web3-risk-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| GOPLUS_APP_KEY | No | Optional GoPlus API key (https://gopluslabs.io) | |
| ETHERSCAN_API_KEY | Yes | Etherscan API key (required). Get one at https://etherscan.io/myapikey | |
| GOPLUS_APP_SECRET | No | Optional GoPlus API secret (https://gopluslabs.io) |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| score_riskA | Give an address a 0-100 risk score with a reason for every point. |
| get_wallet_profileA | Describe a wallet: age, balance, transaction count, top counterparties, tokens it used recently, activity patterns, and any known bad-actor labels. |
| check_token_riskA | Check an ERC-20 token for scam signs before buying it: honeypot (cannot sell), mint, blacklist, and pause powers, buy/sell tax, owner and holder concentration, liquidity size, and whether liquidity is locked. |
| inspect_contractA | Inspect a smart contract: is the source verified, is it an upgradeable proxy, who owns or controls it (wallet, multisig, or renounced), and a plain-English summary of risky functions such as mint, blacklist, pause, and fee changes. |
| trace_fundsA | Follow money in and out of an address for 1 or 2 hops and flag links to known risky addresses such as mixers, sanctioned wallets, and exploiters. |
| list_supported_chainsA | List the chains this server can investigate. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| investigate_address | A step-by-step risk investigation of a wallet, token, or contract. |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| scoring-method | The rules, points, and limits behind score_risk. |
TDQS
Scored across 6 tools
Most tools are clearly distinct: scoring, profiling, token-specific checks, contract inspection, tracing, and chain listing. However, 'score_risk' and 'check_token_risk' have some overlap when applied to tokens (score_risk already checks tokens, though with a different focus). The descriptions help, but a user might hesitate between the two for a token risk check.
Tools mostly follow a verb_noun pattern: score_risk, get_wallet_profile, check_token_risk, inspect_contract, trace_funds. 'list_supported_chains' is consistent. Minor deviation: 'get_wallet_profile' uses 'get' while others use 'check'/'inspect'/'trace', but it's still a clear verb-noun structure. No mixed casing or vague verbs.
With 6 tools, the server is well-scoped for a blockchain risk investigation tool. Each tool addresses a distinct aspect (scoring, profiling, token safety, contract inspection, fund tracing, chain support). This is within the ideal 3-15 range and feels neither sparse nor bloated.
The toolset covers the full risk investigation lifecycle: get a risk score, profile an address, dive into token-specific risks, inspect contract details, trace fund flows, and list chains. A minor gap: there's no direct function to compare multiple addresses or to get a detailed report on a specific transaction or a custom investigation path, but agents can combine these tools to achieve those outcomes.