ThreatPrism — Signed Threat-Intel Attestations

What this is

ThreatPrism is a purple-team attestation issuer. Every observed threat — CVE, in-the-wild exploit, phishing wallet, malicious contract, novel prompt-injection primitive — gets an off-chain EIP-712 signed attestation. Consumers (DeFi insurance, compliance protocols, bridges, DEX aggregators, security teams) query our feed and cryptographically verify every record.

Signer (your check)

loading…

Live attestations

—

Primitive benchmarks

—

Signature scheme

EIP-712

Why it matters (2026 context)

Threat intelligence in 2026 is either: (a) closed vendor reports (Mandiant-class, $50K+/yr, delayed); or (b) open feeds without cryptographic provenance. Neither is agent-usable.

We are the first threat-intel feed where every record is cryptographically signed and independently verifiable without trusting us. Protocols build us into their settlement path (insurance claim processing, bridge fraud detection, compliance pre-approval) and get immutable audit trails for free.

How to verify a signature

Any signature in our feed can be verified by anyone using viem, ethers.js, web3.py, or go-ethereum. No trust in us required — cryptographic proof only.

// viem (TypeScript)
import { verifyTypedData } from "viem";
const attestation = await fetch("http://173.249.14.219/threatprism/attestations/latest?limit=1")
    .then(r => r.json()).then(r => r.attestations[0]);
const domain = { name: "ThreatPrism", version: "1", chainId: 8453, verifyingContract: "0x00...00" };
const types = { ThreatAttestation: [ /* see /threatprism/schema */ ] };
const message = { /* attestation fields */ };
const isValid = await verifyTypedData({
    address: attestation.issuer,
    domain, types, primaryType: "ThreatAttestation",
    message, signature: "0x" + attestation.signature
});

Live feed (last 5 attestations)

When	Type	Target	Severity	Conf	Sig
loading…

Full feed: GET /threatprism/attestations/latest · Search: GET /threatprism/attestations/search?vuln_type=X&severity_min=7 · Single: GET /threatprism/attestations/{uid}

Schema registry

Two schema families:

ThreatAttestation (0x1) — observed threat, defensive disclosure. {uid, issuer, detectedAt, vulnType, target, severity, confidence, sourceUrls, evidenceHash}
PrimitiveAttestation (0x2) — attack primitive tested against own sandbox + detection measurement (purple-team). {uid, issuer, attemptedAt, primitiveId, targetSandbox, payloadHash, detectedBy, detectionLatencyMs, severity}

Full EIP-712 types: /threatprism/schema

Access tiers

Free

30 req/min

Rate-limited public feed. Latest attestations + search.

Agent Pay-Per-Query

$0.005 / query

x402 micropayment. No subscription.

Stream Subscription

$5 / month

Unlimited + webhook + priority.

Protocol Integration

$50 / month

SLA, custom schemas, dedicated endpoints.

Public API endpoints

GET  /threatprism/                          — service info + stats
GET  /threatprism/schema                    — EIP-712 types + domain
GET  /.well-known/attestation-issuer.json   — issuer pubkey discovery
GET  /threatprism/attestations/latest       — recent attestations (free, rate-limited)
GET  /threatprism/attestations/search       — filter by vuln_type, severity, target, since
GET  /threatprism/attestations/{uid}        — single attestation with full signature
GET  /threatprism/primitives/latest         — recent purple-team primitive attestations
GET  /threatprism/health                    — liveness

🛡 ThreatPrism