Address Intel API

x402-powered paid API that returns counterparty risk checks for any EVM address: confirmed malicious-history flags, tiered risk scoring, and plain-language summaries.

Production: https://address-intel-api.tatsu77.workers.dev

Why

Agents (and humans) transact with addresses they've never seen. This API answers "is it safe to pay this address?" in one call, priced for machine consumption ($0.005 USDC via x402). Data: GoPlus Security address_security (sources include SlowMist, BlockSec).

Related MCP server: crest-verify

API

GET /api/v1/address/{address}?chainId={optional}

Payment: $0.005 USDC via x402 v2 on Base mainnet. Sign the requirements from the 402 response's PAYMENT-REQUIRED header and retry with the PAYMENT-SIGNATURE header. A wallet that paid can re-read the same address check free for 1 hour via SIGN-IN-WITH-X (matches the cache TTL, so sessions only re-serve data the wallet already bought).

Response (200):

{
  "address": "0x098b716b8aaf21512996dc57eb0615e2383e2f96",
  "chain_id": null,
  "is_contract": false,
  "risk_score": 0,
  "risk_level": "CRITICAL",
  "flags": { "sanctioned": true, "stealing_attack": true, "...": "18 signals total" },
  "adverse_findings": ["Sanctioned address", "Involved in stealing attacks"],
  "summary": "CRITICAL risk. This address has confirmed malicious history — do not transact. ...",
  "data_source": "SlowMist,BlockSec",
  "cached": false,
  "data_age_seconds": 0
}

Risk levels (tiered, not deduction-based — one confirmed malicious flag is disqualifying):

Errors: 400 invalid input / 402 payment required / 404 no data / 429 upstream throttled / 503 upstream down. Failed requests are never charged (payment cancels instead of settling).

MCP: POST /mcp (streamable HTTP)

Paid tool check_address ($0.005) with in-protocol x402 payment — x402-aware MCP clients (@x402/mcp) pay automatically via params._meta["x402/payment"]. initialize and tools/list are free.

Free discovery

GET /.well-known/x402 (2 resources: http + mcp) / GET /openapi.json / GET /llms.txt / GET /health

Development

npm install
npm run dev          # local dev (uses .dev.vars)
npm run typecheck
npx wrangler deploy --env production   # mainnet (requires secrets below)

Environment

Architecture

Cloudflare Workers (Hono)
  ├── x402 v2 Payment Middleware (@x402/hono, memoized per isolate)
  ├── Paid MCP tool (@x402/mcp createPaymentWrapper)
  ├── SIWx sessions (KV, 1h, nonce replay protection)
  ├── Bazaar Discovery (serviceName/tags + schemas, manifest = middleware)
  ├── Cache (Cloudflare KV, 1h TTL — address reputation moves slowly)
  └── GoPlus address_security → tiered scoring → template summary

Sibling services sharing this architecture: token-intel-api (EVM token security), polymarket-scan-api (Polymarket liquidity anomalies).

License

MIT