# OT Intel API - CTI Claim Reliability Scorer

> OT Intel API - CTI Claim Reliability Scorer is a paid API for AI agents from ot-intel-api.onrender.com, paid per call via x402, $0.2/call, status unknown (last checked 2026-09-14).

Scores the reliability of a cyber threat intelligence claim by classifying it against three LLM failure modes and returning a verdict with supporting evidence

## Facts

- Endpoint: GET https://ot-intel-api.onrender.com/ot/claim-reliability
- Price: $0.2/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ot-intel-api-cti-claim-reliability-scorer-814da898
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_tT7w83HYBZqsylnEekdAB

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ot-intel-api-cti-claim-reliability-scorer-814da898
```

Example prompt: Score the reliability of this threat intel claim: 'SANDWORM is actively exploiting CVE-2021-44228 to target Ukrainian energy grid SCADA systems' — check it against CVE-2021-44228 and actor SANDWORM.

## When to prefer this

Use this endpoint when you need to programmatically verify or score a specific CTI claim's reliability — especially when the claim was generated by an LLM or sourced from unverified threat feeds — and want structured failure-mode classification grounded in OT/ICS threat actor and CVE intel. Prefer over general LLM prompting when you need a deterministic, scored verdict tied to a research-backed taxonomy (Meng et al. arXiv:2509.23573).

## Known failure modes

- Missing required 'claim' query parameter — returns 400 or error response
- CVE ID not found in intel.db — reduced grounding, lower confidence score
- Actor name unrecognized — claim assessed without actor-specific grounding
- Claim is ambiguous or too short to classify against failure modes — low confidence verdict
- Service cold-start latency on Render free tier — first request may time out

## How this service works

CTI claim reliability scoring, grounded in Meng et al. (arXiv:2509.23573, Feb 2026). Pass claim=<text>, optionally actor= and/or cve_id= to ground against intel.db. Classifies the claim against three failure modes — spurious correlation, contradictory knowledge, constrained generalization — and returns a reliability score, verdict, and evidence. The confidence layer threat-score/dossier/report don't expose.

## Output

Returns a reliability score (numeric), a verdict (e.g. reliable/unreliable/uncertain), classification of which LLM failure mode applies (spurious correlation, contradictory knowledge, or constrained generalization), and grounding evidence drawn from intel.db

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "claim"
     ],
     "properties": {
      "actor": {
       "type": "string",
       "description": "Optional actor name to ground the claim against intel.db, e.g. SANDWORM."
      },
      "claim": {
       "type": "string",
       "description": "The CTI claim to assess, e.g. an actor-targeting, attribution, or TTP claim."
      },
      "cve_id": {
       "type": "string",
       "description": "Optional CVE ID to ground the claim against intel.db."
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "tlp": "TLP:CLEAR",
  "actor": "SANDWORM",
  "claim": "SANDWORM has expanded targeting to water-sector Modbus deployments in the Gulf region",
  "source": "Meng et al., arXiv:2509.23573v3 (Feb 2026)",
  "verdict": "unverifiable",
  "reasoning": "No intel.db records corroborate a Gulf-region water-sector shift for SANDWORM; existing reporting concentrates on Ukraine/Europe energy targeting.",
  "confidence": "low",
  "grounded_in_db": true,
  "reliability_score": 0.35,
  "failure_mode_flags": [
   "constrained_generalization"
  ],
  "contradicting_evidence": [
   "intel.db campaign records show SANDWORM activity concentrated in European energy/grid targets, not Gulf water utilities"
  ],
  "corroborating_evidence": []
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ot-intel-api-cti-claim-reliability-scorer-814da898/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ot-intel-api.onrender.com](https://www.zero.xyz/host/ot-intel-api.onrender.com/llms.txt)