io.tooloracle/predictionguard

Adverse media scan — negative news on fraud, money laundering, corruption, sanctions. Delegates to AMLOracle. Core building block for evidence chains that link a wallet or trader to publicly reported concerns (always cite the source, never attribute).

Daily compliance triage: scans top Polymarket markets by 24h volume and flags those whose question text matches curated sensitive-keyword categories — military action, regime change, leadership death, diplomacy, intelligence ops, monetary policy, regulatory action. Returns flagged markets with monitoring severity (HIGH/MEDIUM/LOW), matched categories and keywords, and volume. Pair flagged HIGH markets with pg_insider_signal_scan for active surveillance.

Complete forensic dossier for a single Polymarket market: market details + integrity scan + volume anomaly profile + Trust Layer provenance trace — aggregated into one dossier ready for manual review, press inquiry, or as input to a SAR report.

Composite A-F rating for whether a wallet appears to have had non-public information on a specific market. Aggregates pg_position_timing_anomaly (50% weight) + pg_insider_signal_scan (30%) plus bonuses for being in top positioners (+10), new to market (+10), and sensitive category (+10). Returns letter grade A-F, composite score 0-100, all component scores, and interpretation guide. Pattern-matches reported cases (Van Dyke, Hyperliquid whale). Statistical signal only — not a legal determination.

Issue a cryptographically signed, on-chain anchored integrity alert for a Polymarket market. Combines evidence_anchor + get_signed_fact from FeedOracle Trust Layer. Alerts are anchored on Polygon with an ECDSA signature and are externally verifiable via pg_verify_alert and the JWKS at feedoracle.io/.well-known/jwks.json.

Real-time insider-trading signal scan for a single Polymarket market. Aggregates 5 signals: (1) very large pre-event positions, (2) high ratio of wallets new to this market, (3) coordinated minute-bucket timing clusters, (4) one-sided positioning, (5) sensitive-keyword category match (military/regime/intel). Returns a 0-100 score (CLEAN/LOW/MEDIUM/HIGH/CRITICAL), triggered signals with evidence, top 5 positioners with new-wallet flag, and full methodology for audit. Default window = 72h before market end.

CFTC Rule 5.17(z) conflict-of-interest pre-trade check. Analyzes a Kalshi market's metadata to detect whether trading it would expose decision-makers (election candidates, government officials, athletes, regulators) to insider-trading liability. Pattern-matches against the Kalshi April 2026 disciplinary cases (Moran/Klein/Enriquez) and the CFTC Van Dyke complaint. Returns ALLOW/MONITOR/WARN/BLOCK recommendation + 0-100 score + reference cases. Cannot identify actual trader identity (Kalshi public API anonymizes users) — pair with internal surveillance for full enforcement.

Detailed Kalshi market or event info. Pass 'ticker' for a single market (returns yes/no bids+asks, last price, volume, OI, spread, hours until close) or 'event_ticker' for all markets in an event (multi-outcome). Includes the rules_primary text (Kalshi's settlement criteria) which is critical for understanding resolution risk.

Forensic orderbook analysis for one Kalshi market. Detects manipulation-vulnerable patterns: (1) wide spread (>$0.10), (2) shallow depth (<10 contracts), (3) few price levels, (4) single-order dominance (>80% in top level), (5) penny-wall pattern (large bids at ≤$0.005, commonly used to fake depth). Returns 0-100 score, severity, and full level-by-level data. Kalshi returns bids only — implied asks computed via yes_bid + no_bid = $1 reciprocity.

Compliance briefing: which Kalshi markets resolve in the next N hours? Bucketed by 6h, 24h, 48h, 1 week. Flags markets in CFTC-sensitive categories (Elections, Politics). Use for daily surveillance prep — markets near resolution have highest insider-trading risk window.

Search Kalshi prediction markets (CFTC-regulated event contracts). Returns events ranked by aggregate 24h volume across all markets in the event. Kalshi categories include Elections, Politics, Economics, Climate, Sports, Entertainment, Financials. Public data, no auth needed. Each event has one or more child markets (mutually exclusive or yes/no).

Scan all open Kalshi markets and flag those that are manipulation-vulnerable: closing soon (<24h), low open interest, low liquidity, wide spread, low volume. Daily triage tool. Returns markets ranked by risk_score (≥30 threshold). Best paired with pg_kalshi_resolution_calendar for full compliance briefing.

Top trending Kalshi events ranked by aggregate 24h volume across child markets. Filterable by category. Daily-briefing-ready output. Includes the highest-volume sub-market per event.

Registry of publicly reported prediction-market integrity cases (Théo / French whale, Hyperliquid whale, Venezuela, Iran strikes, Nuclear, UMA Ukraine). Filter by category or minimum AML relevance (low/medium/high). Summaries only — no accusations against named parties.

Full KYC bundle for a named entity: sanctions + PEP + adverse media + country risk in a single call. Delegates to AMLOracle.kyc_bundle.

Full market info: outcomes, outcome prices, volume, liquidity, best bid/ask, spread, resolution source, conditionId. Provide 'slug' or 'id'.

Multi-signal integrity scan: combines thin-book flag, spread, low liquidity, geopolitical-term pattern, end-date proximity, and 24h volume concentration. Returns score 0-100, level HIGH/MEDIUM/LOW/CLEAN, triggered signals, and an operational recommendation.

Search Polymarket markets by keyword (e.g. 'election', 'fed', 'bitcoin'). Returns question, slug, 24h volume, liquidity, end date.

Raw trade access for a Polymarket market via the Polymarket Data API. Supports client-side filters: time range (from/to, ISO 8601), side (BUY/SELL), minimum trade size, or a specific wallet. Paginates server-side (max 25 pages × 1000 trades). Returns compact records with wallet, pseudonym, side, size, price, notional USD, outcome, timestamp, tx_hash.

Volume anomaly heuristic: compares 24h volume vs average daily volume since market start (z-like ratio) and flags thin-book situations where 24h volume >> on-book liquidity.

PredictionGuard platform overview: covered platforms, tool inventory, Polymarket Gamma API ping, Polygon RPC ping (Ankr-backed), known-case count.

Politically Exposed Person (PEP) check via Wikidata. Delegates to AMLOracle. Relevant for prediction markets where reported traders overlap with political figures.

Statistical timing analysis of a single wallet's position on a specific market. Checks: (1) how close to resolution the wallet entered (<6h=35pts, <24h=25pts, <72h=10pts), (2) position size vs market average (>20× avg=25pts, >5× avg=10pts), (3) single-bet pattern (≤3 trades=10pts, no historical trading rationale). Returns 0-100 score, first-trade timestamp, total notional, and methodology. Pair with pg_information_advantage_score for full assessment.

Analyze pre-resolution positioning on a Polymarket market. For the N days before the market's endDate, aggregates trades by wallet, classifies wallets new to the market in that window, detects volume concentration, timing clusters (minutes where ≥5 distinct wallets trade in sync), and pre-event volume spikes vs historical average. Returns a 0–100 risk score (CRITICAL/HIGH/MEDIUM/LOW/CLEAN) with triggered signals, top 10 positioners, and top 10 new wallets. Default window = 7 days.

Pre-trade integrity gate for AI agents and compliance teams. ONE call returns ALLOW/WARN/BLOCK decision + risk_level (0-100) + signed evidence receipt. Aggregates orderbook analysis, resolution-window risk, CFTC Rule 5.17(z) conflict-of-interest check, and (Polymarket) insider signal scan. Supports both Polymarket (slug) and Kalshi (ticker). Optional inputs: wallet (Polymarket-side checks), candidate name (Kalshi Rule 5.17(z) name match), amount_usd (amplifies risk for large bets on thin markets). Returns hashable + ECDSA-signed receipt for audit. Designed for x402 paywall pre-trade calls — agent pays once, gets binary go/no-go.

Multi-signal resolution-risk score (0–100, CLEAN/LOW/MEDIUM/HIGH/CRITICAL) for a Polymarket market. Combines category priors (geopolitical/election/sanctions patterns from pg_known_cases), resolution-phase proximity, market volume, resolution-source sanity check (is the UMA adapter a real deployed contract), UMA global dispute ratio, and thin-book flag. Returns triggered signals with point deductions for full auditability.

