PG1 Sovereign Threat Intelligence

check_wallet_sanctions

PG1 Sovereign Threat Intelligence: checks a cryptocurrency wallet address against the OFAC SDN (Specially Designated Nationals) sanctions list, synced daily from US Treasury data. No payment required — this tool is always free. SIBLING DIFFERENTIATION: Use for wallet/address sanctions screening only. Do NOT use for IP/domain/hash/URL threat lookups (use get_ioc_context) or CVE data (use get_cve_details). BEHAVIOR: Returns { listed: true|false, matches, source, list_last_synced }. A listed:false result means the address is not on the OFAC SDN list as of the reported sync time — it is informational only, not legal or sanctions-compliance advice, and is never phrased as "safe" or "clean". Fails loudly (returns an error) if the sanctions data is empty or unreachable, rather than ever reporting listed:false on a data failure. VALIDATION: if the address does not match a recognised format for any supported currency (EVM, BTC/LTC/BCH/DOGE/DASH/ZEC base58 or bech32/cashaddr, TRON, Monero, Solana), returns an MCP tool error (isError: true, code invalid_address) instead of a result — it never reports listed:false for malformed input.

Input Schema

Name	Required	Description	Default
`address`	Yes	Mandatory wallet address to screen, e.g. an EVM 0x address, a bech32 (bc1/tb1/ltc1...) address, or a base58 address.
`currency`	No	Optional currency/chain filter to narrow the match, e.g. 'BTC', 'ETH', 'XMR'.

Output Schema

Name	Required	Description
`checks`	No	Which underlying sources were checked for this result and whether each one completed.
`listed`	Yes
`source`	Yes
`status`	No	"unknown" whenever a source needed for this answer timed out, errored, or was skipped - never "no_flags" in that case.
`address`	Yes	The address exactly as submitted.
`matches`	Yes
`message`	No
`reasons`	No	Machine-readable reason codes for anything flagged in this result. Empty when nothing was flagged.
`disclaimer`	No
`request_id`	No	UUID for this request, also sent as the X-Request-Id response header.
`test_fixture`	No	true only when the input was a documented integration test fixture and this response is canned; absent on real results.
`list_last_synced`	Yes
`address_normalized`	Yes	The address after normalization, used to match against sanctioned_wallets.

Schema Changelog

Changes observed during successful MCP inspections.

Changed5 schema fields changedOct 1, 2026

addedOutput schema / properties / checks

Added value: +{
+  "description": "Which underlying sources were checked for this result and whether each one completed.",
+  "items": {
+    "properties": {
+      "checked_at": {
+        "type": "string"
+      },
+      "data_as_of": {
+        "type": [
+          "string",
+          "null"
+        ]
+      },
+      "result": {
+        "enum": [
+          "ok",
+          "timeout",
+          "error",
+          "skipped"
+        ],
+        "type": "string"
+      },
+      "source": {
+        "description": "Generic label for the data source checked, never a vendor name.",
+        "type": "string"
+      }
+    },
+    "required": [
+      "source",
+      "result",
+      "checked_at",
+      "data_as_of"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

addedOutput schema / properties / reasons

Added value: +{
+  "description": "Machine-readable reason codes for anything flagged in this result. Empty when nothing was flagged.",
+  "items": {
+    "properties": {
+      "code": {
+        "type": "string"
+      },
+      "message": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "code",
+      "message"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

addedOutput schema / properties / request_id

Added value: +{
+  "description": "UUID for this request, also sent as the X-Request-Id response header.",
+  "type": "string"
+}

addedOutput schema / properties / status

Added value: +{
+  "description": "\"unknown\" whenever a source needed for this answer timed out, errored, or was skipped - never \"no_flags\" in that case.",
+  "enum": [
+    "flagged",
+    "no_flags",
+    "unknown"
+  ],
+  "type": "string"
+}

addedOutput schema / properties / test_fixture

Added value: +{
+  "description": "true only when the input was a documented integration test fixture and this response is canned; absent on real results.",
+  "type": "boolean"
+}

Changed1 schema field changedSep 25, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "properties": {
+    "address": {
+      "description": "The address exactly as submitted.",
+      "type": "string"
+    },
+    "address_normalized": {
+      "description": "The address after normalization, used to match against sanctioned_wallets.",
+      "type": "string"
+    },
+    "disclaimer": {
+      "type": "string"
+    },
+    "list_last_synced": {
+      "type": "string"
+    },
+    "listed": {
+      "type": "boolean"
+    },
+    "matches": {
+      "items": {
+        "properties": {
+          "currency": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "programs": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "sdn_name": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "sdn_uid": {
+            "type": [
+              "string",
+              "number",
+              "null"
+            ]
+          }
+        },
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "message": {
+      "type": "string"
+    },
+    "source": {
+      "type": "string"
+    }
+  },
+  "required": [
+    "address",
+    "address_normalized",
+    "listed",
+    "matches",
+    "source",
+    "list_last_synced"
+  ],
+  "type": "object"
+}

AddedSep 25, 2026

TDQS

A4.9/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations, so the description carries full burden and does so richly: discloses it is always free, the exact return shape, that listed:false is informational and never phrased 'safe'/'clean', that it fails loudly on empty/unreachable data rather than reporting listed:false, and that malformed input returns an isError with code invalid_address. This is unusually thorough behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the core purpose, then uses labeled sections (SIBLING DIFFERENTIATION, BEHAVIOR, VALIDATION) that earn their space. Despite its length, every sentence conveys distinct operational information; nothing is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Has an output schema, so return-value documentation is not strictly needed, yet the description still adds interpretation (listed:false semantics, failure mode, validation behavior). For a sanctions-screening tool where misreading a false result is high-stakes, this is complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents both parameters; baseline would be 3. The description adds value by enumerating supported address formats (EVM, BTC/LTC/BCH/DOGE/DASH/ZEC base58/bech32/cashaddr, TRON, Monero, Solana), which clarifies what 'address' and 'currency' accept beyond the schema's brief examples.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'checks a cryptocurrency wallet address against the OFAC SDN sanctions list.' It also explicitly names the sibling tools it is NOT for (get_ioc_context for IP/domain/hash/URL, get_cve_details for CVE), letting an agent route correctly without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit 'Use for wallet/address sanctions screening only' clause plus named alternatives and the conditions that select them. This is textbook when/when-not guidance with alternatives spelled out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All PG1 Sovereign Threat Intelligence tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.