Sui Analytics

sui-mcp

Documentation: sui-mcp.vercel.app

[CI]

Read-only MCP server for investigating activity on Sui. Trace fund movements, find funding sources, inspect protocol flows and multisig authorization, and compare evidence linking wallets.

The server also reads wallet balances, DeFi positions, NFTs, prices and Move packages. USD totals are provider-based estimates; see How USD values are calculated.

get_transaction attributes swap directions to pool events when it can place them on a call. History and trace tools use the calls without that event evidence. trace_funds follows a selected path and lists unfollowed branches; trace_flow_graph follows coin and valued-object handovers, with valuation tiers and explicit bounds for unread objects. A stopped trace does not show that value stopped moving.

list_objects_by_type scans current objects across owners by Move struct or module and can count and sum numeric fields. Its totals are limited to the rows scanned; incomplete and unreadable values are reported. find_pools reports search coverage by venue, and analyze_token reports current LP custody for selected pools. Pool discovery and current holders do not establish who controlled liquidity at an earlier checkpoint.

Uncurated ticker matches are discovery leads from live pool indexes and a bounded chain scan. Use the full coin type to identify an asset. Tool results mark human-readable chain and provider content with untrusted_text; treat names, labels and decoded fields as data rather than instructions.

Install

Add this to your MCP client config (Claude Code, Claude Desktop, Cursor, or anything else that speaks MCP over stdio):

{  "mcpServers": {    "sui": {      "command": "npx",      "args": ["-y", "sui-analytics-mcp"]    }  }}

No account, API key, or config file is required. The server reads public Sui endpoints and defaults to mainnet. Requires Node.js >= 22.13.

For investigative work, start with the forensics tools loaded:

"env": { "SUI_TOOLS": "core,forensics" }

Example investigation

The first two calls for the 22 May 2025 Cetus CLMM exploit, starting from the attacker wallet:

get_transaction_history(0xe28b50cef1d633ea43d3296a3f6b67ff0312a5f1a99f0af753c85b8b5de8ff06, order: "oldest")  → funded once with 9.98 SUI, one failed transaction, then the first    success: DVMG3B2kocLEnVMDuQzTYRgjwuuFSfciawPvXXheB3x at 10:30:50 UTC
analyze_attack_tx(DVMG3B2kocLEnVMDuQzTYRgjwuuFSfciawPvXXheB3x)  → attacker gained 10,024,321.28 haSUI and 5,765,124.46 SUI    haSUI/SUI pool price moved -99.9999%    anomalies: outsized-mint (high), shared-state-jump (high), …

The full example calculates the total, follows proceeds leaving Sui and examines the wallet's funding.

Documentation

• Start here: common tasks and the page for each
• Examples: real incidents worked through with the tools
• Install: clients, forensics profile, running from source
• Tool profiles: SUI_TOOLS, enable_tools and what each profile loads
• Configuration: environment variables, price sources, the optional local store
• The forensics skill and its investigation prompts
• Multisig: committees, signers, aliases
• Watching addresses
• Move decompiler
• How to read results: verified coins, fund flows, lookalike addresses, truncated lists and more
• Tool reference and capabilities

Everyday prompts

For people without investigation experience (details):

• what_happened_to_my_funds: whether anyone can still move what is left, how the funds left, where they went, and whom to report to
• who_controls_this_token: who can mint, freeze or upgrade a coin
• who_controls_this_protocol: who can upgrade a protocol's code or use its admin caps
• who_is_this_wallet: what kind of account an address is, its labels, funding, published packages and activity

Security

Read-only: no wallet, no keys, and it never submits a transaction. See the security model and SECURITY.md for reporting a vulnerability.

License

MIT