Screen a named entity against global sanctions lists (OFAC SDN, EU FSF, UN SC, Interpol). Delegates to AMLOracle. Use after resolving a wallet/trader to a real name via public reporting or known-case registry.

Generate a draft Suspicious Activity Report (SAR/STR) from structured inputs. Supports EU_GENERIC (FATF-aligned STR, default), US_FINCEN (Form 111 structure), and DE_goAML (German FIU draft). Takes subject, market, activity window, integrity signals, and evidence references — auto-classifies the primary suspicious activity type, generates a narrative, and renders regulator-style markdown. Output is marked draft_for_review; PredictionGuard does not submit SARs directly.

Top Polymarket markets by 24h volume. Useful for daily compliance triage / catching news catalysts before they land in mainstream coverage.

Resolution source and phase for a specific Polymarket market. Fetches market metadata from Gamma, extracts the resolutionSource address, verifies it's a deployed contract on Polygon, and classifies the resolution phase (active_trading / approaching_resolution / imminent_resolution_window / past_end_awaiting_resolution / resolved).

Global UMA Optimistic Oracle health on Polygon. Scans event logs from OOv2 (and optionally OOv1) over a configurable window, tallies events by type (RequestPrice / ProposePrice / DisputePrice / Settle), computes per-hour rate, and derives a dispute/propose ratio — a leading indicator of oracle-level contention.

Verify a previously issued signed alert (JWS or content-hash). Delegates to Trust Layer verify_signature. Returns validity, signer, and timestamp. JWKS at feedoracle.io/.well-known/jwks.json.

Find wallets that co-trade across multiple sensitive Polymarket markets with a target wallet. Given a wallet and 2-10 market slugs, returns: which markets the target traded, top 20 cotraders ranked by overlap count, and an aggregate severity score (≥3 shared markets = MEDIUM, ≥5 = HIGH). Use case: detect coordinated trading rings, shared-info syndicates, or wallet clusters that consistently bet on the same sensitive events.

Resolve a Polygon address to a known entity via PredictionGuard's Wallet Registry (Polymarket core contracts, major stablecoins, known CEX hot wallets), falling back to on-chain heuristic classification for unknown addresses. Returns entity name, type, category, AML relevance, confidence, and source-of-record URL.

Polygon wallet base profile via JSON-RPC (Ankr-backed when RPC_POLYGON is set, public fallback otherwise). Returns MATIC balance, outbound tx count, contract-vs-EOA detection, and a lightweight risk heuristic.

Aggregated A–F risk profile for a Polygon wallet. Combines on-chain behavior (pg_wallet_lookup), entity resolution (pg_wallet_entity_resolve), and — where the entity can be screened — AML bundle (sanctions + PEP + adverse media via AMLOracle). Grade A = clean, F = blocked. Includes triggered flags with points deductions for full auditability.

Add a Polygon wallet to the PredictionGuard watchlist. Takes an initial baseline snapshot so subsequent pg_whale_scan calls can detect movement. Set alert_threshold_matic to tune sensitivity (default 100 MATIC). Tags are free-form.

Retrieve alerts from the watchlist audit log. Filter by address, severity (LOW/MEDIUM/HIGH/CRITICAL), and/or ISO timestamp 'since'. Default returns the 50 most recent alerts across the whole watchlist.

List all watched wallets with their alias, threshold, tags, notes, and last snapshot. Optionally filter by tag.

Remove a wallet from the watchlist. By default keeps historical snapshots and alerts (for audit trail). Set keep_history=false to purge everything for this address.

Scan one or all watched wallets against Polygon RPC. Compares current balance + nonce to the last snapshot, writes a new snapshot, and emits an alert when the delta exceeds the wallet's configured threshold. Severity is MEDIUM / HIGH / CRITICAL by delta size. Omit 'address' to scan the entire watchlist. Designed to be called periodically via SchedulerOracle or a systemd timer.