Publicaml

io.github.publicamlPublished by GitHub account publicamlv0.1.1Updated Oct 24, 2026

AML screening for crypto addresses: risk, sanctions, fund tracing and counterparties.

VerifiedSTDIODesktop onlyFinance Security & Monitoring

Server details

Identifier: io.github.publicaml/mcp-server
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account publicaml for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.publicaml%2Fmcp-server.svg)](https://sourceweft.com/mcp/io.github.publicaml%2Fmcp-server?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Lets an assistant screen crypto addresses for AML risk, sanctions and fund flows across bitcoin, ethereum, bsc and tron via PublicAML.

What you can do: Provides three tools backed by the PublicAML intelligence API. screen_address returns risk level and score, sanctions and issuer freezes, the address type (exchange, mixer, gambling, bridge, personal wallet) and where the risk comes from. trace_funds walks funding backwards to find who paid a wallet, or forwards to see where money left; list_counterparties classifies counterparties, answers whether a wallet touched an exchange, mixer or casino, and checks suspect addresses against it. Answers are bounded by time and may be marked PARTIAL.
When to use it: Useful when an assistant needs to check a crypto wallet before a transaction, investigate where funds came from or went, or see which venues a wallet has dealt with. It suits compliance-style research and due diligence on addresses in the four supported chains.
Requirements: Runs locally as a Node.js process via npx (package @publicaml/mcp-server), typically configured in Claude Desktop, Cursor or Claude Code. Network access to the PublicAML API is required. No account is needed; an optional PUBLICAML_API_KEY raises the rate limit and unlocks outgoing tracing. Optional settings include PUBLICAML_API_BASE, PUBLICAML_TIMEOUT_MS and PUBLICAML_TRACE_CONTINUES.

Before you install

Without a key the server works anonymously under an IP rate limit. Addresses you query are sent to the third-party PublicAML API. Results are evidence for a human decision, not a verdict: a sanctioned flag is blocking on its own, but NOT FOUND means unknown rather than clean, PARTIAL answers are a floor, and USD figures are rough and can be inflated by low-liquidity tokens. Treat the API key as a secret.

Installation

In SourceWeft

Open Publicaml in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

PublicAML MCP server

Blockchain AML screening inside Claude Desktop, Cursor, or any other MCP client. Ask about an address in plain language and the assistant checks it against PublicAML: sanctions, issuer freezes, risk propagated through the transaction graph, who funded the wallet and who it dealt with.

Chains: bitcoin, ethereum, bsc, tron.

Works without an account. An API key only lifts the rate limit and unlocks forward tracing.

Install

Claude Desktop, claude_desktop_config.json:

json

{  "mcpServers": {    "publicaml": {      "command": "npx",      "args": ["-y", "@publicaml/mcp-server"]    }  }}

{  "mcpServers": {    "publicaml": {      "command": "npx",      "args": ["-y", "@publicaml/mcp-server"]    }  }}

With an API key:

json

{  "mcpServers": {    "publicaml": {      "command": "npx",      "args": ["-y", "@publicaml/mcp-server"],      "env": { "PUBLICAML_API_KEY": "your-key" }    }  }}

{  "mcpServers": {    "publicaml": {      "command": "npx",      "args": ["-y", "@publicaml/mcp-server"],      "env": { "PUBLICAML_API_KEY": "your-key" }    }  }}

Cursor uses the same block in .cursor/mcp.json. Claude Code:

Tools

`screen_address`

Risk level and score, sanctions, Tether/Circle freezes, what the address is (exchange, mixer, gambling, bridge, personal wallet) and where its risk comes from.

chain is optional. Omit it and every chain the address format allows is screened, each result labelled with its chain: the same 0x… string is a different wallet on ethereum, bsc and tron, so it is never guessed silently.

`trace_funds`

direction: "incoming" walks the funding backwards to answer "who paid this wallet", stopping at labelled entities rather than walking into an exchange's other customers. direction: "outgoing" follows the largest outgoing flows to where the money left the chain's anonymous part. Outgoing needs an API key.

The walk is bounded by wall clock, so an incomplete answer is returned rather than a timeout, and the answer says which one it is.

`list_counterparties`

Three questions, one tool. classify enumerates counterparties and says what each one is (person, venue, hub, deposit address, contract, mint/burn). category answers "did this wallet touch any exchange / mixer / casino". check tests a list of suspect addresses against the wallet.

Reading the answers

sanctioned: true is a blocking fact on its own, whatever the score says.
The score is a risk reading 0-100, never a share of the funds, and its parts combine by MAX, so the breakdown does not add up to the total.
An address absent from the data comes back as NOT FOUND. That is unknown, not clean.
Lists are ranked and capped. A PARTIAL answer is a floor, not a census.
USD figures cover priced tokens only and can be inflated by low-liquidity tokens. Treat them as an order of magnitude.

This is evidence for a human decision, not the decision itself.

Configuration

Variable	Default	Meaning
`PUBLICAML_API_KEY`	none	Lifts the anonymous rate limit, unlocks outgoing tracing.
`PUBLICAML_API_BASE`	`https://intelapi.publicaml.org`	API base URL.
`PUBLICAML_TIMEOUT_MS`	`60000`	Per-request timeout.
`PUBLICAML_TRACE_CONTINUES`	`2`	How many times an incomplete backward walk is resumed automatically.

One-click desktop install

The same server is also distributed as an MCPB bundle, which Claude Desktop installs with a double click and no JSON editing. Build it with:

The bundle lands in dist/. Version, description, licence and the tool list are read from package.json and from the server's own tool definitions, so the bundle cannot drift from the npm release.

Development

npm installnpm test          # unit tests, no networknode scripts/live.mjs  # end-to-end against the live API

npm installnpm test          # unit tests, no networknode scripts/live.mjs  # end-to-end against the live API

MIT licensed. API docs: https://publicaml.org/api

Source: README.md at commit 2f77e9d

Tools

SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

v0.1.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts