XRPL Token Guard

Ask your AI agent, or your voice assistant, "is this token safe?" and get an honest answer with reasons.

XRPL Token Guard is an open-source MCP server. It checks XRP Ledger tokens and wallets using live, read-only mainnet data, and returns three things:

• a verdict: High risk / Caution / No red flags found / Not enough data

• the reasons behind it, each naming the exact ledger fact

• a one-sentence spoken summary, ready for text-to-speech on Alexa+ or any other voice assistant

It never signs, never sends a transaction and never asks for keys.

You:    "Is this RLUSD real?"
Guard:  "Warning, high risk. This token calls itself RLUSD, but it is not the real Ripple USD.
         The real one comes from a different issuer. I would not buy it."

Why it exists

Scammers on the XRP Ledger copy famous names. On mainnet today there are several tokens called RLUSD that aren't Ripple's. Many of them have a black-holed issuer, which naive checkers score as "safe" because nobody can mint more. Token Guard knows the official issuers and flags the copy first. It explains that a locked supply doesn't make an imitation genuine.

Answers have to be short enough to speak and specific enough to trust. Every finding carries both a precise message (for screens and agents) and a spoken line (for voice).

Related MCP server: jevscan

Tools

There's also a prompt, voice_token_check, that tells a voice assistant how to answer: two sentences, the verdict and the main reason, no buy/sell advice.

Every tool has:

• readOnlyHint: true

• an outputSchema, with typed structuredContent in each response

• a human-readable text block

Tickers are resolved case-insensitively against the issuer's real obligations, so asking for "bigds" finds $BIGDS.

Run it

npm install
npm run build
npm start                 # Streamable HTTP on http://127.0.0.1:8787/mcp, voice demo on http://127.0.0.1:8787/
npm run stdio             # stdio transport for Claude Desktop / Claude Code / Cursor
npm test                  # 14 unit + end-to-end MCP tests (LIVE=1 adds a mainnet check)

Transport: Streamable HTTP, MCP protocol 2025-11-25.

• Stateless: every POST /mcp gets a fresh server, so it scales horizontally.

• JSON responses.

• Rate limit: 60 requests per minute per IP.

• Origin allow-list via ALLOWED_ORIGINS.

• GET /health reports the transport and protocol.

Docker:

docker build -t xrpl-token-guard . && docker run -p 8787:8787 xrpl-token-guard

Claude Desktop (claude_desktop_config.json):

{ "mcpServers": { "xrpl-token-guard": { "command": "node", "args": ["/path/to/xrpl-token-guard/dist/stdio.js"] } } }

Configuration

Voice demo (Alexa+-style simulator)

Open http://127.0.0.1:8787/ and tap the mic (Chrome), or type.

• The page is a small MCP client that speaks Streamable HTTP to /mcp. It turns the question into a tool call and reads spoken_summary aloud.

• The right-hand panel shows the live tools/call request and result.

• /?demo=1 plays a scripted run with captions, for screen recording.

How the verdict works

Regulated stablecoins (RLUSD, USDC) are expected to keep freeze, clawback and multisig control, so those are reported as information, not warnings. The score (0–100) is a rough guide only. Not financial advice. These are ledger facts at the time of the check.

Built by

Zach Riehn (Launch Lab, XRPL tools for people and AI agents). Launch Lab also runs a pay-per-call x402 API (XRP/RLUSD on XRPL, USDC on Base) for deeper wallet and token reports. Token Guard is the free, open core.

MIT licensed.