trade.onyxprotocolPublished by onyxprotocol.tradeOfficial publisherv1.0.0Updated Oct 24, 2026
Crypto address risk checks for agents: USDT/USDC blacklists, sanctions, scam lists, poisoning
Onyx AML's hosted MCP server (onyxprotocol.trade), published by onyxprotocol.trade; no sign-in required; Streamable HTTP; 8 tools.
No AI overview yet: these facts come from the registry entry and the server itself.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/trade.onyxprotocol%2Fonyx-aml/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Add this to your client's mcpServers config.
{
"mcpServers": {
"onyx-aml": {
"type": "http",
"url": "https://onyxprotocol.trade/mcp"
}
}
}Decide whether to transact with an address
Return allow / review / deny for a counterparty address against your own risk policy, with the reasons named. Use this before every outbound transfer. Checks issuer blacklists (USDT, USDC), sanctions across six EVM chains plus the OFAC list, open scam databases, community reports and behavioural patterns. Costs credit.
policyaddressrequiredamount_usdScreen one address
Return the raw risk markers for one address: risk zone, issuer blacklists, sanctions coverage, scam databases, community reports, address age, balance and exchange attribution where known. Use this when you want the facts rather than a decision. Costs credit.
addressrequiredScreen many addresses at once
Screen up to 50 addresses in a single call, for example before a mass payout. Priced per address, and only addresses actually screened are charged. Each result carries facts_complete so you can tell whether the behavioural facts finished loading.
addressesrequiredCheck this is the address you mean, before paying
Operational safety check for a payment, separate from risk screening. Detects address poisoning (a lookalike planted in your history so it gets copied instead of the real address), contract recipients that would swallow the tokens, and addresses that behave differently on different chains. Pass known_addresses (the counterparties you already use) to enable poisoning detection. In our live-traffic sample this class of loss came up far more often than sanctioned counterparties. Dedicated transaction-security services cover part of it; no AML screening does. Run this together with onyx_decide before every payment.
addressrequiredknown_addressesTrace where funds went
Multi-hop trace of outgoing flows from an address, with attribution where a node is known (exchange labels, deposit addresses). Use it to establish provenance after receiving funds. Costs more than a screening call.
addressrequiredWatch an address and get a webhook when it turns toxic
Subscribe to an address. When it enters an issuer blacklist, a sanctions list or a scam database, we POST a signed event to your callback URL. A one-off check cannot warn you about a freeze that has not happened yet. Billed per address per day. The callback must be public https.
addressrequiredcallback_urlrequiredCheck remaining credit
How much credit your API key has left, and the current prices. Free.
Takes no parameters.
How to pay and get an API key
Machine-readable payment terms: which asset and network to send, the address, prices per operation, and how to claim an API key from the address you paid from. No account or signup is involved. Free, and works without a key.
Takes no parameters.
83% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.
A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.