Skip to main content
Glama
onchainvanguard

ScytheRadar MCP

Official

ScytheRadar MCP

On-chain risk intelligence for AI agents — read-only, bilingual (中文/English), and built for the Chinese-speaking agent ecosystem first. Screen wallets, check blacklists, and trace fund flows, with rug-pull forensics no other crypto MCP ships.

Read-only by design. No private keys, no signing, no transaction execution. The worst case is a wrong answer; your funds are never at risk.

Why ScytheRadar (vs the 15+ crypto-AML MCPs)

We win where they don't

The gap we fill

🀄 Chinese agent ecosystem first

First mover for Coze / Dify / Chinese Claude & Cursor users — bilingual tool descriptions and docs. Every competitor is English-only.

🪦 Rug-pull forensics (death files)

87+ rug-pull case files with autopsy reports, timelines, and scam-contract code breakdowns — not just a score, a case file.

💧 TRON 脏U (dirty-USDT) focus

Tether's official freeze list (9,000+ addresses) + OFAC multi-chain sanctions — built for Asia's P2P/OTC "should I accept this USDT" reality.

💰 Cheap, read-only, keyless trial

6 free calls/day, no signup; paid plans from a few USDT. Built for retail users and small merchants, not banks.

Related MCP server: crypto-inspector-mcp

Tools

Tool

What it does

screen_address

Risk-screen a wallet address (0-100 score / level / verdict / risk flags)

check_blacklist

Blacklist hit check (Tether freezes / OFAC sanctions / phishing)

trace_funds

Fund tracing (flow / hops / aggregation / suspected laundering path)

Language

Tool descriptions are bilingual (中文 / English), so Chinese-language agents (Coze, Dify, 文心, Kimi) call the right tool just as reliably as English ones. 工具描述中英双语,中文 agent 同样能精准调用。

Quick start

1. Get an API key

Grab a free key at https://scytheradar.com/b2b. Without a key you get a limited trial (6 calls/day); with a key you unlock full coverage.

2. Claude Desktop

Add to your Claude Desktop MCP config:

{
  "mcpServers": {
    "scytheradar": {
      "command": "npx",
      "args": ["-y", "scytheradar-mcp"],
      "env": {
        "SCYTHERADAR_API_KEY": "your-key"
      }
    }
  }
}

3. Cursor

Cursor Settings → MCP → Add new MCP server, command npx -y scytheradar-mcp, env SCYTHERADAR_API_KEY.

4. Run locally

export SCYTHERADAR_API_KEY=your-key
npx -y scytheradar-mcp

Environment variables

Variable

Description

SCYTHERADAR_API_KEY

API key (required for paid endpoints)

SCYTHERADAR_BASE

API base URL, defaults to https://scytheradar.com

Coverage

  • Chains: BSC / Ethereum / Base / Arbitrum / TRON (blacklist also covers BTC / LTC / ZEC / XMR / Solana)

  • Data: 9,000+ Tether freeze addresses · 495 OFAC sanctions (multi-chain) · phishing database · 87+ rug-pull death files (autopsy + timeline)

Disclaimer

Research use only. Not investment advice.

Available Tools

3 tools
check_blacklistA

Check whether an address or transaction hash matches a blacklist (Tether freezes / OFAC sanctions / phishing scams). Returns match type, source, and evidence. TRON coverage includes 9,000+ Tether freeze addresses plus a multi-chain OFAC list. Use to judge whether funds are tainted or safe to receive. 中文:检测地址或交易哈希是否命中黑名单(Tether 冻结 / OFAC 制裁 / 钓鱼诈骗),返回命中类型、来源与证据。TRON 覆盖 9000+ Tether 冻结地址 + OFAC 多链制裁。用于判断资金是否涉黑、能否安全接收。

