It's just C-C, and solely because I noticed that it appears (a) to do its networking from the user's local network instead of a cloud server, and (b) it typically identifies itself as claude-code. It also showed up enough in my logs to be noticed; I don't go proactively searching or testing these things.

Other tools either run off of a central cloud provider, in which case they get the standard anti-AI page, or mask as a "legitimate" user agent, in which case I leave it up to the captcha/challenge.