Install Jentic One Beta

Connect the CyCAT.org API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the CyCAT.org API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fcycat.org%2Fcycat" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fcycat.org%2Fcycat" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with CyCAT.org API.

Resolve a CyCAT UUID to its canonical record with GET /lookup/{uuid}

Walk parent and child relationships between cybersecurity entities for provenance mapping

Search the CyCAT catalogue by free-text query for projects, publishers, and tools

List projects or publishers in paginated ranges for bulk indexing

Resolve a namespace identifier to its CyCAT UUID for cross-reference with external sources

GET STARTED

Start building with CyCAT.org API

Explore with Jentic One

View OpenAPI Document

Use Cases

Patterns agents use CyCAT.org API for, with concrete tasks.

★ Threat Intel Tool Provenance

When a threat intel analyst encounters a new defensive tool referenced in a report, they resolve the tool's CyCAT UUID and walk its relationships to identify the publisher, parent project, and any child forks. CyCAT's GET /lookup/{uuid} and /parent/{uuid} endpoints return that lineage in two calls, so the analyst can attribute the tool without manually crawling vendor websites.

Call GET /lookup/{uuid} for the supplied CyCAT UUID, then call GET /parent/{uuid} and summarise publisher and parent project.

Catalogue Mirror for Internal Wiki

Security engineering teams that maintain an internal tooling wiki paginate through CyCAT's project and publisher lists to populate a local mirror. /list/project/{start}/{end} and /list/publisher/{start}/{end} return ordered slices, so a scheduled agent can incrementally sync new entries without re-fetching the full catalogue.

Loop GET /list/project/0/100, /list/project/100/200 ... and write each project's UUID and metadata to a local index until the response is empty.

Cross-Reference With External Frameworks

A SOC tooling team that already references MITRE ATT&CK or vendor namespace IDs uses /namespace/getid/{namespace} and /namespace/finduuid to translate those external identifiers into CyCAT UUIDs. This lets them join CyCAT's relationship graph onto their existing detection engineering inventory without manual mapping.

Given namespace 'mitre-attack' and namespace ID 'T1566', call GET /namespace/finduuid/mitre-attack/T1566 and return the CyCAT UUID.

Agent-Assisted Catalogue Contribution

An AI agent reviewing a newly released open-source security tool drafts a CyCAT proposal by calling GET /generate/uuid for a candidate identifier and POST /propose with the tool metadata. A human curator reviews the proposal before it is merged, with the agent removing the friction of writing the JSON payload by hand.

Call GET /generate/uuid, then POST /propose with the new UUID, tool name, publisher, and source URL extracted from a GitHub README.

Key Endpoints

14 endpoints — cycat.

METHOD

PATH

DESCRIPTION

GET

/lookup/{uuid}

Resolve a CyCAT UUID to its record

GET

/search/{searchquery}

Free-text catalogue search

GET

/parent/{uuid}

Get the parent of a CyCAT entity

GET

/child/{uuid}

Get the children of a CyCAT entity

GET

/relationships/expanded/{uuid}

Expanded relationship graph

GET

/namespace/finduuid/{namespace}/{namespaceid}

Resolve namespace to UUID

POST

/propose

Propose a new catalogue entry

GET

/lookup/{uuid}

Resolve a CyCAT UUID to its record

GET

/search/{searchquery}

Free-text catalogue search

GET

/parent/{uuid}

Get the parent of a CyCAT entity

GET

/child/{uuid}

Get the children of a CyCAT entity

GET

/relationships/expanded/{uuid}

Expanded relationship graph

GET

/namespace/finduuid/{namespace}/{namespaceid}

Resolve namespace to UUID

POST

/propose

Propose a new catalogue entry

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Wiring the CyCAT.org API by hand means targeting its host, mapping its lookup, search, and relationship routes, and parsing the catalogue responses yourself. Through Jentic you install once, import the CyCAT.org API from the API Directory, and your agent calls it even though the API itself needs no credential.

Permission scoping

CyCAT.org puts the item uuid in the URL path (/lookup/{uuid}, /parent/{uuid}), so a rule can pin your agent to reading a specific catalogue item and its relationships. You choose the operations it may call, so proposing new entries is not included unless you add it.

Credential isolation

CyCAT.org needs no credential, so none is stored, and Jentic still routes the call through your own Jentic One instance at execution time. Nothing sensitive enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'look up a cybersecurity tool' or 'walk catalogue relationships', and Jentic returns the matching CyCAT.org operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

FAQs

Specific to using CyCAT.org API through Jentic.

What authentication does the CyCAT.org API use?

The CyCAT.org API is unauthenticated for read operations. The OpenAPI spec declares no security schemes, so GET endpoints can be called directly against api.cycat.org. Through Jentic the agent simply executes the operation; no credentials are stored or injected.

Can I look up a cybersecurity tool by its CyCAT UUID?

Yes. GET /lookup/{uuid} returns the canonical record for a CyCAT UUID, and GET /parent/{uuid} and /child/{uuid} let you walk the entity graph to identify the parent project and any forks or sub-projects.

What are the rate limits for the CyCAT.org API?

The OpenAPI spec does not document explicit rate limits. CyCAT is operated as a community service, so treat sustained traffic above a few requests per second as inappropriate and stagger bulk catalogue mirrors across longer time windows.

How do I search the CyCAT catalogue through Jentic?

Install pip install jentic and run an agent with the search query 'search the CyCAT cybersecurity catalogue'. Jentic returns the GET /search/{searchquery} operation with its input schema so the agent can call it with a free-text query like 'crowdstrike' and parse the matching catalogue entries.

Can I add a new tool to CyCAT through the API?

Yes. POST /propose accepts a candidate entry that is reviewed by a human curator before being merged into the catalogue. Use GET /generate/uuid first to get a fresh UUID for the proposal, then submit the metadata.

Is the CyCAT.org API free?

Yes. CyCAT.org is an open community catalogue and the public API is free to use. There is no paid tier or API key required for read access.

Can I limit what my agent is allowed to do with the CyCAT.org API?

Yes. Because you run Jentic One yourself, your own rules decide which CyCAT.org operations and which entities your agent may touch. CyCAT.org carries the item UUID in the URL path, as in GET /lookup/{uuid} and GET /parent/{uuid}, so you can pin the agent to reading a specific catalogue item and walking its relationships. Since you pick the allowed operations, write actions like POST /propose stay excluded unless you add them.

CyCAT.org API

Name: CyCAT.org API
Brand: CyCAT.org API
Availability: InStock

Official vendor OpenAPI document · agent-readySecurityThreat Detectionnone14 EndpointsREST

For Agents

Look up cybersecurity tools, publishers, and projects in the CyCAT catalogue and walk relationships between entities for threat intel and tooling research.

Use for: I need to look up a cybersecurity tool by its CyCAT UUID, Search CyCAT for all projects matching a vendor name, Find the parent record of a given CyCAT entity, Retrieve every child entity attached to a project UUID

Not supported: Does not handle vulnerability scanning, malware analysis, or live threat feeds - use for cybersecurity tool, publisher, and project catalogue lookups only.

CyCAT.org is the open Cybersecurity Resource Catalogue, a public index that links projects, tools, publishers, and the relationships between them. The API exposes 14 read-only endpoints for resolving CyCAT UUIDs, walking parent and child relationships, searching the catalogue, and proposing new entries. It is built for SOC analysts, threat intelligence engineers, and AI agents that need to map third-party tooling and publisher provenance.

Jentic One on Github View OpenAPI Document