traql

io.traqlPublished by traql.iov0.1.2Updated Oct 24, 2026

AML risk scoring for crypto addresses and transactions on Ethereum, BSC, TRON, TON, Bitcoin

VerifiedSTDIODesktop onlyFinanceSecurity & Monitoring

Overview

AI-generated overview

Scores crypto addresses and transactions for AML risk, returning a 0–100 score, band, flags and signals to an AI assistant.

What you can do
  • Check a single address on Ethereum, BSC, TRON, TON or Bitcoin and get a 0–100 risk score, band and flags
  • Screen a transfer before broadcasting it by passing sender, recipient, optional amount and asset
  • Look up an already on-chain transaction by hash on Ethereum, BSC, TRON or TON
  • Read itemized signals with source, entity, severity and confidence, plus a computed timestamp
  • Receive both human-readable text and structured content for each result
When to use it
Useful when an assistant helps with crypto payments, treasury or compliance triage and needs a quick risk read on a counterparty address or a transfer before it is sent. Also handy for reviewing an existing transaction hash against sanctions, mixer and scam data.
Requirements
Runs locally over stdio via npx, requiring Node.js 18 or later. An API key from the traql dashboard is recommended, set as TRAQL_API_KEY and sent as the X-API-Key header. Optional TRAQL_API_URL for self-hosting and TRAQL_TIMEOUT_MS for request timeouts. Network access to the hosted API is needed.
Before you install
Each successful call consumes one check from the account; without a key the keyless tier allows 3 free checks per IP per day and then asks for per-call payment over x402, with coarser results. Addresses and transaction details are sent to the hosted traql API unless you self-host. Scores are advisory and not a legal determination, and a partial result is only a lower bound.

Installation

In SourceWeft

  1. Open traql in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

traql MCP server

[npm] [CI] [License: MIT] [Glama] [M8ven Live Monitored] [mcprush]

AML and compliance risk scoring for crypto addresses and transactions, exposed to AI agents over the Model Context Protocol.

Ask your agent "is it safe to send to this address?" and it gets back a 0–100 risk score, a band, the risk categories behind it, and — with an API key — every individual signal with its source and confidence.

ethereum address 0x8589427373d6d84e98730d7795d8f6f8731fda16RISK 100/100 — CRITICALFlags: sanctions, mixer, scam
Signals (21):  +80  [sanctions/eth_labels] direct.sanctions — sanctions label "Tornado.Cash: Donate" [entity Tornado.Cash: Donate, confidence 0.80]  +68  [mixer/eth_labels] direct.mixer — mixer label "Tornado.Cash: Donate" [entity Tornado.Cash: Donate, confidence 0.80]  +10  [mixer] behavior.mixer_contact — direct contact with mixer 0xdd4c48c0b24039969fc16d1cdf626eab821d3384  +9   [sanctions/ofac_sdn] indirect.sanctions — sent to Semenov Roman (sanctions, 18% of USDC volume) [entity Semenov Roman, confidence 1.00]  ... and 17 more
Computed at 2026-08-23T11:42:49Z.

Backed by traql: OFAC SDN, UK OFSI, EU and UN sanctions lists, Tether/Circle freeze events, curated hack and mixer attributions, and counterparty exposure analysis across Ethereum, BSC, TRON, TON and Bitcoin.

Quick start

Requires Node.js 18+.

bash
npx -y @traql/mcp

The server speaks MCP over stdio, so you normally point a client at it rather than running it by hand.

Claude Code

bash
claude mcp add traql --env TRAQL_API_KEY=your_key -- npx -y @traql/mcp

Claude Desktop

Add to claude_desktop_config.json:

json
{  "mcpServers": {    "traql": {      "command": "npx",      "args": ["-y", "@traql/mcp"],      "env": { "TRAQL_API_KEY": "your_key" }    }  }}

Cursor

Add to ~/.cursor/mcp.json (or .cursor/mcp.json in a project) using the same mcpServers block as above.

VS Code

Add to .vscode/mcp.json:

json
{  "servers": {    "traql": {      "type": "stdio",      "command": "npx",      "args": ["-y", "@traql/mcp"],      "env": { "TRAQL_API_KEY": "your_key" }    }  }}

Getting an API key

Sign up at app.traql.io, confirm your email — free checks are included — and issue a key under API keys. The secret is shown once; it can be rotated or revoked at any time.

Without a key the server still runs, on the keyless tier: the hosted API serves 3 free checks per IP per day so you can try it immediately, then asks for per-call payment over x402. Keyless responses are also coarser — a single reason phrase instead of itemized signals — and rate limits are tighter. For anything beyond a first look, set a key.

Configuration

VariableRequiredDefaultDescription
TRAQL_API_KEYrecommended—API key from the traql dashboard. Sent as X-API-Key. Unlocks itemized signals and higher limits.
TRAQL_API_URLnohttps://api.traql.ioBase URL of the API. Point it at your own deployment if you self-host traql.
TRAQL_TIMEOUT_MSno30000Per-request timeout in milliseconds.

Tools

check_address

Scores a single address.

ArgumentTypeRequiredDescription
chainethereum | bsc | tron | ton | bitcoinyesNetwork the address belongs to.
addressstringyesAddress in the chain's native format.

screen_transaction

Scores both sides of a transfer, in one of two modes:

  • Pre-flight — pass from and to (optionally amount and asset) to screen a transfer before broadcasting it. Works on every supported chain.
  • By hash — pass tx_hash alone to look up a transaction that is already on-chain. Supported on Ethereum, BSC, TRON and TON.
ArgumentTypeRequiredDescription
chainchain enumyesNetwork the transaction belongs to.
fromstringpre-flightSender address.
tostringpre-flightRecipient address.
amountstringnoInteger amount in the asset's base units (e.g. 1000000 for 1 USDT).
assetstringnoAsset or token symbol, e.g. USDT.
tx_hashstringby-hashHash of a broadcast transaction. Mutually exclusive with from/to.

Response

Both tools return human-readable text plus structuredContent:

json
{  "subject": { "type": "address", "chain": "ethereum", "address": "0x…" },  "result": {    "score": 100,    "band": "critical",    "flags": ["sanctions", "mixer", "scam"],    "partial": false,    "computed_at": "2026-08-23T11:42:49Z",    "reasons": [      {        "code": "direct.sanctions",        "message": "sanctions label \"Tornado.Cash: Donate\" from eth_labels (severity 100 × confidence 0.80 = 80.0)",        "contribution": 80,        "category": "sanctions",        "source": "eth_labels",        "entity": "Tornado.Cash: Donate",        "severity": 100,        "confidence": 0.8,        "eff": 80.0      }    ]  }}

Score bands: clean 0–9, low 10–39, elevated 40–69, high 70–89, critical 90–100.

partial: true means an upstream data source was degraded while computing the result — read the score as a lower bound, not a final verdict.

Each successful call consumes one check from the configured account. Malformed input is rejected locally where possible, so it costs nothing.

Development

bash
npm installnpm run buildnpm test

Notes

Scores are advisory signals for triage and automation. They are not a legal determination of wrongdoing, and they do not by themselves discharge any regulatory obligation.

Links

License

MIT

Source: README.md at commit 3f705bd

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.2LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts