TeleSint

{
  "name": "TeleSint",
  "description": "Real-time Telegram threat intelligence API. Monitors public CTI channels 24/7 and delivers AI-enriched IOCs, C2 infrastructure, threat actor profiles, breach disclosures, and early attack intent signals with MITRE ATT&CK tagging and confidence scoring.",
  "url": "https://telesint-api.onrender.com",
  "version": "1.0.0",
  "documentationUrl": "https://telesint-api.onrender.com/SKILL.md",
  "payment": {
    "protocol": "x402",
    "network": "eip155:8453",
    "asset": "USDC"
  },
  "a2aEndpoint": "https://telesint-api.onrender.com/a2a",
  "mcpEndpoint": "https://telesint-api.onrender.com/mcp",
  "mcpServerCard": "https://telesint-api.onrender.com/mcp/server-card",
  "skills": [
    {
      "id": "ioc-lookup",
      "name": "IOC Lookup",
      "description": "Query Indicators of Compromise by type (ip, domain, url, hash, cve), severity, confidence, TLP, and time range. Returns defanged indicators with MITRE ATT&CK context. Input: query params. Output: paginated JSON array.",
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price": "$0.01 USDC",
      "price_usd": 0.01,
      "path": "/ioc"
    },
    {
      "id": "c2-infrastructure",
      "name": "C2 Infrastructure",
      "description": "Query Command-and-Control infrastructure by framework (cobalt_strike, sliver, havoc, brute_ratel). Returns panels, listeners, beacons with MITRE C2 technique tags. Input: query params. Output: paginated JSON array.",
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price": "$0.02 USDC",
      "price_usd": 0.02,
      "path": "/c2"
    },
    {
      "id": "threat-actor-profiles",
      "name": "Threat Actor Profiles",
      "description": "Query threat actor profiles by name, nation-state attribution, motivation, and MITRE technique. Returns actor aliases, TTPs, targets, and country of origin. Input: query params. Output: paginated JSON array.",
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price": "$0.02 USDC",
      "price_usd": 0.02,
      "path": "/actor"
    },
    {
      "id": "breach-disclosures",
      "name": "Breach Disclosures",
      "description": "Query breach announcements and data leak disclosures from Telegram by sector, country, or organization. Returns breach target details, data types exposed, and source channel. Input: query params. Output: paginated JSON array.",
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price": "$0.03 USDC",
      "price_usd": 0.03,
      "path": "/breach"
    },
    {
      "id": "attack-intent-signals",
      "name": "Attack Intent Signals",
      "description": "Query pre-attack signals: initial access sales, 0day disclosures, ransomware group targeting announcements. These signals appear BEFORE attacks land. Filter by sector, country, or intent type. Input: query params. Output: paginated JSON array.",
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price": "$0.05 USDC",
      "price_usd": 0.05,
      "path": "/intent"
    },
    {
      "id": "threat-intel-feed",
      "name": "Full Threat Intel Feed",
      "description": "Unified paginated feed across all intelligence categories. Filter by category, severity, confidence, TLP, tag, or time range. Ideal for SIEM ingestion and agents that process all intel types. Input: query params. Output: paginated JSON array.",
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price": "$0.05 USDC",
      "price_usd": 0.05,
      "path": "/feed"
    },
    {
      "id": "vulnerability-intel",
      "name": "Vulnerability Intelligence",
      "description": "CVEs and exploitation-in-the-wild signals from Telegram CTI channels. Filter by severity, min_confidence, since, tag, ttp. Returns CVE IDs, affected products, MITRE techniques, and exploit availability. Input: query params. Output: paginated JSON array.",
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price": "$0.03 USDC",
      "price_usd": 0.03,
      "path": "/vulnerability"
    },
    {
      "id": "cross-category-search",
      "name": "Cross-Category Search",
      "description": "Keyword pivot across all intel categories in one call. Use ?q= for broad keyword search or combine any filter params (category, sector, country, tag, ttp, severity). Ideal for ad-hoc threat pivoting. Input: query params. Output: paginated JSON array.",
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price": "$0.04 USDC",
      "price_usd": 0.04,
      "path": "/search"
    },
    {
      "id": "ransomware-intel",
      "name": "Ransomware Intelligence",
      "description": "Ransomware group victim posts, leak site announcements, extortion demands, and group activity (LockBit, BlackCat, Cl0p, RansomHub, Play, Akira, etc.). Filter by severity, sector, country, tag. Input: query params. Output: paginated JSON array.",
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price": "$0.04 USDC",
      "price_usd": 0.04,
      "path": "/ransomware"
    },
