forensics-mcp
Server Details
x402-payable on-chain forensics tools: token verdicts, settle-safe RWA screens, wallet trust screens
- Status
- Healthy
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-03-26
- URL
- Repository
- leohoudinisanders-byte/forensics-mcp
- GitHub Stars
- 0
TDQS
Scored across 6 tools
Most tools are distinguishable by scope, but token_profile and token_verdict overlap heavily—both analyze ERC-20 tokens for supply changes, concentration, and whale activity, differing mainly in depth and whether a score/tier is returned. settle_safe and diligence_memo also touch the same token-forensics space at different tiers, which risks misselection for an agent deciding between a profile, a verdict, or a screen.
All names use consistent snake_case with a two-word resource/action structure (token_profile, token_verdict, wallet_screen, settle_safe, diligence_memo). The only minor deviation is forensics_info, which is a generic noun rather than a clear action, but the overall convention is predictable.
Six tools is well-scoped for an on-chain forensics service, with each tool covering a distinct analysis artifact (memo, directory, settle-safe screen, token profile, token verdict, wallet screen). No redundant padding or obviously missing category within the count.
The surface covers the core forensics lifecycle: discovery (forensics_info), token analysis (token_profile, token_verdict), pre-trade screening (settle_safe), wallet screening (wallet_screen), and a composed report (diligence_memo). Minor gaps exist—no explicit monitoring/alerting or historical/trend tool—but agents can work around these.
Available Tools
6 toolsdiligence_memoAInspect
$0.25 composed Token Due-Diligence Memo (decision-grade, reproducible, no LLM calls): verdict + supply/flow forensics + settle-safe screen + narrative risk assessment. $0.35 when counterparty is provided (adds the settlement counterparty trust screen). EVM or XRPL.
| Name | Required | Description | Default |
|---|---|---|---|
| chain | No | ||
| token | No | token alias | |
| address | No | ||
| currency | No | XRPL currency code (chain=xrp) | |
| counterparty | No | optional settlement counterparty (adds trust screen, +$0.10) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden and does disclose genuinely useful traits: deterministic 'reproducible, no LLM calls' output and explicit cost ($0.25, +$0.10 for counterparty). It does not mention latency, rate limits, or auth requirements, but the cost and determinism disclosures are substantive behavioral context rarely found elsewhere.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two dense sentences with the price and core deliverable front-loaded, followed by the counterparty upgrade and chain support. Little waste, though the parenthetical stack is somewhat compressed and reads like marketing copy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 5-parameter tool with 0 required params, no output schema, and no annotations, the description should clarify which parameters are needed for which chain (e.g., currency for XRPL, address vs token alias). It covers what is produced and the cost tiers but leaves the required-parameter combinations ambiguous.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 60%, in the middle band. The description hints at chain support ('EVM or XRPL') and repeats the counterparty trust-screen semantics already present in the schema description, but it does not clarify the distinction between token alias, address, and currency, nor the base/ethereum/xrp enum choices. Marginal value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific resource ('composed Token Due-Diligence Memo') and enumerates its components: verdict, supply/flow forensics, settle-safe screen, and narrative risk assessment. These components map cleanly onto the sibling tools (token_verdict, forensics_info, settle_safe), so an agent can infer this is the aggregate view. It stops short of explicitly naming the siblings it consolidates, keeping it at 4 rather than 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: the composite nature suggests 'call this to get everything at once' versus the individual sibling tools, but no explicit when-to-use or when-not-to-use statement is given. The cost tiers ($0.25 vs $0.35 with counterparty) inform selection economics but are pricing, not guidance. No alternatives are named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
forensics_infoAInspect
FREE. Service directory for the On-chain Forensics MCP server: endpoint catalog, chains supported (Base, Ethereum, XRPL), pricing, tokenized-equity aliases (btsla, bcspx, rlusd, bitstamp-usd, ...) and usage examples.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It usefully discloses cost ('FREE') and implies a passive read-only directory with no side effects, but says nothing about authentication requirements, rate limits, or whether the returned catalog is static or live. Adequate but thin for an unannotated tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single dense sentence with the most decision-relevant token ('FREE') front-loaded, followed by the content inventory. Efficient, though the parenthetical alias list is long and could be trimmed without loss.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-param, no-output-schema info tool, the description is nearly complete: it tells the agent exactly what categories of information the call returns, so no follow-up is needed to decide whether to invoke it. Only the absence of any usage routing keeps it from being fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so per the rubric the baseline is 4. There is no parameter semantics to explain, and the description correctly does not invent any.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource (service directory for the On-chain Forensics MCP server) and enumerates its contents: endpoint catalog, supported chains, pricing, tokenized-equity aliases, and usage examples. That is clearly distinct from the sibling tools (diligence_memo, settle_safe, token_profile, token_verdict, wallet_screen), though it never explicitly contrasts itself with them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'FREE' implies this is the no-cost entry point for discovery before calling paid siblings, which gives an implied usage context. However, there is no explicit when-to-use statement, no prerequisites, and no named alternatives, so the agent must infer the routing on its own.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
settle_safeBInspect
$0.02. FLAGSHIP pre-trade settle-safe screen for AI agents trading tokenized equities/RWAs: canonical-asset check against the verified registry (EVM: btsla/bcspx/bnvda/aapl/nvda/usdy/ousg/...; XRPL issuers: rlusd, gatehub-usd, bitstamp-usd/eur), freeze/clawback flags, trustline breadth, optional counterparty wallet trust tier.
