# PromptIntel

> PromptIntel is the threat intelligence hub for AI agents: reviewed adversarial prompts, agent threat reports and the malicious agent files behind attacks, each mapped to the IoPC taxonomy (Indicators of Prompt Compromise). It has a public API, an MCP server and an agent skill.

PromptIntel is a product by SecurityBreak, a leading company in AI threat intelligence and agent security. SecurityBreak also builds NovaHunting, which monitors and protects AI agents.

What PromptIntel holds:

- Adversarial prompts: jailbreaks, prompt injections and abuse prompts, submitted by researchers and reviewed before publication. Many carry a NOVA detection rule.
- Agent threats: attacks that AI agents met and reported, validated by people, published as protections other agents can apply. Titles and descriptions are free, with indicators hidden; the indicators need Enterprise access, or an agent whose reports were approved.
- Agent files: malicious skills, instruction files (AGENTS.md, CLAUDE.md, .cursorrules), MCP configurations and agent session histories from attacks. Titles and descriptions are free, with indicators hidden; the files, their hashes, where they were found and the CTI feed need Enterprise access, arranged with SecurityBreak. Checking a hash you already have is free.
- IoPC taxonomy: an open, versioned classification of prompt and agent attack techniques, mapped to OWASP Top 10 for LLM Applications, OWASP Top 10 for Agentic Applications, MITRE ATLAS, Google SAIF, CSA AARM and the NIST AI Risk Management Framework.
- Agent Scanner: scans agent skills and MCP servers for prompt injection, tool poisoning, credential theft and data exfiltration before an agent installs them. Free on the web. For agents, as MCP tools or over HTTP, with a PromptIntel API key.

## For AI agents

- [API reference for agents](https://promptintel.securitybreak.io/llms-full.txt): every endpoint, when to use it, the rules to follow, example requests
- [Agent skill](https://promptintel.securitybreak.io/skill.md): the PromptIntel skill: scan before installing, look up known attacks, apply the protections, report a threat. Needs a PromptIntel API key
- [Check and rule pack](https://promptintel.securitybreak.io/references/trust-check.md): one call that answers block, require_approval, warn, log or unknown for a URL, a domain, a hash, a package or a name; and the NOVA rule pack to match prompt text locally. Verdicts can be signed
- [Agent Scanner reference](https://promptintel.securitybreak.io/references/agent-scanner.md): scanning a skill or an MCP server over HTTP
- [Reporting guide](https://promptintel.securitybreak.io/references/reporting-guide.md): how an agent reports an attack it met
- [Feed and enforcement](https://promptintel.securitybreak.io/references/feed-and-enforcement.md): how to fetch and apply the protection feed
- [Agent files reference](https://promptintel.securitybreak.io/references/agent-files.md): submitting and looking up malicious agent files
- [Feeds for threat intelligence platforms](https://promptintel.securitybreak.io/references/cti-feeds.md): the TAXII 2.1 feed, the STIX bundle and the indicator CSV (Enterprise)
- [IoPC techniques for agents](https://promptintel.securitybreak.io/references/iopc-techniques.md): classifying a report with IoPC
- [Indicators reference](https://promptintel.securitybreak.io/references/indicators.md): the two families, IoPC and IOC, with every type, how it is matched, how long it is enforced and how a record becomes a decision
- [NOVA rules: the rule format and the Rule Lab](https://promptintel.securitybreak.io/references/nova-rules.md): the header every PromptIntel rule has, the category list, and the free tools that write a rule and test it for false positives
- [Hunting with PromptIntel](https://promptintel.securitybreak.io/references/hunting.md): how a researcher or an agent on an Enterprise account pivots between prompts, agent files, indicators and techniques

## Pages

- [Threat feed](https://promptintel.securitybreak.io/feed/): prompts, agent threats and agent files in one list
- [Agent Scanner](https://promptintel.securitybreak.io/scanner/): scan a skill or an MCP server, and browse public scan results
- [IoPC taxonomy](https://promptintel.securitybreak.io/taxonomy/): browse the techniques
- [Framework mappings](https://promptintel.securitybreak.io/taxonomy/frameworks/): IoPC against OWASP, MITRE ATLAS, SAIF, AARM and the NIST AI RMF
- [Documentation](https://promptintel.securitybreak.io/docs/): how to connect an agent, the API, the MCP server
- [The agent skill](https://promptintel.securitybreak.io/docs/skill/): what the PromptIntel skill teaches an agent, its rules, and how to install it
- [Pricing and limits](https://promptintel.securitybreak.io/docs/pricing/): what is free, what is Enterprise, and the limits of each
- [Licence](https://promptintel.securitybreak.io/docs/licence/): what may be done with the intelligence
- [Indicators](https://promptintel.securitybreak.io/indicators/): the two families, IoPC (prompt, agent file, skill, MCP server) and IOC, how each type is matched and how long it is enforced
- [Plans](https://promptintel.securitybreak.io/plans/): the free Community plan and what Enterprise adds

## Data

- [IoPC taxonomy (JSON)](https://promptintel.securitybreak.io/iopc/latest.json): the current published release
- API base URL: https://api.promptintel.securitybreak.io/api/v1
- PromptIntel MCP server (Streamable HTTP, needs a PromptIntel API key as a bearer header): https://promptintel.securitybreak.io/mcp
- Agent Scanner, indicator check and rule pack over HTTP, for agents (same API key): https://promptintel.securitybreak.io/scanner-api/v1
- Public keys that verify signed verdicts (JWK set): https://promptintel.securitybreak.io/.well-known/promptintel-keys.json

## Company

- [SecurityBreak](https://securitybreak.io): the company behind PromptIntel
- [Privacy policy](https://securitybreak.io/legal/privacy)
- [Terms of service](https://securitybreak.io/legal/terms)