Hive Aml Screen

io.github.srotzinPublished by GitHub account srotzinv1.0.0Updated Oct 25, 2026

Real-time AML and sanctions screening for agent-to-agent transactions

VerifiedStreamable HTTPWeb executableFinanceSecurity & Monitoring

Overview

AI-generated overview

Remote MCP server that screens blockchain addresses for AML and sanctions risk, returning a 0–100 score, OFAC SDN match flag and chain heuristics.

What you can do
Screen a single address on a given chain for a risk score, risk band, OFAC SDN match and heuristic flags such as mixer contract or very new wallet, cached for 24 hours per chain and address. Screen many addresses in one bulk call with a 10-address minimum. Read free UTC-day counters and OFAC list status. Paid calls are settled per request in USDC on Base via an x402 quote and access token.
When to use it
Useful when an assistant needs a quick observational risk signal on a wallet or contract address, for example before an agent-to-agent transaction, or when checking addresses against the OFAC SDN list. Not a substitute for a regulated KYC/AML provider or for making compliance decisions.
Requirements
Remote streamable HTTP endpoint; no local install, account or API key declared. Paid screening calls require payment in USDC on Base: the first call returns a 402 quote, which is settled and submitted to obtain an access token sent in the X-Hive-Access header. Network access to the endpoint is required.
Before you install
Screening calls cost money: $0.03 per single address and $0.025 per address for bulk, paid in USDC on Base, so an assistant could spend funds. Results are observational only; the provider states it does not block, freeze or settle and that the customer is responsible for compliance decisions. Addresses and chains sent are processed by a third-party service.

Installation

In SourceWeft

  1. Open Hive Aml Screen in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.srotzin%2Fhive-mcp-aml-screen/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "hive-aml-screen": {
      "type": "http",
      "url": "https://hive-mcp-aml-screen.onrender.com/mcp"
    }
  }
}

README

hive-mcp-aml-screen

[srotzin/hive-mcp-aml-screen MCP server]

AML screening broker for the A2A network. Send an address and a chain. Receive a 0–100 observational risk score, an OFAC SDN match flag, and chain-heuristic categories. Cached for 24 hours.

Hive does not block, freeze, or settle. This is observational AML data only. Customer is responsible for compliance decisions.

  • Sources — daily-refreshed OFAC SDN list (treasury.gov), live Base mainnet RPC reads, conservative mixer-contract seed list
  • Scoring — 0–100 with bands (minimal, low, medium, high, critical)
  • Pricing — $0.03 per single address, $0.025 per address for bulk (10-address minimum), settled via x402 in USDC on Base
  • Cache — 24 hours per (chain, address)
  • Mode — inbound only, ENABLE=true by default

The shim is a broker. It returns observational data. It never blocks, freezes, or settles on behalf of a customer, and it never replaces a regulated KYC/AML provider.

Endpoints

MethodPathCostPurpose
POST/v1/aml/screen$0.03Screen one address
POST/v1/aml/bulk$0.025/addr (min 10)Screen many addresses in one call
GET/v1/aml/todayfreeUTC-day counters and OFAC list status
GET/healthfreeLiveness, OFAC list status, pricing
POST/mcp—JSON-RPC 2.0 entry for MCP clients
GET/.well-known/mcp.jsonfreeMCP descriptor
POST/v1/x402/submit—Settle a 402 quote, mint an access token

MCP tools

ToolCostDescription
aml_screen$0.03Single-address screening
aml_bulk_screen$0.025/addrBulk screening, 10-address minimum
aml_todayfreeCounters and OFAC list status

Every response — JSON-RPC and REST alike — carries the disclaimer field:

json
"disclaimer": "Hive does not block, freeze, or settle. This is observational AML data only. Customer is responsible for compliance decisions."

