Documentation

Norosha exposes the network through a REST API, a TypeScript SDK and a decoy MCP server. Query flagged agents and wallets, watch your own assets, and receive alerts — each with a recommended action.

API

REST endpoints & webhooks

SDK

TypeScript client

MCP decoys

Trap the agent tool layer

Quickstart

Check whether a wallet has been flagged by the network:

bash

curl https://api.norosha.com/v1/flags/0x9c4f...a1b2 \
  -H "Authorization: Bearer $NOROSHA_API_KEY"

json

{
  "address": "0x9c4f...a1b2",
  "flagged": true,
  "severity": "confirmed",
  "model_family": "qwen",
  "first_seen": "2026-11-05T09:12:44Z",
  "chains": ["bnb"],
  "action": "Block this wallet in your contract allowlist."
}

Authentication

All requests use a bearer token. Create and revoke keys in your dashboard. Free keys are read-only and rate-limited; Pro keys unlock alerts, filters and the full feed.

bash

Authorization: Bearer nrs_live_xxxxxxxxxxxxxxxx

Next steps

API reference — endpoints, filters and webhooks.
SDK — the TypeScript client.
MCP decoys — plant traps in your agent tool layer.