ScytheRadar MCP
OfficialSupports risk screening, blacklist checks, and fund-flow tracing for Ethereum wallet addresses through ScytheRadar's read-only on-chain intelligence tools.
Provides blacklist coverage for Solana addresses, enabling checks against relevant sanctions, phishing, and freeze-related risk data.
Enables blacklist hit checks against Tether's official freeze list of 9,000+ addresses, helping assess dirty-USDT exposure.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@ScytheRadar MCPCheck if this TRON wallet is safe to receive USDT: TQn9Y2khEsLJW1ChVWFMSMeRDow5KcbLSE"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
ScytheRadar MCP
On-chain risk intelligence for AI agents — read-only, bilingual (中文/English), and built for the Chinese-speaking agent ecosystem first. Screen wallets, check blacklists, and trace fund flows, with rug-pull forensics no other crypto MCP ships.
Read-only by design. No private keys, no signing, no transaction execution. The worst case is a wrong answer; your funds are never at risk.
Why ScytheRadar (vs the 15+ crypto-AML MCPs)
We win where they don't | The gap we fill |
🀄 Chinese agent ecosystem first | First mover for Coze / Dify / Chinese Claude & Cursor users — bilingual tool descriptions and docs. Every competitor is English-only. |
🪦 Rug-pull forensics (death files) | 87+ rug-pull case files with autopsy reports, timelines, and scam-contract code breakdowns — not just a score, a case file. |
💧 TRON 脏U (dirty-USDT) focus | Tether's official freeze list (9,000+ addresses) + OFAC multi-chain sanctions — built for Asia's P2P/OTC "should I accept this USDT" reality. |
💰 Cheap, read-only, keyless trial | 6 free calls/day, no signup; paid plans from a few USDT. Built for retail users and small merchants, not banks. |
Related MCP server: crypto-inspector-mcp
Tools
Tool | What it does |
| Risk-screen a wallet address (0-100 score / level / verdict / risk flags) |
| Blacklist hit check (Tether freezes / OFAC sanctions / phishing) |
| Fund tracing (flow / hops / aggregation / suspected laundering path) |
Language
Tool descriptions are bilingual (中文 / English), so Chinese-language agents (Coze, Dify, 文心, Kimi) call the right tool just as reliably as English ones. 工具描述中英双语,中文 agent 同样能精准调用。
Quick start
1. Get an API key
Grab a free key at https://scytheradar.com/b2b. Without a key you get a limited trial (6 calls/day); with a key you unlock full coverage.
2. Claude Desktop
Add to your Claude Desktop MCP config:
{
"mcpServers": {
"scytheradar": {
"command": "npx",
"args": ["-y", "scytheradar-mcp"],
"env": {
"SCYTHERADAR_API_KEY": "your-key"
}
}
}
}3. Cursor
Cursor Settings → MCP → Add new MCP server, command npx -y scytheradar-mcp, env SCYTHERADAR_API_KEY.
4. Run locally
export SCYTHERADAR_API_KEY=your-key
npx -y scytheradar-mcpEnvironment variables
Variable | Description |
| API key (required for paid endpoints) |
| API base URL, defaults to |
Coverage
Chains: BSC / Ethereum / Base / Arbitrum / TRON (blacklist also covers BTC / LTC / ZEC / XMR / Solana)
Data: 9,000+ Tether freeze addresses · 495 OFAC sanctions (multi-chain) · phishing database · 87+ rug-pull death files (autopsy + timeline)
Disclaimer
Research use only. Not investment advice.