Quickstart

bash
curl -sX POST https://hive-mcp-aml-screen.onrender.com/v1/aml/screen \  -H 'content-type: application/json' \  -d '{"address":"0x8589427373d6d84e98730d7795d8f6f8731fda16","chain":"base"}'

The first call returns a 402 envelope with a quote. Settle on Base in USDC, then resubmit the proof to /v1/x402/submit to mint an access token, and replay the request with X-Hive-Access: <token>.

bash
curl -sX POST https://hive-mcp-aml-screen.onrender.com/v1/x402/submit \  -H 'content-type: application/json' \  -d '{"nonce":"...","payer":"0x...","chain":"base","tx_hash":"0x..."}'

Response shape

json
{  "ok": true,  "address": "0x8589427373d6d84e98730d7795d8f6f8731fda16",  "chain": "base",  "risk_score": 100,  "risk_band": "critical",  "flags": [    {"category": "ofac_sdn_match", "severity": "critical", "detail": "OFAC SDN list match: program=CYBER2 sdn_uid=12345"},    {"category": "mixer_contract", "severity": "high", "detail": "address is a known mixer/sanctioned-protocol contract"}  ],  "sdn_match": true,  "sdn_record": {"sdn_uid": "12345", "sdn_name": "TORNADO CASH", "program": "CYBER2"},  "chain_detail": {"nonce": 0, "is_contract": true, "balance_wei": "0", "head_block": 12345678},  "sources": {    "ofac_sdn": {"list_size": 8421, "last_refresh_ms": 1745798400000},    "heuristics": {"chain": "base", "version": "v1"}  },  "cache_hit": false,  "cache_ttl_seconds": 86400,  "screened_at": 1745875200000,  "screening_id": "8a3f...",  "disclaimer": "Hive does not block, freeze, or settle. This is observational AML data only. Customer is responsible for compliance decisions."}

Heuristics

For EVM chains the shim performs four real Base RPC reads — getTransactionCount, getCode, getBalance, getBlockNumber — plus a binary search over historical blocks to estimate the wallet's earliest activity. Categories returned in flags:

CategorySeverityTrigger
ofac_sdn_matchcriticalAddress appears in the daily OFAC SDN list
mixer_contracthighAddress is a known mixer/sanctioned-protocol contract
very_new_walletmediumFirst on-chain activity within 24 hours
high_velocitymedium≥ 20 outbound tx per hour over wallet lifetime
mixer_adjacent_balancelowBalance is exactly 0.1 / 1 / 10 / 100 ETH (Tornado pool denominations)
no_outbound_historylowAddress has never sent a transaction on this chain
rpc_unavailablelowRPC read failed; SDN-only signal returned
heuristic_errorlowInternal heuristic error; SDN-only signal returned

Non-EVM chains return the SDN match signal only with a note in chain_detail.

Configuration

EnvDefaultPurpose
PORT3000HTTP port
ENABLEtrueMaster switch. Set false to short-circuit all paid endpoints with 503
WALLET_ADDRESS0x15184bf50b3d3f52b60434f8942b7d52f2eb436ex402 settlement recipient (W1 MONROE)
BASE_RPC_URLhttps://mainnet.base.orgBase mainnet RPC for chain heuristics
OFAC_SDN_URLhttps://www.treasury.gov/ofac/downloads/sdn.csvSource URL for the SDN list
DB_PATH/tmp/aml.dbSQLite database file
MIXER_ADDRESSES(empty)Comma-separated list of extra mixer contract addresses to flag
X402_BYPASS(unset)Set to any value to bypass payment in development

Persistence

SQLite at /tmp/aml.db with WAL journaling.

  • ofac_sdn — (address PK, sdn_uid, sdn_name, program, list_type, inserted_at) — wiped and re-inserted on each refresh
  • ofac_meta — refresh timestamp, count, byte size, last error
  • screenings — every screen call, billed or cached
  • cache — (chain:address) → JSON payload, 24-hour TTL

Operational notes

  • The OFAC list is refreshed at boot and every 24 hours thereafter
  • Cache entries are pruned hourly
  • Body limit is 256 KB on JSON requests
  • Inbound only — the shim never initiates outbound calls beyond the OFAC fetch and Base RPC reads

License

MIT — see LICENSE.

Hive Civilization Directory

Part of the Hive Civilization — agent-native financial infrastructure.

Brand: #C08D23

Source: README.md at commit dfd26e4

Tools

0
SourceWeft has not read this server's tools yet.

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts