Skip to main content

RugBrain

RugBrain is the memory of the platform. A retrieval-augmented generation (RAG) engine that embeds scam patterns, historical hacks, news and social intel, wallet/entity knowledge, and real-time security incidents into vector collections — then serves them back through semantic, hybrid, and entity-aware search.

You meet RugBrain every time the scanner shows a Known Scam Patterns check, the AI chat answers a research question, or an investigation report cites historical precedent. It is also exposed directly as paid tools (rag_search, reputation_score) in the x402 catalog.

✅ Live-platform facts on this page verified against production on 2026-08-24.

What it knows​

DomainContentExample surface
Scam intelligenceKnown scam patterns, historical hacks, scanner findingsScanner "Known Scam Patterns", scam-check
Market awarenessNews, CT rundown, market brief, social sentimentBackend /api/v1/rag/v2/search
Entity intelligenceWallet labels, entity profiles, cross-chain identities/investigate, three-pillar search
Security alertsLive exploit/rug-pull incidents, polled every 5 minutesNATS alerts.crypto.security + ClickHouse

Live scale: 57 Qdrant collections including scam_intel_v2, threat_intel_v2, hacks_v2, news_v2, research_v2, known_scams, defi_exploits, live_threats, security_alerts, exchange_flows, and more.

How retrieval works​

RugBrain uses a three-pillar search architecture fused with Reciprocal Rank Fusion:

  1. Dense retrieval — embeddings via BGE-M3-class models (qwen3-embedding, 2560-dim) served locally through Infinity.
  2. Sparse retrieval — BM25/SPLADE lexical matching for exact symbols and addresses.
  3. Entity retrieval — structured wallet/entity lookups.

Optional cross-encoder reranking and MMR dedup refine the final ranking. Embedding failures fail loud (HTTP 503) — no silent hash-fallback garbage.

Real-time security alert ingestion​

A poller sweeps free security-intel sources (CoinGecko new listings, DeFiLlama hacks, Rekt News, CertiK/PeckShield/Beosin feeds) every 5 minutes. Each new incident is embedded, stored to the security_alerts collection, pushed to NATS (alerts.crypto.security, Redis pub/sub fallback), and logged to ClickHouse for historical tracking.

Market awareness feeds scoring: score_awareness(query) / boosted_risk(query) fold current landscape — trending scams, recent exploits, fear/greed — into risk scores for new token scans, so a token matching a recently exploited protocol is flagged immediately.

API surface​

RugBrain runs as an internal service (FastAPI, authenticated with API keys) behind the platform. Highlights:

Endpoint groupWhat it does
/api/v1/rag/v2/scam-checkSemantic scam-pattern check for a token/address
/api/v1/rag/queryThree-pillar hybrid search over all collections
/api/v1/rag/investigateEntity-aware investigation search
/api/v1/rag/confidenceConfidence scoring for retrieved evidence
/api/v1/analyze/{address}Address analysis fusing vectors + graph
/api/v1/fear-index, /market/moodMarket sentiment indices
/api/v1/news/top, /news/rateRated news intel
/ingestDocument ingestion pipeline

From the public API you touch RugBrain through:

# Knowledge search (paid x402 tool, trial-eligible)
curl -X POST https://rugmunch.io/api/v1/x402-tools/rag_search \
  -H "Content-Type: application/json" \
  -d '{"query": "honeypot patterns with hidden mint functions"}'

Open source core​

The RugBrain engine is open source (MIT) as rugbrain — collection schemas, ingestion sources (25+ pluggable Source implementations), the three-pillar retriever, and B2 snapshot permanence. The managed platform adds proprietary corpora and enrichment.

git clone https://git.rugmunch.io/RugMunchMedia/rugbrain.git
cd rugbrain && pip install -e .
python scripts/seed_all.py --dry-run   # preview seeding
python -m rugbrain                     # serve on :8012

Requires Qdrant, Redis, and an Infinity embedding endpoint — see the repo's .env.example.