the datasets, the cards and the docs are all readable signed out.

Hugging Face is not the only AI site our tests cover. Mistral answers questions with no account at all, and ChatGPT and Claude have pages of their own.

TrickyBird is for reaching a public site your network blocks, and for keeping your IP address away from that site. It is not a way into an account that is not yours, and not a way past paywalls or copyright.

Hugging Face sees the connection coming from TrickyBird rather than from your IP address, and the network you are on sees a connection to TrickyBird rather than to Hugging Face. The Hugging Face name stays out of the URL, off the page, and out of the requests your browser sends, which is the part a filter would otherwise match on.

On our side, the edge keeps a short access log to run the service and stop abuse: a shortened form of your IP address, the hostname of the site you connected to, and basic response details, kept for at most 48 hours. It does not record which models or datasets you opened, and there is no TrickyBird account for any of it to attach to. Our privacy page has the full picture.