Crypto address risk checks for agents: USDT/USDC blacklists, sanctions, scam lists, poisoning
Scored across 8 tools
The tools are mostly clearly distinct: decide returns a policy verdict, screen returns raw facts, preflight covers operational payment safety, and trace/watch/batch have unique roles. The only mild overlap is that balance and payment_info both expose pricing information, though they serve different account-versus-payment purposes.
All tools consistently use the onyx_ prefix with snake_case names, making the set predictable and easy to scan. Most names are operation-oriented, though a few are noun-based (balance, payment_info), which is a minor deviation from a strict verb_noun pattern.
Eight tools is well-scoped for an AML and payment-safety server. Each tool covers a distinct workflow: account/payment setup, decisioning, raw screening, batch screening, preflight checks, tracing, and monitoring.
The surface covers the core AML lifecycle: payment terms, risk decisions, raw screening, batch checks, operational preflight, tracing, and ongoing watch subscriptions. Minor gaps remain around managing subscriptions, such as listing or removing watches, but the main agent workflows are covered.
How much credit your API key has left, and the current prices. Free.
Inputs: no named parameters.
Return allow / review / deny for a counterparty address against your own risk policy, with the reasons named. Use this before every outbound transfer. Checks issuer blacklists (USDT, USDC), sanctions across six EVM chains plus the OFAC list, open scam databases, community reports and behavioural patterns. Costs credit.
Inputs: address (required), policy, amount_usd.
Machine-readable payment terms: which asset and network to send, the address, prices per operation, and how to claim an API key from the address you paid from. No account or signup is involved. Free, and works without a key.
Inputs: no named parameters.
Operational safety check for a payment, separate from risk screening. Detects address poisoning (a lookalike planted in your history so it gets copied instead of the real address), burn addresses, token contracts and other contract recipients that would swallow the tokens (a Safe multisig or an EIP-7702 delegated wallet is reported as a wallet, not a trap), and addresses that behave differently on different chains. Pass known_addresses (the counterparties you already use) to enable poisoning detection. Verdicts: stop, caution, clear, or unknown: on EVM chains the recipient check could not run (retry, not charged); on TRON and Solana only the lookalike check exists (partial: true) and known_addresses is required. In our live-traffic sample this class of loss came up far more often than sanctioned counterparties. Dedicated transaction-security services cover part of it; no AML screening does. Run this together with onyx_decide before every payment.
Inputs: address (required), chain, known_addresses.
Return the raw risk markers for one address: risk zone, issuer blacklists, sanctions coverage, scam databases, community reports, address age, balance and exchange attribution where known. Use this when you want the facts rather than a decision. Costs credit.
Inputs: address (required).
Screen up to 50 addresses in a single call, for example before a mass payout. Priced per address, and only addresses actually screened are charged. Each result carries facts_complete so you can tell whether the behavioural facts finished loading.
Inputs: addresses (required).
Multi-hop trace of outgoing flows from an address, with attribution where a node is known (exchange labels, deposit addresses). Use it to establish provenance after receiving funds. Costs more than a screening call.
Inputs: address (required).
Subscribe to an address. When it enters an issuer blacklist, a sanctions list or a scam database, we POST a signed event to your callback URL. A one-off check cannot warn you about a freeze that has not happened yet. Billed per address per day. The callback must be public https.
Inputs: address (required), callback_url (required).
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
OFAC and global sanctions screening: crypto addresses, emails, websites, IDs, countries, VPN, geo
TRON USDT risk: free Tether blacklist check, paid sanctions screen and AML report.
Sanctions screening, KYB, identifier validation, jurisdiction risk & secret scanning for AI agents
Blockchain address risk scoring, AML reports, sanctions screening and counterparty exposure.
Add one secure layer between your agents and this server.