Available Tools
3 toolscheck_blacklistA
Check whether an address or transaction hash matches a blacklist (Tether freezes / OFAC sanctions / phishing scams). Returns match type, source, and evidence. TRON coverage includes 9,000+ Tether freeze addresses plus a multi-chain OFAC list. Use to judge whether funds are tainted or safe to receive. 中文:检测地址或交易哈希是否命中黑名单(Tether 冻结 / OFAC 制裁 / 钓鱼诈骗),返回命中类型、来源与证据。TRON 覆盖 9000+ Tether 冻结地址 + OFAC 多链制裁。用于判断资金是否涉黑、能否安全接收。
| Name | Required | Description | Default |
|---|---|---|---|
| chain | No | Chain. Defaults to auto-detect. Options: bsc / ethereum / base / arbitrum / tron. 中文:链,默认 auto 自动识别,可选 bsc / ethereum / base / arbitrum / tron | |
| txhash | No | Transaction hash. Use either this or address | |
| address | No | Address to check (0x- or T-prefixed). Use either this or txhash |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does meaningful work: it discloses the return fields (match type, source, evidence) and the underlying data sources and coverage (9,000+ Tether freeze addresses, multi-chain OFAC on TRON). It omits cost/rate-limit and what a no-match response looks like, leaving a gap for a mutation-free lookup that agents may call in bulk.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The English block is tight and front-loaded, with purpose first and usage second. However the full Chinese translation approximately doubles the token cost without adding new information, and the lead sentence buries the output contract behind the resource list.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description correctly compensates by enumerating return fields and data sources. The remaining gap is that the schema marks zero required parameters and has no oneOf, yet the description never states that at least one of address or txhash must be supplied.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so chain/address/txhash are already documented with enums and formats; baseline applies. The prose only restates that address or txhash is the input and adds nothing about the 'auto' chain detection behavior or what happens if both are supplied.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource with scope: it checks an address or txhash against named blacklist categories (Tether freezes, OFAC, phishing) and says what comes back. It does not, however, distinguish itself from the sibling screen_address, which plausibly does something very similar — an agent must guess which to pick.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Use to judge whether funds are tainted or safe to receive" gives a decision context, which is better than nothing. But there is no explicit when-not, no prerequisite (e.g., need at least one of address/txhash), and no routing guidance versus screen_address or trace_funds.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
screen_addressA
Screen a wallet address for on-chain risk. Returns a 0-100 risk score, risk level, verdict, and matched risk flags (honeypot / mintable / owner-not-renounced / blacklist, etc). Supports EVM (0x...) and TRON (T...) addresses. Use before receiving funds, interacting with a contract, or investing. 中文:筛查链上地址风险,返回 0-100 风险分、风险等级、判定结论与命中的风险标记(蜜罐/可增发/Owner未放弃/黑名单等)。支持 EVM(0x…) 与 TRON(T…) 地址。收款、交互、投资前使用。
| Name | Required | Description | Default |
|---|---|---|---|
| chain | No | Chain. Defaults to auto-detect. Options: bsc / ethereum / base / arbitrum / tron. 中文:链,默认 auto 自动识别,可选 bsc / ethereum / base / arbitrum / tron | |
| address | Yes | Address to screen, 0x-prefixed (EVM) or T-prefixed (TRON) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It does disclose the return payload shape (score, level, verdict, matched flags) and accepted address formats, which is genuinely useful. But it says nothing about rate limits, latency, permission requirements, or behavior on malformed/unsupported addresses, so important operational traits remain unknown.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The English portion is front-loaded and efficient, leading with the action and the return values. But the entire description is then repeated verbatim in Chinese, roughly doubling length and token cost without adding information; a single bilingual sentence or a shorter note would have earned the same coverage.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, yet the description adequately covers return values, supported chains, and address formats, so an agent knows what comes back. It is only slightly short on error handling and the distinction from sibling risk tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both the address format and the chain enum (auto/bsc/ethereum/base/arbitrum/tron) are already documented. The description only restates the accepted address prefixes, adding no extra semantics such as what 'auto' detection does when it fails or which chains are ambiguous.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Screen a wallet address for on-chain risk') and enumerates concrete outputs (0-100 score, risk level, verdict, risk flags) plus supported networks. It does not explicitly differentiate from siblings check_blacklist or trace_funds, though the broader scope is implied by the multi-flag output.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear usage contexts — 'before receiving funds, interacting with a contract, or investing' — which tells an agent when the tool is appropriate. However, it never states when NOT to use it or why one would pick it over the overlapping sibling check_blacklist, leaving the boundary to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