| Name | Required | Description | Default |
|---|---|---|---|
| chain | No | ||
| token | No | token alias (btsla, rlusd, bitstamp-usd, ...) | |
| address | No | EVM token contract or XRPL issuer | |
| currency | No | XRPL currency code (chain=xrp) | |
| counterparty | No | optional settlement counterparty wallet to trust-screen |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does disclose substantive behavior — the specific checks run (registry canonical-asset verification, freeze/clawback flags, trustline breadth, counterparty trust tier) and the cost ($0.02), which is genuinely useful. It still omits what the screen returns, whether a failure blocks settlement, and latency/rate behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that leads with cost and purpose, and the bulk of the content (registry examples, chain-specific issuers, check list) earns its place. It loses a point for the run-on parenthetical and the 'FLAGSHIP' marketing qualifier, which is pure noise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations, no output schema, five optional parameters, and no required fields, the description should clarify how chain/token/address/currency interoperate (e.g., currency applies only to chain=xrp) and whether any parameter combination is mandatory. It gestures at the domain but leaves the invocation contract under-specified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 80%, so the schema already documents token alias, address format, currency, and counterparty. The description's registry examples (btsla/bcspx/bnvda…, rlusd, gatehub-usd, bitstamp-usd/eur) reinforce the token/address values but add little syntax or selection logic beyond the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: a pre-trade 'settle-safe screen' that performs canonical-asset registry checks, freeze/clawback flag detection, and trustline breadth analysis on tokenized equities/RWAs. Sibling differentiation is weak, however — it never says how it differs from token_verdict or wallet_screen, even though 'optional counterparty wallet trust tier' visibly overlaps with wallet_screen.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'pre-trade settle-safe screen for AI agents trading tokenized equities/RWAs' implies the usage context (run before settling a trade), so the when is inferable. But there is no explicit when-not, no prerequisite chain selection guidance, and no named alternative for the overlapping sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
token_profileCInspect
$0.05. Full ERC-20 forensics profile on Base or Ethereum: exact 24h net supply change, recent mint/burn events, holder concentration, top transfers, whale moves.
| Name | Required | Description | Default |
|---|---|---|---|
| chain | No | ||
| token | No | token alias (ondo, edel, buidl, ...) | |
| address | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It discloses cost ($0.05), which is genuinely useful and beyond the schema, but says nothing about read-only nature, auth requirements, rate limits, or latency; for a mutation-free but possibly expensive forensics call this leaves major gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that front-loads the cost and then the capability, with the output list tightly packed. No filler, though the comma-spliced enumeration is dense.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, annotations, or high-coverage params, the description does list the returned dimensions — useful — but is silent on how to choose between token and address, what the $0.05 buys in terms of scope/limits, and how it differs from overlapping siblings. Adequate but under-specified for a 3-param paid forensics tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 33%; the address pattern and token alias examples live in the schema, while the description merely repeats the chain enum ('Base or Ethereum'). It never clarifies the token-vs-address relationship (are they alternatives? both required?), so it fails to compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Full ERC-20 forensics profile') and constrains scope to Base or Ethereum, then enumerates the exact outputs (net supply change, mint/burn, holder concentration, transfers, whale moves). This distinguishes it reasonably from generic siblings like forensics_info, though it never names an alternative explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The only usage signal is the price tag '$0.05', which implies a paid call. There is no statement of when to reach for this over token_verdict, forensics_info, or wallet_screen, nor any prerequisite (e.g., which of token/address to supply).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
token_verdictAInspect
$0.02. Token verdict card for any ERC-20 on Base or Ethereum (address+chain), any registered alias (token=btsla|ondo|edel|...), or any XRPL issued currency (chain=xrp + issuer + currency): activity score 0-100, verdict tier (RED_HOT/HEAVY_FIRE/ACTIVE/THIN/SUSPICIOUS_THIN/DORMANT), transfers, unique wallets, mints/burns, concentration, whale flags, plain-English take.
| Name | Required | Description | Default |
|---|---|---|---|
| chain | No | ||
| token | No | token alias (btsla, bcspx, ondo, edel, rlusd, bitstamp-usd, ...) | |
| address | No | EVM token contract (0x...) or XRPL issuer (r...) | |
| currency | No | XRPL issued-currency code (3 letters or 40-char hex), for chain=xrp |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the full disclosure burden; it does add real behavioral value by enumerating the response contents and disclosing the $0.02 cost up front. It stops short of stating read-only vs mutating nature, permission/auth requirements, or rate limits, which keeps it out of the top band.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One dense sentence with the price front-loaded, then the input modes, then the output payload. Every clause carries information, though the parenthetical enumerations of aliases and tier names make it heavier than a purely scannable definition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Inputs and return contents are well covered and no output schema exists to offload them, so the coverage is broadly adequate. It is silent on which parameter combination is mandatory in practice (required=0 in the schema) and on how it differs from the overlapping token_profile sibling, leaving a real gap for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is already 75% (chain, token, address, currency all carry descriptions or an enum), so baseline is 3. The description goes further by explaining how the parameters combine per input mode (address+chain vs token alias vs chain=xrp with issuer and currency), which the schema does not express.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific deliverable (a 'token verdict card') over clearly enumerated resource domains: ERC-20 on Base/Ethereum, registered aliases, and XRPL issued currencies. It also lists the exact outputs (0-100 score, verdict tier set, transfers, wallets, mints/burns, concentration, whale flags). It does not, however, differentiate itself from the sibling token_profile, which an agent would likely confuse it with.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied through the three accepted input forms (address+chain, token=alias, chain=xrp+issuer+currency). There is no explicit when-to-use, when-not-to-use, or named alternative among diligence_memo/token_profile/wallet_screen, so routing between siblings is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
wallet_screenAInspect
$0.05. Wallet trust screen for any wallet on Base, Ethereum or XRPL (chain=xrp): balance, tx count, flows, top counterparties, contract-interaction risk, trust tier. For XRPL also trustlines and issuer screens.
| Name | Required | Description | Default |
|---|---|---|---|
| chain | No | ||
| address | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does disclose the price ($0.05) and the breadth of returned analysis, which are genuine behavioral facts beyond the schema. However, it says nothing about auth requirements, latency, caching, or failure behavior for an invalid/unsupported address, leaving real gaps for a paid tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the price, then purpose, then the returned signal list in one dense sentence with no filler. The enumeration is long but each item is a distinct capability claim, so it earns its space.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description usefully doubles as a return-value summary and states the cost, so an agent knows what it gets and what it pays. The remaining gap is behavioral (permissions, errors, rate limits), which is modest for a read-only screening call.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It names the three supported chains and clarifies that XRPL is selected with chain=xrp, which adds meaning beyond the bare enum, but it never explains the address parameter's two accepted formats (0x hex vs XRPL r-address) that the schema only encodes as a regex pattern.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ("Wallet trust screen for any wallet") and enumerates the delivered signals (balance, tx count, flows, counterparties, contract-interaction risk, trust tier), which is far more than the name alone conveys. It also scopes the supported chains. It stops short of naming which sibling it replaces (token_verdict, forensics_info), so sibling differentiation is left to inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied rather than stated: an agent can infer "screen a wallet for trustworthiness" and that XRPL wallets get extra coverage, but there is no explicit when-to-use/when-not-to-use and no comparison against the token-focused siblings. The "(chain=xrp)" hint is the only routing guidance offered.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
- First observed
diligence_memo - First observed
forensics_info - First observed
settle_safe - First observed
token_profile - First observed
token_verdict - First observed
wallet_screen
Related MCP Connectors
Pay-per-call crypto intel via x402: honeypot/rug check, whale flows, unlocks, MEV, liquidation risk
x402 paid on-chain data: token report, contract DD, pool risk, wallet profile, Robinhood Chain.
Free token-safety scans + paid x402 verdicts, signals, radar & EVM swap quotes for AI agents.
Free token-safety scans + paid x402 verdicts, signals, radar & EVM swap quotes for AI agents.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenancePay-per-use AI security and research tools for autonomous agents on Base, enabling honeypot detection, risk assessment, wallet analysis, and yield optimization via the x402 protocol.1-
- AlicenseNot gradedqualityFmaintenanceArchived and no longer maintained. Tools and prices shown here are out of date. Use the maintained server: glama.ai/mcp/servers/OceanAlt666/oceanalt-aml-mcp (GitHub: OceanAlt666/oceanalt-aml-mcp).280 npmMIT
- FlicenseNot gradedqualityDmaintenanceProvides counterparty risk checks for any EVM address, returning malicious-history flags, tiered risk scoring, and plain-language summaries via x402 payment.-

AgentRiskofficial
FlicenseNot gradedqualityBmaintenancePre-Trade Security & Risk Analysis Layer for Autonomous DeFi Agents on Base using x402 protocol.-
Glama MCP Gateway
Add one secure layer between your agents and this server.