Developers
The ThreatWire record, for a site or an assistant
One read-only API and one remote MCP server. Both return the same stored records: published vulnerabilities, research metadata, DeFi incidents, addresses, transactions, code, and alerts.
Available
Published CVEs
Editorial records only: severity, KEV, PoC status, fixed versions, sources, and an EPSS score when the tracker snapshot has one.
Available
Tracker snapshot
A local CVE snapshot with severity, KEV, EPSS, and whether NVD listed a public PoC reference. Live link checks stay on the PoC Finder. No exploit code.
Available
Research and news
Title, summary, category, and the article URL. The full text stays on the page.
Available
DeFi incidents
Reviewed records and the public dataset, each with its own verification label. Filter by chain, protocol, class, and year.
Available
Protocols, chains, classes
The indexes behind the DeFi section, so a site can build its own navigation.
Available
Addresses and transactions
Stored contracts and reviewed transactions, with explorer links. A dataset address is not treated as confirmed.
Available
Code
Metadata, plus at most 200 lines at a time. The files are stored data. ThreatWire does not run them.
Available
Alerts
The stored alert list. Not a live chain monitor.
Planned
Webhooks and paid plans
Not available. No date.
Three ways to read it
- A website calls /api/v1 from its server and renders the JSON.
- A developer creates a free key on Keys and uses curl, JavaScript, or Python.
- An assistant uses the MCP server. The questions on that page match records that are actually stored.
curl -s "https://www.threatwire.tech/api/v1/defi/incidents?q=euler&year=2023&limit=1" \ -H "Authorization: Bearer tw_live_YOUR_KEY" curl -s "https://www.threatwire.tech/api/v1/cves/CVE-2026-64959" \ -H "Authorization: Bearer tw_live_YOUR_KEY"