Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@XRPL Token Guard Is this RLUSD token the real one or a scam?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Ask your AI agent, or your voice assistant, "is this token safe?" and get an honest answer with reasons.
XRPL Token Guard is an open-source MCP server. It checks XRP Ledger tokens and wallets using live, read-only mainnet data, and returns three things:
a verdict: High risk / Caution / No red flags found / Not enough data
the reasons behind it, each naming the exact ledger fact
a one-sentence spoken summary, ready for text-to-speech on Alexa+ or any other voice assistant
It never signs, never sends a transaction and never asks for keys.
Try the free hosted demo or browse the free token evidence pages. Launch Lab offers a Token Report for 5 XRP, a Wallet Checkup for 3 XRP, and a Token Launch Kit for 10 XRP. Preview the findings before choosing a paid report. These are factual ledger checks, not buy/sell advice or a guarantee of safety; Token Guard stays free.
Hosted MCP: https://cocoeatsai.com/area4/guard/mcp (Streamable HTTP). The hosted demo supports typed questions and example buttons; microphone input is currently disabled by the hosting policy. It is a voice-assistant simulator, not an actual Alexa integration.
For Claude Desktop (claude_desktop_config.json) or Cursor (.cursor/mcp.json), build a local clone using the commands below, then replace the absolute path in this configuration:
{"mcpServers": {
"xrpl-token-guard": {"command": "node", "args": ["/absolute/path/to/xrpl-token-guard/dist/stdio.js"]}
}}Example risk interpretation (not a trading recommendation):
You: "Is this RLUSD real?"
Guard: "Warning, high risk. This token calls itself RLUSD, but it is not the real Ripple USD.
The real one comes from a different issuer. A matching name does not establish authenticity."Related MCP server: verdix
Scammers on the XRP Ledger copy famous names. On mainnet today there are several tokens called RLUSD that aren't Ripple's. Many of them have a black-holed issuer, which naive checkers score as "safe" because nobody can mint more. Token Guard knows the official issuers and flags the copy first. It explains that a locked supply doesn't make an imitation genuine.
Answers have to be short enough to speak and specific enough to trust. Every finding carries both a precise message (for screens and agents) and a spoken line (for voice).
Tool | What it answers | Ledger calls |
| "Is this token safe?" Checks for: imitations of RLUSD/USDC/SOLO, issuers that can still mint, freeze or claw back, Global Freeze, transfer fees, unverified or launchpad-only domains, whale concentration (AMM pool excluded), thin AMM liquidity, brand-new issuers. |
|
| "Is this the real RLUSD?" Answers instantly from verified official issuers (each issuer's on-ledger Domain points at the brand's own site). | none |
| "Was my wallet hacked?" Finds a stranger's regular key or multisig signer list (the classic drainer setup), and marks changes from the last 7 days as urgent. |
|
There's also a prompt, voice_token_check, that tells a voice assistant how to answer: two sentences, the verdict and the main reason, no buy/sell advice.
Every tool has:
readOnlyHint: true
an outputSchema, with typed structuredContent in each response
a human-readable text block
Tickers are resolved case-insensitively against the issuer's real obligations, so asking for "bigds" finds $BIGDS.
npm install
npm run build
npm start # Streamable HTTP on http://127.0.0.1:8787/mcp, voice demo on http://127.0.0.1:8787/
npm run stdio # stdio transport for Claude Desktop / Claude Code / Cursor
npm test # 14 unit + end-to-end MCP tests (LIVE=1 adds a mainnet check)Transport: Streamable HTTP, MCP protocol 2025-11-25.
Stateless: every POST /mcp gets a fresh server, so it scales horizontally.
JSON responses.
Rate limit: 60 requests per minute per IP.
Origin allow-list via ALLOWED_ORIGINS.
GET /health reports the transport and protocol.
Docker:
# Web demo + Streamable HTTP (default target)
docker build -t xrpl-token-guard .
docker run --rm -p 8787:8787 xrpl-token-guard
# stdio MCP clients / Glama: keep stdin open; do not allocate a TTY
docker build --target stdio -t xrpl-token-guard:stdio .
docker run --rm -i xrpl-token-guard:stdioFor a Glama build spec that uses the default image, set CMD arguments to node dist/stdio.js. No API keys or wallet credentials are required.
Claude Desktop (claude_desktop_config.json):
{ "mcpServers": { "xrpl-token-guard": { "command": "node", "args": ["/path/to/xrpl-token-guard/dist/stdio.js"] } } }Env | Default | Meaning |
|
| Public XRPL JSON-RPC endpoints, tried in order |
|
| Bind address |
| (any) | Comma-separated Origin allow-list for |
|
| Adds a link to a free ledger-evidence page for the token when one exists; |
Open http://127.0.0.1:8787/ and tap the mic (Chrome), or type.
The page is a small MCP client that speaks Streamable HTTP to /mcp. It turns the question into a tool call and reads spoken_summary aloud.