NameRequiredDescriptionDefault
chainNoChain. Defaults to auto-detect. Options: bsc / ethereum / base / arbitrum / tron. 中文:链,默认 auto 自动识别,可选 bsc / ethereum / base / arbitrum / tron
txhashNoTransaction hash. Use either this or address
addressNoAddress to check (0x- or T-prefixed). Use either this or txhash

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does meaningful work: it discloses the return fields (match type, source, evidence) and the underlying data sources and coverage (9,000+ Tether freeze addresses, multi-chain OFAC on TRON). It omits cost/rate-limit and what a no-match response looks like, leaving a gap for a mutation-free lookup that agents may call in bulk.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The English block is tight and front-loaded, with purpose first and usage second. However the full Chinese translation approximately doubles the token cost without adding new information, and the lead sentence buries the output contract behind the resource list.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description correctly compensates by enumerating return fields and data sources. The remaining gap is that the schema marks zero required parameters and has no oneOf, yet the description never states that at least one of address or txhash must be supplied.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so chain/address/txhash are already documented with enums and formats; baseline applies. The prose only restates that address or txhash is the input and adds nothing about the 'auto' chain detection behavior or what happens if both are supplied.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb+resource with scope: it checks an address or txhash against named blacklist categories (Tether freezes, OFAC, phishing) and says what comes back. It does not, however, distinguish itself from the sibling screen_address, which plausibly does something very similar — an agent must guess which to pick.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Use to judge whether funds are tainted or safe to receive" gives a decision context, which is better than nothing. But there is no explicit when-not, no prerequisite (e.g., need at least one of address/txhash), and no routing guidance versus screen_address or trace_funds.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

screen_addressA

Screen a wallet address for on-chain risk. Returns a 0-100 risk score, risk level, verdict, and matched risk flags (honeypot / mintable / owner-not-renounced / blacklist, etc). Supports EVM (0x...) and TRON (T...) addresses. Use before receiving funds, interacting with a contract, or investing. 中文:筛查链上地址风险,返回 0-100 风险分、风险等级、判定结论与命中的风险标记(蜜罐/可增发/Owner未放弃/黑名单等)。支持 EVM(0x…) 与 TRON(T…) 地址。收款、交互、投资前使用。

NameRequiredDescriptionDefault
chainNoChain. Defaults to auto-detect. Options: bsc / ethereum / base / arbitrum / tron. 中文:链,默认 auto 自动识别,可选 bsc / ethereum / base / arbitrum / tron
addressYesAddress to screen, 0x-prefixed (EVM) or T-prefixed (TRON)

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It does disclose the return payload shape (score, level, verdict, matched flags) and accepted address formats, which is genuinely useful. But it says nothing about rate limits, latency, permission requirements, or behavior on malformed/unsupported addresses, so important operational traits remain unknown.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The English portion is front-loaded and efficient, leading with the action and the return values. But the entire description is then repeated verbatim in Chinese, roughly doubling length and token cost without adding information; a single bilingual sentence or a shorter note would have earned the same coverage.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, yet the description adequately covers return values, supported chains, and address formats, so an agent knows what comes back. It is only slightly short on error handling and the distinction from sibling risk tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both the address format and the chain enum (auto/bsc/ethereum/base/arbitrum/tron) are already documented. The description only restates the accepted address prefixes, adding no extra semantics such as what 'auto' detection does when it fails or which chains are ambiguous.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Screen a wallet address for on-chain risk') and enumerates concrete outputs (0-100 score, risk level, verdict, risk flags) plus supported networks. It does not explicitly differentiate from siblings check_blacklist or trace_funds, though the broader scope is implied by the multi-flag output.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear usage contexts — 'before receiving funds, interacting with a contract, or investing' — which tells an agent when the tool is appropriate. However, it never states when NOT to use it or why one would pick it over the overlapping sibling check_blacklist, leaving the boundary to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

trace_fundsA

Trace the flow of funds from an address or transaction, layer by layer. Returns fund exposure, hop addresses, final aggregation, and suspected laundering paths. Supports deep mode (slower but more complete). Use for tracing stolen funds or checking whether an incoming deposit passed through a mixer or sanctioned address. 中文:逐层溯源资金流向,返回资金暴露面、跳板地址、最终归集与疑似洗钱路径。支持 deep 深度模式。用于追赃、判断入账是否经过混币器或制裁地址。

