How this reads a token

You paste an access token. The page asks the service that issued it what the token can do, and turns the answer into one verdict, a list of findings ordered by severity, and the accounts and repositories it reaches.

It is built for the moment you are holding a credential and need to know how bad it is - a key found in a repository, a token in a CI log, your own secret during an audit. The question it answers is not “is this valid” but “what would someone do with it”.