PublicAML MCP Server
OfficialScreens bitcoin addresses via PublicAML: returns risk level and score, sanctions hits, issuer freezes, the entity type behind the address (exchange, mixer, gambling, bridge, personal wallet) and a breakdown of where the risk comes from. Also supports tracing incoming funding flows backwards and enumerating counterparties of a bitcoin wallet.
Reports whether an address has been frozen by Circle as part of AML screening, surfacing issuer freeze events in the risk and sanctions evidence returned for a wallet.
Screens ethereum (and other 0x-format chains such as bsc) addresses, returning risk level and score, sanctions exposure, Tether/Circle freeze status, address classification, and risk provenance from the transaction graph. Supports backward funding traces and counterparty classification, category checks and suspect-address checks.
Reports whether an address has been frozen by Tether as part of AML screening, surfacing issuer freeze events in the risk and sanctions evidence returned for a wallet.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@PublicAML MCP Serverscreen 0x742d35Cc6634C0532925a3b844Bc454e4438f44e for sanctions and AML risk"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
PublicAML MCP server
Blockchain AML screening inside Claude Desktop, Cursor, or any other MCP client. Ask about an address in plain language and the assistant checks it against PublicAML: sanctions, issuer freezes, risk propagated through the transaction graph, who funded the wallet and who it dealt with.
Chains: bitcoin, ethereum, bsc, tron.
Works without an account. An API key only lifts the rate limit and unlocks forward tracing.
Install
Claude Desktop, claude_desktop_config.json:
{
"mcpServers": {
"publicaml": {
"command": "npx",
"args": ["-y", "@publicaml/mcp-server"]
}
}
}With an API key:
{
"mcpServers": {
"publicaml": {
"command": "npx",
"args": ["-y", "@publicaml/mcp-server"],
"env": { "PUBLICAML_API_KEY": "your-key" }
}
}
}Cursor uses the same block in .cursor/mcp.json. Claude Code:
claude mcp add publicaml -- npx -y @publicaml/mcp-serverRelated MCP server: hive-mcp-agent-kyc
Tools
screen_address
Risk level and score, sanctions, Tether/Circle freezes, what the address is (exchange, mixer, gambling, bridge, personal wallet) and where its risk comes from.
chain is optional. Omit it and every chain the address format allows is
screened, each result labelled with its chain: the same 0x… string is a
different wallet on ethereum, bsc and tron, so it is never guessed silently.
trace_funds
direction: "incoming" walks the funding backwards to answer "who paid this
wallet", stopping at labelled entities rather than walking into an exchange's
other customers. direction: "outgoing" follows the largest outgoing flows to
where the money left the chain's anonymous part. Outgoing needs an API key.
The walk is bounded by wall clock, so an incomplete answer is returned rather than a timeout, and the answer says which one it is.
list_counterparties
Three questions, one tool. classify enumerates counterparties and says what
each one is (person, venue, hub, deposit address, contract, mint/burn).
category answers "did this wallet touch any exchange / mixer / casino".
check tests a list of suspect addresses against the wallet.
Reading the answers
sanctioned: trueis a blocking fact on its own, whatever the score says.The score is a risk reading 0-100, never a share of the funds, and its parts combine by MAX, so the breakdown does not add up to the total.
An address absent from the data comes back as NOT FOUND. That is unknown, not clean.
Lists are ranked and capped. A
PARTIALanswer is a floor, not a census.USD figures cover priced tokens only and can be inflated by low-liquidity tokens. Treat them as an order of magnitude.
This is evidence for a human decision, not the decision itself.
Configuration
Variable | Default | Meaning |
| none | Lifts the anonymous rate limit, unlocks outgoing tracing. |
|
| API base URL. |
|
| Per-request timeout. |
|
| How many times an incomplete backward walk is resumed automatically. |
One-click desktop install
The same server is also distributed as an MCPB bundle, which Claude Desktop installs with a double click and no JSON editing. Build it with:
npm run build:mcpbThe bundle lands in dist/. Version, description, licence and the tool list are
read from package.json and from the server's own tool definitions, so the
bundle cannot drift from the npm release.
Development
npm install
npm test # unit tests, no network
node scripts/live.mjs # end-to-end against the live APIMIT licensed. API docs: https://publicaml.org/api
Available Tools
3 toolslist_counterpartiesList who an address transacted withA
Who a wallet dealt with and for how much, in one of three modes:
classify — enumerate the counterparties and say what each one IS: a person, a venue (exchange/service), a hub, a deposit address, a contract or a mint/burn pseudo-address. This is the mode for 'which ordinary people funded this wallet'. An unlabelled counterparty is NOT thereby a person; that is what this mode's degree probe decides.
category — did this wallet touch any exchange / mixer / gambling site / bridge at all.
check — you already have suspect addresses and want to know whether this wallet dealt with them, and for how much. Addresses with no recorded interaction are simply absent from the answer.