The right-hand panel shows the live tools/call request and result.
/?demo=1 plays a scripted run with captions, for screen recording.
Severity | Examples | Effect |
⛔ high | impersonation of an official token, Global Freeze on, clawback enabled, issuer doesn't exist, nothing issued | verdict High risk |
⚠️ caution | issuer can mint / freeze, >1% transfer fee, one wallet >50% or top 10 >80% (AMM pool excluded), fewer than 25 holders, under 500 XRP of AMM liquidity, issuer under 14 days old, domain doesn't list the issuer | verdict Caution |
✅ good / ℹ️ info | official issuer, black-holed supply, verified domain, deep liquidity | context only |
Regulated stablecoins may retain issuer controls. Official identity remains separate from the control-policy verdict: clawback is a hard failure, even for an official issuer. The score (0–100) is a rough guide only. Not financial advice. These are ledger facts at the time of the check.
Zach Riehn (Launch Lab, XRPL tools for people and AI agents). Launch Lab also runs a pay-per-call x402 API (XRP/RLUSD on XRPL, USDC on Base) for deeper wallet and token reports. Token Guard is the free, open core.
MIT licensed.
The freeze-control condition passes when NoFreeze is set OR master is disabled, RegularKey is exactly rrrrrrrrrrrrrrrrrrrrBZbvji, and no signer list exists. Clawback permission is a hard failure for every issuer, including regulated stablecoins; Global Freeze already active is also a failure. The MCP structured output reports freeze_control_pass, issuer_controls_pass and the exact rule. A missing regular key is not the requested blackhole proof. NoFreeze alone does not prevent minting or enabling Global Freeze. Identity, concentration and other checks still apply. Scores are mechanical, not probabilities of safety.
Live safety check of an XRP Ledger token (issued currency). Detects fake look-alikes of famous tokens (e.g. a fake RLUSD), issuers that can still mint, freeze or claw back, global freezes, transfer fees, unverified domains, whale concentration, thin AMM liquidity and brand-new issuers. Returns a verdict (High risk / Caution / No red flags found / Not enough data), the reasons behind it with the exact ledger facts, and a one-sentence spoken summary.
| Name | Required | Description | Default |
|---|---|---|---|
| issuer | Yes | The token issuer's XRPL address (starts with r). | |
| currency | Yes | Token ticker as shown in wallets (e.g. RLUSD, SOLO) or its 40-character hex currency code. |
| Name | Required | Description |
|---|---|---|
| facts | Yes | |
| score | Yes | 0-100 mechanical score; not a safety probability. Clawback is a high-risk control-policy failure. |
| token | Yes | |
| reasons | Yes | The top reasons behind the verdict, most important first. |
| verdict | Yes | |
| findings | Yes | |
| checked_at | Yes | |
| disclaimer | Yes | |
| ledger_index | Yes | |
| more_info_url | Yes | |
| verdict_label | Yes | |
| spoken_summary | Yes | One or two sentences ready for text-to-speech. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnly, idempotent, non-destructive, openWorld), and the description goes further by disclosing the detection surface (mint/freeze/clawback capability, global freezes, transfer fees, unverified domains, whale concentration, AMM liquidity, brand-new issuers). Some of this is return-shape information that the existing output schema may already carry, which keeps it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose, then a dense but well-ordered enumeration of detections, then the return summary. Slightly long for two sentences, but every clause adds a distinct fact rather than filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex analysis tool, the description names the input domain, the detection surface, and the verdict vocabulary an agent will see. With an output schema present and annotations covering safety traits, nothing essential to correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and both parameters are documented there (issuer format, currency ticker-or-hex). The description adds no parameter-level detail such as issuer/currency consistency or hex-encoding rules, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb and resource: 'Live safety check of an XRP Ledger token (issued currency)', plus an enumerated list of what it detects (fake look-alikes, mint/freeze/clawback issuers, thin AMM liquidity). It does not name or contrast itself with the sibling is_it_the_real_token, which overlaps on the 'fake token' detection ground, so differentiation is left to inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied by the phrase 'Live safety check' – an agent can infer this is a pre-trade/pre-interaction screening step. There is no explicit when-to-use, no when-not-to-use, and no routing to check_wallet_security or is_it_the_real_token despite clear topical overlap with the latter.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Checks whether anyone besides the owner can sign for an XRPL wallet: an unexpected regular key or multisig signer list (the classic drainer setup), and flags changes made in the last 7 days as urgent. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| address | Yes | The wallet's XRPL address (starts with r). |
| Name | Required | Description |
|---|---|---|
| facts | Yes | |
| address | Yes | |
| verdict | Yes | |
| findings | Yes | |
| checked_at | Yes | |
| disclaimer | Yes | |
| verdict_label | Yes | |