NameRequiredDescriptionDefault
deepNoDeep trace, default false
chainNoChain. Defaults to auto-detect. Options: bsc / ethereum / base / arbitrum / tron. 中文:链,默认 auto 自动识别,可选 bsc / ethereum / base / arbitrum / tron
targetNoTrace target address (equivalent to address, use either)
addressNoSource address or transaction hash

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden and does reasonably well: it discloses the return categories, that a trace proceeds layer by layer, and that deep mode is slower but more complete (a latency/cost signal). It never explicitly says the operation is read-only or whether the target address is logged, and gives no sense of runtime limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and outputs are front-loaded in the first two sentences, and the deep-mode caveat comes before the usage examples, which is good ordering. The full Chinese mirror roughly doubles the length, which is defensible localization but not free — no sentence is otherwise wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no output schema, and the description compensates by enumerating the return fields (exposure, hops, aggregation, laundering paths). All four parameters are documented in the schema, the mode tradeoff is stated, and the use cases are given — nothing an agent needs in order to call this correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds only one piece of meaning beyond the schema — that deep mode trades speed for completeness — while the ambiguous target-vs-address duplication and the auto-detect chain default are left to the schema's own text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("trace the flow of funds from an address or transaction, layer by layer") and enumerates what the trace yields (fund exposure, hop addresses, final aggregation, suspected laundering paths), which is far more concrete than the sibling names screen_address/check_blacklist. It stops short of naming how it differs from those siblings, even though the phrase "checking whether an incoming deposit passed through a mixer or sanctioned address" overlaps with what check_blacklist appears to do.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit use cases — "tracing stolen funds" and "checking whether an incoming deposit passed through a mixer or sanctioned address" — plus a mode tradeoff ("deep mode (slower but more complete)"). No when-not guidance or named alternative is offered, so the agent must infer that a pure blacklist lookup should go to check_blacklist instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 3 tool updatesv0.1.0
    • First observedcheck_blacklist
    • First observedscreen_address
    • First observedtrace_funds

TDQS

A3.9/5.0

Scored across 3 tools

Disambiguation4/5

Each tool has a distinct primary action: risk scoring, blacklist matching, and fund tracing. However, screen_address and check_blacklist overlap somewhat because both assess address safety and may surface related risk flags, which could cause occasional misselection.

Naming Consistency5/5

All three tools follow a clear verb_noun pattern: screen_address, check_blacklist, trace_funds. The convention is consistent and immediately readable.

Tool Count5/5

Three tightly scoped tools fit the focused purpose of on-chain risk screening and tracing. Each tool earns its place without redundant surface area.

Completeness4/5

The set covers core workflows: risk screening, blacklist checks, and layered fund tracing. Minor gaps exist, such as batch screening or broader contract-audit operations, but the primary domain is well covered.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    B
    quality
    C
    maintenance
    Provides on-chain forensic checks for evaluating transaction risks, including token verification, rug-pull detection, and fund tracing, using public blockchain endpoints.
    12
    51 npm
    MIT
  • A
    license
    A
    quality
    A
    maintenance
    Enables AI agents to perform AML and compliance risk scoring for crypto addresses and transactions on Ethereum, BSC, TRON, TON, and Bitcoin, returning 0–100 risk scores, bands, flags, and detailed signals.
    2
    57 npm
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    Enables AI assistants to assess the risk of crypto wallets, tokens, and smart contracts by providing read-only on-chain analysis, 0-100 risk scoring with explanations, fund tracing, and contract inspection before interaction.
    6
    MIT