WalletTriage

io.github.wallettriagePublished by GitHub account wallettriagev0.1.5Updated Oct 24, 2026

Real-time exploit-exposure risk check for EVM wallets, paid per query via x402 (USDC on Base).

VerifiedSTDIODesktop onlyFinanceSecurity & Monitoring

Overview

AI-generated overview

WalletTriage checks EVM wallet addresses for real-time exploit exposure, with each paid query settled in USDC on Base via x402 from a local session key.

What you can do
Check an EVM address for risk: dangerous ERC20 approvals cross-referenced with a live threat feed, returning a risk score, risk level and findings (paid per query). Retrieve service status and the current price per query (free).
When to use it
Useful when an assistant is about to interact with an unfamiliar EVM address or contract and you want a quick exposure check before approving or sending. Also handy for checking service availability and pricing before funding a session wallet.
Requirements
Runs locally via npx and needs Node 20+. Requires the EVM_PRIVATE_KEY environment variable: the private key of a dedicated session wallet holding a few USDC on Base. Optional settings: GATEWAY_URL (defaults to the public production gateway), MAX_PAYMENT_ATOMIC (default 100000, i.e. US$0.10) and DEFAULT_SCAN_CHAIN (default eth). Network access to the gateway is needed.
Before you install
The server asks for a wallet private key in EVM_PRIVATE_KEY, which signs real USDC payments on Base; use a dedicated low-balance wallet, never a main key. Each risk check spends USDC, capped by MAX_PAYMENT_ATOMIC. Do not disable TLS verification, since payment data travels in headers. The README states queries are stateless and nothing is persisted.

Installation

In SourceWeft

  1. Open WalletTriage in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

wallettriage-mcp

MCP server for WalletTriage — real-time exploit-exposure check for EVM wallets, built for AI agents. Each query is paid via x402 (USDC on Base) signed locally by a session key: no signup, no API key, no prompts. Stateless — nothing about you or your queries is persisted.

Tools

  • check_address_risk (paid) — real-time risk for an EVM address: dangerous ERC20 approvals cross-referenced with a live threat feed of contracts under attack. Returns risk_score (0–100), risk_level and actionable findings.
  • get_pricing (free) — service status and current price per query.

Setup (Claude Desktop, Claude Code, Cursor)

Requires Node 20+. Add to your MCP config (e.g. claude_desktop_config.json):

json
{  "mcpServers": {    "wallettriage": {      "command": "npx",      "args": ["-y", "wallettriage-mcp"],      "env": {        "GATEWAY_URL": "https://api.wallettriage.com",        "EVM_PRIVATE_KEY": "0xREPLACE_WITH_SESSION_WALLET_PRIVATE_KEY",        "MAX_PAYMENT_ATOMIC": "100000"      }    }  }}

Fund the session wallet with a few USDC on Base. Use a dedicated, low-balance wallet — never your main key. It only signs gasless EIP-3009 USDC payments; WalletTriage never holds or moves funds.

EVM_PRIVATE_KEY is the wallet's private key (0x + 64 hex), not its address. No ETH needed — payments are gasless (EIP-3009). Test connectivity first with the free get_pricing tool before funding.

Then ask your agent: "Check the risk of 0xd8dA… before I interact with it."

Troubleshooting

  • unable to verify the first certificate (common on Windows / corporate networks): your antivirus or proxy intercepts TLS and Node doesn't use the system certificate store by default. Add "NODE_OPTIONS": "--use-system-ca" to the env block. Never disable TLS verification — payments travel in headers and must not be tamperable.
  • EVM_PRIVATE_KEY is malformed: the value must be 0x + 64 hex characters (the private key of the session wallet). Check for placeholder text, missing 0x or stray whitespace.
  • Gateway unreachable: GATEWAY_URL defaults to https://api.wallettriage.com. If you overrode it (e.g. to a local gateway), make sure that host is reachable and running.

Environment variables

VariableRequiredDefaultPurpose
EVM_PRIVATE_KEYyes—Session key that signs x402 payments (USDC on Base)
GATEWAY_URLnohttps://api.wallettriage.comWalletTriage API base URL. Defaults to production; set http://localhost:4021 for local dev (https enforced for non-local hosts)
MAX_PAYMENT_ATOMICno100000 (US$0.10)Refuses any 402 requirement above this cap (atomic USDC units, 6 decimals)
DEFAULT_SCAN_CHAINnoethDefault chain: eth, base, polygon, arbitrum, optimism, bsc

Local development

bash
npm installcp .env.example .env   # set EVM_PRIVATE_KEYnpm start              # runs src/server.ts via tsx (stdio)

Point at a local gateway with GATEWAY_URL=http://localhost:4021, or test with the MCP Inspector:

bash
npx @modelcontextprotocol/inspector npx tsx src/server.ts

npm run build emits dist/server.js (the published bin).

Source: README.md at commit c1528dc

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.5LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.