| spoken_summary | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, destructiveHint=false and idempotentHint, so the 'Read-only' clause is largely redundant. However, the description adds real behavioral context beyond the structured fields: the specific detection heuristic (unexpected regular key / multisig signer list) and the urgency rule that changes in the last 7 days are flagged urgent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One dense sentence with zero filler: it leads with the core check, names the concrete threat pattern, and ends with the urgency rule and read-only status. Nothing could be removed without losing information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values need not be explained, and the description covers what is inspected and how findings are prioritized. It stops short of stating anything about failure modes (e.g., invalid address, network errors) or result interpretation, which would round it out.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is a single address parameter with 100% schema description coverage, so the schema already documents format and constraints. The description adds no extra parameter meaning, which is the correct baseline when the schema does the work.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (checks whether anyone besides the owner can sign for an XRPL wallet) and enumerates the exact signals it inspects: unexpected regular key or multisig signer list. The wallet-focused scope cleanly separates it from the token-oriented siblings check_token_safety and is_it_the_real_token.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes the use case implied (detecting takeover/drainer setups) but never says when to call this versus the sibling token-checking tools, nor any prerequisites or exclusions. Usage is inferable but not stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Answers "is this the real RLUSD / USDC / SOLO?" using the verified official issuers (RLUSD: rMxCKbEDwqr76QuheSUMdEGf4B9xJ8m5De; USDC: rGm7WCVp9gb4jZHWTEtGUr4dd74z2XuWhE; SOLO: rsoLo2S1kiGeCcn6hCUXVrCpGMWLrRrLZz). Give the ticker alone to learn the official issuer, or ticker + issuer to confirm or expose an imitation. Instant, no ledger call.
| Name | Required | Description | Default |
|---|---|---|---|
| issuer | No | Optional issuer address to verify. | |
| ticker | Yes | The token name or ticker the user mentioned, e.g. RLUSD. |
| Name | Required | Description |
|---|---|---|
| ticker | Yes | |
| message | Yes | |
| official | Yes | |
| is_official | Yes | |
| known_brand | Yes | |
| spoken_summary | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive, closed-world behavior, so the bar is lower. The description still adds real value: 'Instant, no ledger call' discloses the lookup is against a hardcoded issuer list rather than a live ledger query, which explains latency and failure modes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Opens with the question it answers, then gives the issuer list and the two usage modes. The inline addresses make the sentence dense, but they are load-bearing reference data and the overall text is front-loaded with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described, and both call modes are covered. The one omission is scope: it does not say the verified list is limited to RLUSD/USDC/SOLO, so an agent could wrongly assume it validates arbitrary tokens.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so a 3 is the baseline, but the description goes beyond the schema by explaining the interaction between the two parameters: omitting issuer yields the official issuer, while supplying it turns the call into a confirmation/imitation check. That is semantic meaning the schema's 'Optional issuer address to verify' does not convey.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific question it answers ('is this the real RLUSD / USDC / SOLO?') and names the verification basis (verified official issuers). This is clearly distinct from the siblings check_token_safety and check_wallet_security, which address safety/security rather than issuer authenticity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit invocation modes: 'Give the ticker alone to learn the official issuer, or ticker + issuer to confirm or expose an imitation.' That is clear when-and-how guidance for the two call shapes, though it never states when to prefer a sibling tool over this one.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
check_token_safetycheck_wallet_securityis_it_the_real_tokenScored across 3 tools
The three tools target distinct objects: issued tokens, official token identity, and wallet signing authority. There is some overlap between check_token_safety and is_it_the_real_token regarding fake tokens, but the descriptions make the boundary clear: one is an instant official-issuer lookup, the other is a live ledger risk assessment.
Two tools follow a consistent check_* pattern (check_token_safety, check_wallet_security), but is_it_the_real_token breaks the verb_noun convention and is phrased as a question. The set is still readable, but the naming convention is mixed.
Three tools is a narrow but defensible surface for a focused safety-checking server; each tool covers a distinct safety question. It is on the thin side, but not trivially so.
The core workflows are covered: token risk screening, official issuer verification, and wallet signer checks. Minor gaps remain, such as checking trustlines/balances or broader issuer history, but agents can work around these for the stated purpose.
XRPL token rug-checks, issuer reputation & AMM data for AI agents. Pay-per-call USDC via x402.
XRPL wallet scores, wallet permissions, batch send, MPT risk, screening, pre-checks. Never signs.
Wallet trust scores for AI agents. Stellar, XRPL, EVM 81+ chains. OFAC sanctions. x402 payments. Multi-chain wallet trust scoring for AI agents. Score Stellar, XRPL, and EVM wallets across 81+ chains with real-time OFAC/UN/EU sanctions screening. Pay per query via x402 USDC micropayments on Stellar or Base — no accounts, no API keys required.
Smart-contract risk reports for AI agents on 20 EVM chains, paid per call via x402 ($0.02 USDC).