The list is ranked and capped, so a partial answer is a floor, not the complete set, and a degree figure is a lower bound measured in a window.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Which question you are asking. The modes do not combine. | |
| chain | No | Required unless the address format identifies exactly one chain. | |
| kinds | No | `classify` mode: which classes to return. Default: all of them. | |
| limit | No | Default 25. | |
| since | No | Restrict to a window. ISO date ('2026-06-21') or epoch seconds. | |
| until | No | ||
| address | Yes | The wallet whose counterparties to look at. | |
| rank_by | No | 'value' (default) weighs token units with no price attached, so a memecoin sender can outrank an ETH sender. Use 'tx_count' when that would mislead. | |
| category | No | `category` mode: the entity type to look for — cex, mixer, gambling, bridge, darknet, … | |
| addresses | No | `check` mode: the candidate counterparty addresses to test. | |
| direction | No | `classify` mode. 'in' (default) = who paid this address. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and delivers: the list is ranked and capped, a `partial` answer is a floor rather than the complete set, degree figures are lower bounds, unlabelled counterparties are explicitly NOT people, and non-interacting addresses are simply absent. These are exactly the caveats an agent needs to avoid over-reading results.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded purpose statement followed by tight mode bullets, with the capping caveat last. Every sentence earns its place, though the mode formatting is dense for a definition of this length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 11-parameter tool with no annotations and no output schema, the description covers mode selection, result capping, and interpretation caveats. It stops short of describing the shape of the returned counterparty records or how `since`/`until` windows interact with the 'lower bound' claim.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 91%, so the schema already documents nearly every parameter, including the `rank_by` value-vs-tx_count tradeoff and the `direction` default. The description adds mode semantics and the capping caveat, which is useful but largely overlaps what the schema already supplies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening line states a specific verb and resource ('Who a wallet dealt with and for how much'), and the three named modes carve out precise sub-purposes. It never names the siblings screen_address or trace_funds, so an agent must infer the boundary from function alone rather than being told.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Each mode is given an explicit question it answers, including the exact user phrasing it targets ('which ordinary people funded this wallet') and the precondition for `check` ('you already have suspect addresses'). It also rules out mode combination ('the modes do not combine').
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
screen_addressScreen a crypto address for AML riskA
AML screening for one blockchain address: risk level and score, sanctions, issuer freezes (Tether/Circle), what the address is (exchange, mixer, gambling, bridge, personal wallet) and where its risk comes from. Chains: bitcoin, ethereum, bsc, tron.
Read the answer this way: sanctioned: true is a blocking fact on its own, independent of the score. The score is a risk reading 0-100, never a share of the funds. An address absent from the data is reported as NOT FOUND and must not be presented as clean.
Chain is part of the address's identity, not a hint: the same 0x address is a different wallet on ethereum, bsc and tron. Pass chain when you know it; if you omit it, every chain the format allows is screened and each result is labelled with its chain.
| Name | Required | Description | Default |
|---|---|---|---|
| chain | No | Which chain the address belongs to. Omit only if you genuinely do not know: the candidates implied by the address format are screened instead. | |
| address | Yes | The address to screen. Bitcoin, Ethereum/BSC (0x…) or Tron (T…). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and does so well: it discloses that `sanctioned: true` is blocking independently of score, that the score is a 0–100 risk reading rather than a share of funds, that absent addresses are reported as NOT FOUND and must not be treated as clean, and that chain is identity rather than a hint. These are meaningful operational and interpretive traits beyond what the schema alone provides.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with purpose then structured interpretation notes ('Read the answer this way') and chain semantics, with no filler sentences. There is mild redundancy with the schema's own chain description, which slightly limits conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description does substantial work explaining return semantics, edge cases, and the meaning of chain omission. It remains incomplete only in tool-selection guidance against siblings and in any auth or rate-limit notes, which are not addressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3, but the description adds real meaning: it stresses that chain is part of the address's identity, that the same 0x address is a different wallet on ethereum, bsc, and tron, and that omitting chain screens every allowed format with each result labelled. The schema already mentions omitting chain when unknown, so this is reinforcing and extending rather than wholly new.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('screen') and resource ('one blockchain address'), and enumerates what it reports: risk level/score, sanctions, issuer freezes, address type, risk provenance, and supported chains. Clear purpose, but it does not differentiate from siblings trace_funds and list_counterparties, so an agent cannot tell from the description alone why to pick this over those.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by 'AML screening for one blockchain address' and the chain parameter guidance ('Pass chain when you know it; if you omit it...'), which helps a caller use it correctly. However, there is no explicit when-to-use/when-not-to-use guidance and no mention of the alternative sibling tools, so selection against trace_funds or list_counterparties is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
trace_fundsTrace where an address's money came from or wentA
Follows the money one direction at a time.
incoming walks funding backwards: who paid this wallet. The trail stops at labelled entities (it reports the exchange rather than walking into its other customers) and at unlabelled addresses whose degree makes them a service.
outgoing follows the largest outgoing flows forward to where the money left the anonymous part of the chain (exchange, OTC, mixer) and what is still sitting in unlabelled dead ends. Outgoing tracing needs an API key.