trace_fundsA
Trace the flow of funds from an address or transaction, layer by layer. Returns fund exposure, hop addresses, final aggregation, and suspected laundering paths. Supports deep mode (slower but more complete). Use for tracing stolen funds or checking whether an incoming deposit passed through a mixer or sanctioned address. 中文:逐层溯源资金流向,返回资金暴露面、跳板地址、最终归集与疑似洗钱路径。支持 deep 深度模式。用于追赃、判断入账是否经过混币器或制裁地址。
| Name | Required | Description | Default |
|---|---|---|---|
| deep | No | Deep trace, default false | |
| chain | No | Chain. Defaults to auto-detect. Options: bsc / ethereum / base / arbitrum / tron. 中文:链,默认 auto 自动识别,可选 bsc / ethereum / base / arbitrum / tron | |
| target | No | Trace target address (equivalent to address, use either) | |
| address | No | Source address or transaction hash |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden and does reasonably well: it discloses the return categories, that a trace proceeds layer by layer, and that deep mode is slower but more complete (a latency/cost signal). It never explicitly says the operation is read-only or whether the target address is logged, and gives no sense of runtime limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose and outputs are front-loaded in the first two sentences, and the deep-mode caveat comes before the usage examples, which is good ordering. The full Chinese mirror roughly doubles the length, which is defensible localization but not free — no sentence is otherwise wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema, and the description compensates by enumerating the return fields (exposure, hops, aggregation, laundering paths). All four parameters are documented in the schema, the mode tradeoff is stated, and the use cases are given — nothing an agent needs in order to call this correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds only one piece of meaning beyond the schema — that deep mode trades speed for completeness — while the ambiguous target-vs-address duplication and the auto-detect chain default are left to the schema's own text.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("trace the flow of funds from an address or transaction, layer by layer") and enumerates what the trace yields (fund exposure, hop addresses, final aggregation, suspected laundering paths), which is far more concrete than the sibling names screen_address/check_blacklist. It stops short of naming how it differs from those siblings, even though the phrase "checking whether an incoming deposit passed through a mixer or sanctioned address" overlaps with what check_blacklist appears to do.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit use cases — "tracing stolen funds" and "checking whether an incoming deposit passed through a mixer or sanctioned address" — plus a mode tradeoff ("deep mode (slower but more complete)"). No when-not guidance or named alternative is offered, so the agent must infer that a pure blacklist lookup should go to check_blacklist instead.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
v0.1.0- First observed
check_blacklist - First observed
screen_address - First observed
trace_funds
TDQS
Scored across 3 tools
Each tool has a distinct primary action: risk scoring, blacklist matching, and fund tracing. However, screen_address and check_blacklist overlap somewhat because both assess address safety and may surface related risk flags, which could cause occasional misselection.
All three tools follow a clear verb_noun pattern: screen_address, check_blacklist, trace_funds. The convention is consistent and immediately readable.
Three tightly scoped tools fit the focused purpose of on-chain risk screening and tracing. Each tool earns its place without redundant surface area.
The set covers core workflows: risk screening, blacklist checks, and layered fund tracing. Minor gaps exist, such as batch screening or broader contract-audit operations, but the primary domain is well covered.
Maintenance
Related MCP Connectors
Token rug-risk scans, Know Your Agent wallet checks and deployer reputation for AI agents.
Crypto address risk checks for agents: USDT/USDC blacklists, sanctions, scam lists, poisoning
Crypto security, honeypot detection, wallet analysis, and token risk scoring across 31 blockchains.
Solana address risk grades and token scans for AI agents. Pay-per-call via x402 (USDC on Base).
Related MCP Servers
- AlicenseBqualityCmaintenanceProvides on-chain forensic checks for evaluating transaction risks, including token verification, rug-pull detection, and fund tracing, using public blockchain endpoints.1251 npmMIT
- AlicenseBqualityCmaintenanceEnables AI agents to perform token security audits, honeypot detection, liquidity analysis, and risk scoring to avoid crypto scams.1ISC

traql MCP serverofficial
AlicenseAqualityAmaintenanceEnables AI agents to perform AML and compliance risk scoring for crypto addresses and transactions on Ethereum, BSC, TRON, TON, and Bitcoin, returning 0–100 risk scores, bands, flags, and detailed signals.257 npmMIT- AlicenseAqualityBmaintenanceEnables AI assistants to assess the risk of crypto wallets, tokens, and smart contracts by providing read-only on-chain analysis, 0-100 risk scoring with explanations, fund tracing, and contract inspection before interaction.6MIT