CyCAT.org API

Name: CyCAT.org API
Brand: CyCAT.org API
Availability: InStock

✓ Official Vendor SpecSecurityThreat Detectionnone14 EndpointsREST

For Agents

Look up cybersecurity tools, publishers, and projects in the CyCAT catalogue and walk relationships between entities for threat intel and tooling research.

Install Jentic One Beta

Connect the CyCAT.org API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the CyCAT.org API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with CyCAT.org API.

Resolve a CyCAT UUID to its canonical record with GET /lookup/{uuid}

Walk parent and child relationships between cybersecurity entities for provenance mapping

Search the CyCAT catalogue by free-text query for projects, publishers, and tools

GET STARTED

Start building with CyCAT.org API

Explore with Jentic

View OpenAPI Document

Use Cases

Patterns agents use CyCAT.org API for, with concrete tasks.

★ Threat Intel Tool Provenance

When a threat intel analyst encounters a new defensive tool referenced in a report, they resolve the tool's CyCAT UUID and walk its relationships to identify the publisher, parent project, and any child forks. CyCAT's GET /lookup/{uuid} and /parent/{uuid} endpoints return that lineage in two calls, so the analyst can attribute the tool without manually crawling vendor websites.

Call GET /lookup/{uuid} for the supplied CyCAT UUID, then call GET /parent/{uuid} and summarise publisher and parent project.

Catalogue Mirror for Internal Wiki

Security engineering teams that maintain an internal tooling wiki paginate through CyCAT's project and publisher lists to populate a local mirror. /list/project/{start}/{end} and /list/publisher/{start}/{end} return ordered slices, so a scheduled agent can incrementally sync new entries without re-fetching the full catalogue.

Loop GET /list/project/0/100, /list/project/100/200 ... and write each project's UUID and metadata to a local index until the response is empty.

Cross-Reference With External Frameworks

A SOC tooling team that already references MITRE ATT&CK or vendor namespace IDs uses /namespace/getid/{namespace} and /namespace/finduuid to translate those external identifiers into CyCAT UUIDs. This lets them join CyCAT's relationship graph onto their existing detection engineering inventory without manual mapping.

Given namespace 'mitre-attack' and namespace ID 'T1566', call GET /namespace/finduuid/mitre-attack/T1566 and return the CyCAT UUID.

Agent-Assisted Catalogue Contribution

An AI agent reviewing a newly released open-source security tool drafts a CyCAT proposal by calling GET /generate/uuid for a candidate identifier and POST /propose with the tool metadata. A human curator reviews the proposal before it is merged, with the agent removing the friction of writing the JSON payload by hand.

Call GET /generate/uuid, then POST /propose with the new UUID, tool name, publisher, and source URL extracted from a GitHub README.

Key Endpoints

14 endpoints — cycat.

METHOD

PATH

DESCRIPTION

GET

/lookup/{uuid}

Resolve a CyCAT UUID to its record

GET

/search/{searchquery}

Free-text catalogue search

GET

/parent/{uuid}

Get the parent of a CyCAT entity

GET

/child/{uuid}

Get the children of a CyCAT entity

GET

/relationships/expanded/{uuid}

Expanded relationship graph

GET

/namespace/finduuid/{namespace}/{namespaceid}

Resolve namespace to UUID

POST

/propose

Propose a new catalogue entry

GET

/lookup/{uuid}

Resolve a CyCAT UUID to its record

GET

/search/{searchquery}

Free-text catalogue search

GET

/parent/{uuid}

Get the parent of a CyCAT entity

GET

/child/{uuid}

Get the children of a CyCAT entity

GET

/relationships/expanded/{uuid}

Expanded relationship graph

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

CyCAT.org is unauthenticated, so no credentials are stored. Jentic simply routes the request and returns the parsed response, keeping the agent's call shape consistent with authenticated APIs.

Intent-based discovery

Agents search Jentic for 'look up a cybersecurity tool' or 'walk security catalogue relationships' and Jentic returns the matching CyCAT operations with input schemas, so the agent can call GET /lookup/{uuid} or /search/{query} directly.

Time to first call

Direct CyCAT integration: 1-2 hours to read the docs and parse the relationship graph. Through Jentic: under 15 minutes — search, load schema, execute.

FAQs

Specific to using CyCAT.org API through Jentic.

What authentication does the CyCAT.org API use?

The CyCAT.org API is unauthenticated for read operations. The OpenAPI spec declares no security schemes, so GET endpoints can be called directly against api.cycat.org. Through Jentic the agent simply executes the operation; no credentials are stored or injected.

Can I look up a cybersecurity tool by its CyCAT UUID?

Yes. GET /lookup/{uuid} returns the canonical record for a CyCAT UUID, and GET /parent/{uuid} and /child/{uuid} let you walk the entity graph to identify the parent project and any forks or sub-projects.

What are the rate limits for the CyCAT.org API?

The OpenAPI spec does not document explicit rate limits. CyCAT is operated as a community service, so treat sustained traffic above a few requests per second as inappropriate and stagger bulk catalogue mirrors across longer time windows.

How do I search the CyCAT catalogue through Jentic?

Install pip install jentic and run an agent with the search query 'search the CyCAT cybersecurity catalogue'. Jentic returns the GET /search/{searchquery} operation with its input schema so the agent can call it with a free-text query like 'crowdstrike' and parse the matching catalogue entries.

Can I add a new tool to CyCAT through the API?

Yes. POST /propose accepts a candidate entry that is reviewed by a human curator before being merged into the catalogue. Use GET /generate/uuid first to get a fresh UUID for the proposal, then submit the metadata.

Is the CyCAT.org API free?

Yes. CyCAT.org is an open community catalogue and the public API is free to use. There is no paid tier or API key required for read access.