    {
      "id": "malware-intel",
      "name": "Malware Intelligence",
      "description": "Malware family analysis: new sample drops, behavior descriptions, packer/loader details, malware-as-a-service offerings. Covers stealers, RATs, loaders, backdoors. Filter by tag, severity, since. Input: query params. Output: paginated JSON array.",
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price": "$0.02 USDC",
      "price_usd": 0.02,
      "path": "/malware"
    },
    {
      "id": "darkweb-intel",
      "name": "Dark Web Intelligence",
      "description": "Dark web marketplace listings, underground forum chatter, access broker posts, credential shops, Tor site activity. Filter by sector, country, organization, tag. Input: query params. Output: paginated JSON array.",
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price": "$0.03 USDC",
      "price_usd": 0.03,
      "path": "/darkweb"
    },
    {
      "id": "cti-artifact-export",
      "name": "CTI Artifact Export",
      "description": "Export any TeleSint intel record as a Sigma detection rule (YAML), STIX 2.1 bundle (JSON), or structured analyst report (text). Requires items[].id from any prior TeleSint call and a format choice. Output is derived from real enriched data \u2014 iocs[], ttps[], actor{}, target{}.",
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json",
        "text/plain"
      ],
      "price": "$0.05 USDC",
      "price_usd": 0.05,
      "path": "/artifact"
    },
    {
      "id": "asn-intel",
      "name": "ASN Threat Intelligence",
      "description": "Profiles an ASN using Telegram CTI channel observations. Returns C2 framework associations, phishing kit links, threat actor mentions, bulletproof hosting indicators, and blocking recommendation. Surfaces what cybercriminals discuss about a given ASN on Telegram.",
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price": "$0.03 USDC",
      "price_usd": 0.03,
      "path": "/asn"
    },
    {
      "id": "source-verification",
      "name": "Raw Source Verification",
      "description": "Returns the original defanged Telegram message for a given record UUID alongside its AI-generated English summary. Use for provenance checks, translation validation, and Tier-2/3 SOC forensics. Requires items[].id from any prior TeleSint call.",
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price": "$0.02 USDC",
      "price_usd": 0.02,
      "path": "/source"
    },
    {
      "id": "adversary-preparation",
      "name": "Adversary Preparation Assessment",
      "description": "Call before an escalation decision: is someone preparing to attack this organisation, sector or country? Returns a deterministic verdict (escalate | watch | none), five-stage ladder with gaps, Dempster-Shafer belief/plausibility/conflict, EWMA velocity and evidence record IDs.",
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price": "$0.10 USDC",
      "price_usd": 0.1,
      "path": "/preparation"
    },
    {
      "id": "threat-velocity",
      "name": "Threat Activity Velocity",
      "description": "Call on a schedule to detect tempo changes: acceleration of Telegram threat activity per preparation stage and category, globally or for a scope.",
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price": "$0.03 USDC",
      "price_usd": 0.03,
      "path": "/velocity"
    },
    {
      "id": "target-mentions",
      "name": "Organisation Mentions",
      "description": "Call when you need to know whether an organisation is being named on Telegram: access sales, credential leaks, targeting announcements and compromise claims, deduplicated with first/last seen.",
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price": "$0.05 USDC",
      "price_usd": 0.05,
      "path": "/target-mentions"
    },
    {
      "id": "claim-check",
      "name": "Claim Recycling Check",
      "description": "Call before acting on a breach, ransomware or hacktivist claim: tests it for recycling against earlier Telegram posts and returns recycled | reused_template | previously_claimed | repost | no_prior_match.",
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price": "$0.05 USDC",
      "price_usd": 0.05,
      "path": "/claim-check"
    },
    {
      "id": "watchlist",
      "name": "Wallet-Bound Watchlists",
      "description": "Register requirements once with /watch/create ($0.02); each /watch/pull ($0.10) returns only what changed since the last pull plus preparation verdict transitions. The paying wallet is the account \u2014 REST only, not available via /a2a.",
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price": "$0.10 USDC",
      "price_usd": 0.1,
      "path": "/watch/pull"
    }
  ],
  "responseSigning": {
    "address": "0x63C55000637Bdc9b60Fda76E7ab2aB09F7547219",
    "scheme": "telesint-sig/1 (RFC8785-JCS + SHA-256 + EIP-191)",
    "keyInfo": "https://telesint-api.onrender.com/.well-known/telesint-signer.json"
  }
}