This is a lead-generating tool, not exhaustive accounting: the walk is bounded by wall clock, so a partial answer is returned rather than a timeout, and 'nothing found' can mean 'the budget ran out'. The answer says which one it was; report that honestly.
| Name | Required | Description | Default |
|---|---|---|---|
| chain | No | Required unless the address format identifies exactly one chain. A 0x address is ambiguous between ethereum and bsc and must name its chain. | |
| address | Yes | The address to trace. | |
| max_hops | No | Default 5, 8 on bitcoin. On bitcoin one hop is HALF an economic step: the graph runs address -> transaction -> address. | |
| direction | Yes | incoming = who funded this address (works without an API key). outgoing = where its money went (requires an API key). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so: it discloses that the trail stops at labelled entities and high-degree service addresses, that the walk is bounded by wall clock so partial results are returned instead of a timeout, and that 'nothing found' can mean the budget ran out. These are non-obvious behaviors an agent must report honestly and could not infer from the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the one-direction-at-a-time rule, then per-mode paragraphs, then the caveat paragraph. Slightly repetitive with the schema's direction description, but nearly every sentence carries information an agent needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description must explain returns, and it does: it describes what the trail reports (exchange vs. dead end), that partial answers occur, and that the answer itself indicates which case it was. Complete for a 4-param tracing tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents chain ambiguity, max_hops defaults and the bitcoin half-step, and the direction enum. The description restates direction semantics rather than adding syntax or constraints beyond the schema, so it sits at the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete verb-and-resource (trace an address's funding flows) and sharply separates its own two modes, incoming and outgoing. It never references the sibling tools (screen_address, list_counterparties), so an agent gets no help distinguishing this from them, which keeps it just below the top band.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when each direction applies ('incoming walks funding backwards', 'outgoing follows the largest outgoing flows forward'), and adds the gating condition that outgoing requires an API key. It also frames the tool as lead-generating rather than exhaustive, telling the agent how to weigh the output.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
v0.1.1- First observed
list_counterparties - First observed
screen_address - First observed
trace_funds
TDQS
Scored across 3 tools
Each tool targets a different AML task (address screening, fund tracing, counterparty listing), but trace_funds (incoming) and list_counterparties (classify/category) both surface who a wallet interacted with, creating some boundary blur. Descriptions clarify scope, so misselection is unlikely but possible.
All three names follow a consistent snake_case verb_noun pattern (screen_address, trace_funds, list_counterparties). No deviations, making the set predictable and easy to scan.
Three tools is well-scoped for a focused AML API, and each tool encapsulates a distinct, multi-purpose operation (screening, tracing, counterparty analysis). No tool feels redundant or missing.
Covers core AML workflows: risk/sanctions screening, fund tracing, and counterparty classification. Minor gaps exist, such as batch address screening or granular transaction-level retrieval, but agents can work around them for most use cases.
Maintenance
Related MCP Connectors
Free crypto AML/KYT screening for BTC/ETH/BSC/TRON — risk score, sanctions, source of funds.
Blockchain intelligence for tracing funds, screening addresses, and investigating on-chain activity.
Pre-transaction risk screening for Ethereum addresses: signed score, sanctions, audit trail.
AML/CFT compliance oracle: wallet screening, sanctions, PEPs, jurisdiction risk.
Related MCP Servers
- AlicenseBqualityDmaintenanceProvides blockchain address risk scoring and asset information through the BICScan API, allowing users to assess risks for crypto addresses, domains, and dApps on a scale of 0-100.217MIT
- AlicenseNot gradedqualityCmaintenanceRoutes blockchain address screening to third-party KYC/AML providers and checks public sanctions lists, serving as a clean-money gate primitive for MCP-compatible agents.MIT
- AlicenseNot gradedqualityCmaintenanceEnables AML screening of blockchain addresses against OFAC SDN lists and chain heuristics, returning risk scores and flags.MIT
- AlicenseBqualityCmaintenanceMCP server for AML/KYT crypto wallet screening, enabling AI clients to check wallet risk scores, source-of-funds tags, activity dates, and volume totals via Satoshkin backend.133 npmMIT