> **Agent?** Fastest path: MCP at `https://api.mnemom.ai/mcp` — call `get_started` first (zero-auth, no args). Full agent guide: <https://www.mnemom.ai/agents.txt>

# Trust Center

Trust Center

# Indicator-of-Compromise feed

Public, machine-readable feed of indicators AEGIS surfaces from the Protection Network. Returned as a STIX 2.1 Bundle so it slots into existing threat-intel pipelines.

Endpoint

`GET https://api.mnemom.ai/v1/trust/iocs`

No authentication required. Rate-limited at the gateway plus a best-effort in-handler check (1 req/min/IP). Pagination via `?after=&lt;ISO-8601 timestamp&gt;` on the previous response's `next_after` field.

## Calm-at-GA contract

At GA the feed may be empty. That's the system telling the truth: when AEGIS has no closed campaigns and no live indicators, the feed surfaces an empty STIX bundle rather than theatre.

## Consumption examples

curl + jq

curl -sS 'https://api.mnemom.ai/v1/trust/iocs' | jq '.objects\[\] | {id, type, indicator\_types, pattern}'

Python (requests)

import requests

resp = requests.get("https://api.mnemom.ai/v1/trust/iocs")
bundle = resp.json()
for obj in bundle.get("objects", \[\]):
    if obj.get("type") == "indicator":
        print(obj.get("id"), obj.get("pattern"))

# Pagination — pass next\_after as ?after=
next\_cursor = bundle.get("next\_after")

## Indicator extensions

Indicators with canonical STIX patterns (sha256 hashes, domains, URLs) emit those patterns directly. Mnemom-internal indicator classes (substrate fingerprints, MITRE ATT&amp;CK technique IDs) carry the value inside a Mnemom property-extension on the STIX `indicator` SDO. The extension also carries the Traffic Light Protocol class, a synthetic-fixture marker, and the related advisory id when present.

---
_Source: /trust/iocs/index.html · Generated by build-markdown-mirrors.mjs · For agent-readability commitment #4 see https://www.mnemom.ai/for-agents/_