IOCArena: classify IPs, domains and hashes from VirusTotal data with Jev, Von or Laya

# IOCArena

A small self-hosted app that runs VirusTotal data through **System One**
decision models to classify IP addresses, domains, and file hashes — and lets
you **evaluate those models against each other**.

The primary purpose is **evaluating the models**, not production threat
detection. The prompts and criteria handed to them are versioned JSON data, so
you can edit them, run the same labelled dataset through every model, and
compare the results.

## Screenshots

[](screenshots/ioc3.png)

[Evaluation dashboard](screenshots/ioc3.png) · [Lookup result](screenshots/ioc1.png) ·
[Instruction editor](screenshots/ioc2.png)

Supported models:

| Provider | What it is | Where it runs | Key |
| --- | --- | --- | --- |
| `typesafe` | TypeSafe **Jev** | Hosted API | `TYPESAFE_API_KEY` |
| `von` | [Von](https://github.com/wfzyx/von) | Local container | none |
| `laya` | [Laya](https://github.com/NandhaKishorM/laya) | Local container | none |

All three speak the same `POST /v1/systemone` wire contract, so the backend
talks to them identically and only the wire-format translation differs (Von
needs structured instructions flattened to strings; see `app/providers.py`).

## Layout

- `app/` — FastAPI backend. Lookups, history, instruction sets, and the
  evaluation engine.
- `frontend/` — SvelteKit UI (adapter-node). A console for lookups, plus
  instruction editing and evaluation pages.
- `instructions/<ip|domain|file_hash>/<id>.json` — instruction sets.
- `eval/` — evaluation scripts, cached datasets, and run output.
- `laya_server/` — thin FastAPI wrapper that serves the Laya SDK over
  `/v1/systemone`.
- `von_server/` — the Von server (`von-sdk`) plus a startup warmup.
- `secrets/` — file-based API keys for Docker (gitignored).

## Requirements

- Docker + Compose (recomme