Technical Reference
Developer Documentation
Integrate VibeGuard AI into your Sui wallet or dApp
REST API
Direct API Access
Base URL
https://vibeguardai.vercel.appSecurity
Authentication
The API is currently fully open — no API key required. All endpoints are accessible without authentication.
For enterprise access, rate limit increases, or partnership inquiries, open a GitHub Issue.
Analysis Endpoint
POST /api/explain
Full transaction analysis with AI explanation and scam detection.
Request Body
{
"transactionBytes": "AAACAA...", // Base64 bytes BEFORE signing
"network": "testnet",
"userAddress": "0x...",
"userIntent": "Claim airdrop" // Optional but recommended
}Use base64 transaction bytes from your wallet BEFORE signing. Transaction hashes from explorers won't work.
Response
{
"simulation": {
"effectsSummary": {...},
"staticAnalysis": {
"moveCalls": [...],
"gasBudget": "10000000",
"containsDirectTransfer": true
}
},
"risk": {
"riskLevel": "RED",
"reasons": [
"Assets leave your wallet to another address",
"INTENT MISMATCH: You expect to receive assets, but this sends assets away"
],
"confidence": 0.9
},
"explanation": {
"headline": "Honeypot Scam Detected",
"plainEnglish": "This transaction will send 100 SUI from your wallet...",
"recommendedAction": "Do Not Sign"
}
}B2B Intelligence
B2B Threat Intelligence API
Query the indexed threat registry. Powered by real-time event indexing from the on-chain ReputationRegistry.
GET /api/threats
Query indexed threats with optional filters.
# All threats GET /api/threats # Filter by category GET /api/threats?category=Honeypot GET /api/threats?category=Intent+Mismatch # Filter by severity GET /api/threats?severity=Critical GET /api/threats?severity=High # Pagination GET /api/threats?limit=10&offset=0 # Lookup specific package GET /api/threats?packageId=0x... # Aggregated stats GET /api/threats?stats=true # Force re-index from chain GET /api/threats?refresh=true
GET /api/threats?stats=true
Returns aggregated threat statistics.
{
"success": true,
"stats": {
"total": 5,
"byCategory": {
"Intent Mismatch": 1,
"Unknown": 4
},
"bySeverity": {
"High": 1,
"Unknown": 4
}
}
}GET /api/events
Server-Sent Events stream. Subscribe to real-time ThreatReported events as they are emitted on-chain.
// Browser / Node.js
const stream = new EventSource('https://vibeguardai.vercel.app/api/events');
stream.onmessage = (event) => {
const threat = JSON.parse(event.data);
console.log('New threat:', threat.malicious_package_id);
blacklist.add(threat.malicious_package_id);
};POST /api/webhooks
Register a webhook URL to receive push notifications when new threats are detected.
curl -X POST https://vibeguardai.vercel.app/api/webhooks \
-H "Content-Type: application/json" \
-d '{
"url": "https://your-app.com/webhook",
"events": ["ThreatReported", "ThreatVerified"],
"apiKey": "your_key"
}'
// Payload delivered to your URL:
{
"event": "ThreatReported",
"data": {
"malicious_package_id": "0x...",
"walrus_blob_id": "..."
},
"timestamp": 1775909610023
}POST /api/indexer
Force re-index all ThreatReported events from the blockchain.
curl -X POST https://vibeguardai.vercel.app/api/indexer
// Response:
{
"success": true,
"indexed": 5,
"stats": {
"total": 5,
"byCategory": { "Intent Mismatch": 1, "Unknown": 4 }
}
}Threat Retrieval
GET /api/threat/[blobId]
Retrieve a full threat report from Walrus decentralized storage. Accepts an optional blobObjectId query parameter to verify the Blob NFT is still live on Sui before fetching.
# Without liveness check GET /api/threat/:blobId # With Blob NFT liveness gate (returns 410 if expired) GET /api/threat/:blobId?blobObjectId=0x...
Response
{
"metadata": {
"title": "VibeGuard AI Threat Report",
"publisher": "0x...",
"category": "Security Signal",
"timestamp": "2026-03-23T08:43:36.775Z"
},
"packageId": "0x...",
"riskLevel": "RED",
"headline": "Automated Detection: Honeypot/Malicious Contract",
"reasons": [...],
"reportedAt": "2026-03-23T08:43:36.775Z",
"reportedBy": "vibeguard-automated-pipeline"
}Code Examples
Example: cURL
curl -X POST https://vibeguardai.vercel.app/api/explain \
-H "Content-Type: application/json" \
-d '{
"transactionBytes": "AAACAA...base64...",
"network": "testnet",
"userAddress": "0x1234...5678",
"userIntent": "Claim free airdrop"
}'Replace with your actual base64 transaction bytes and wallet address.
Code Examples
Example: JavaScript
const response = await fetch('https://vibeguardai.vercel.app/api/explain', {
method: 'POST',
headers: {
'Content-Type': 'application/json'
},
body: JSON.stringify({
transactionBytes: 'AAACAA...base64...',
network: 'testnet',
userAddress: '0x1234...5678',
userIntent: 'Claim free airdrop'
})
});
const data = await response.json();
console.log(data.risk.riskLevel);
console.log(data.explanation.recommendedAction);Infrastructure
Production Enclave
Threat analysis runs inside an AWS Nitro Enclave TEE. The enclave signs every threat payload with a registered Ed25519 keypair verified on-chain before registry commitment.
Threat Engine
Adversarial Threat Detection
The enclave threat engine detects sophisticated attack patterns with 100% accuracy across all test cases.
INTENT_MISMATCH_HONEYPOTUser expects inflow but simulation shows outflow — classic airdrop scam
MULTI_RECIPIENT_DRAINAssets routed to 3+ unique recipients — multi-hop drain attack
DRAIN_FUNCTIONDangerous Move functions: transfer_all, drain, sweep, approve_all, emergency_withdraw
UNEXPECTED_OUTFLOWUnexpected asset outflow when user expects to receive
HIGH_GAS_BUDGETGas budget exceeds 500M MIST — indicator of complex exploit