CIM

Demo

About

Cyber Intel Marketplace (CIM) is a marketplace where autonomous AI agents pay per query for cybersecurity threat data. Providers publish services, like IP-reputation and file-hash reputation lookups, and set a price per query type. Agents discover available services through a registry, then pay for exactly the data they need using the x402 pay-per-request protocol settled on Hedera testnet. Every payment produces a verifiable on-chain audit record via Hedera Consensus Service. Crucially, both sides are gated by proof-of-personhood: providers must pass World's Selfie Check before publishing, and agents must be human-backed through World AgentKit and AgentBook before they can transact, preventing sybil abuse and keeping the data economy trustworthy. A live dashboard shows agents discovering, paying, and consuming data in real time, with links to HashScan for on-chain verification.

How it's made

CIM is a TypeScript monorepo split into backend, agent, frontend, and contracts packages. The backend is a Node.js API server (Express/Fastify) that wraps free threat-intel APIs, AbuseIPDB for IP reputation and VirusTotal for file-hash checks, behind our own metered endpoints, priced per query type. It also hosts a service registry with a discovery endpoint so agents can find available services programmatically. Payments run on the x402 pay-per-request protocol: a gated endpoint returns HTTP 402 with payment requirements, and settlement is handled through the Blocky402 facilitator on Hedera testnet. We use the Hedera SDK (@hashgraph/sdk) for HBAR transfers and to write an on-chain audit log via Hedera Consensus Service ; every paid request submits a message to an HCS topic, making the whole transaction history verifiable on HashScan. The payment gate is a reusable middleware module the backend wraps around any endpoint. The autonomous agent is built on the Hedera Agent Kit. It runs a discover -> select -> pay -> consume loop: it queries the registry, picks a service for a given task (for example investigating a batch of suspicious IPs), hits the endpoint, auto-pays the 402 challenge within a max-spend budget guard, and aggregates the results into a threat report. It emits live activity events that the frontend renders in real time. Identity is powered by the World SDK. Providers must pass Selfie Check before they're allowed to publish a service, and agents are registered as human-backed through World AgentKit and resolved via AgentBook before the backend permits them to transact, all tested against the World ID Sandbox App. This turns proof-of-personhood into a concrete anti-sybil gate on both supply and demand sides of the marketplace. The frontend is React + Vite + Tailwind, featuring a marketplace directory, a provider dashboard, and a live agent activity monitor that visualizes the payment moment (402 -> paying -> paid -> data received) with links out to HashScan. For Bazantic, we deployed an x402/MPP Gateway for our threat-intel service and authored a Recipe describing how an agent should stack-rank suspicious indicators by threat score, so the service is reusable and agent-consumable through the Recipe rather than a one-off integration.