# com.oceanalt/aml

> Pre-payment checks for AI agents: sanctions and AML screening of payees, payment pages and requests.

- name: com.oceanalt/aml
- version: 0.7.4
- connection class: R0 (autonomous)
- trust: 96/100
- quality: 85/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/com.oceanalt%2Faml
- tools: https://api.protogrid.dev/v1/servers/com.oceanalt%2Faml/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "aml": {
      "type": "http",
      "url": "https://oceanalt.com/api/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 100
- freshness: 100
- provenance: 85
- drivers: +repository +dns-namespace +website +reachable +uptime-99% +updated-1d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 85/100 (good)

### protocol: 100 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- pass `protocol.list_ttl`: tool list is cacheable (ttlMs 3600000)

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 79 (weight 30)

- pass `tools.descriptions`: every tool has a description
- warn `tools.description_length`: 1 tools have descriptions over 1,024 characters, which crowds the context
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 13 of 13 tools declare readOnlyHint or destructiveHint
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: screen_endpoint (destructiveHint); check_calldata_intent (destructiveHint); payee_decide (destructiveHint); …
- pass `tools.token_cost`: about 4,117 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 75 (weight 15)

- warn `stability.changes`: 17 tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: deps.dev does not know oceanalt-aml-mcp@0.7.4

- tools: 13, about 4,117 tokens to load them all
- tool set hash: 66281642c23b179fd98c89b39452d2c0
- tools last changed: 2026-10-19T21:14:39.975Z
- badge: [![protogrid quality](https://protogrid.dev/badge/com.oceanalt/aml.svg)](https://protogrid.dev/servers/com.oceanalt/aml)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-19 `screen_address` changed (inputSchema)
- 2026-10-19 `payment_decision` changed (inputSchema)
- 2026-10-18 `check_payment_request` added
  - Call this before paying because an email, invoice or chat message asked you to. Pass what you received: raw headers if you have them, the From line, subject and body (or body_html), and the payee address if you already extracted one. OceanAlt checks whether the sender is who it claims to be (SPF/DKIM/DMARC results, a display name that names another domain, Reply-To sent elsewhere), whether the sender domain or any link imitates a brand or is a known phishing host, whether the payee address is listed or differs from previous_pay_to, and whether the text pressures the reader, announces changed payment details, or carries instructions aimed at an AI. Returns allow | review | decline with findings. On decline, do not pay from this message; confirm through a channel you already trust. The text is processed in memory and not stored. Free, no API key.
- 2026-10-17 `screen_endpoint` changed (outputSchema)
- 2026-10-17 `screen_address` changed (outputSchema)
- 2026-10-17 `payment_decision` changed (outputSchema)
- 2026-10-14 `payment_decision` changed (inputSchema)
- 2026-10-14 `screen_address` changed (inputSchema)
- 2026-10-14 `payment_decision` changed (description, inputSchema)
  - before: Call this before every payment your agent makes. Free, no signup, no API key. Pass the payee address the agent is about to pay; get a machine-executable decision: allow | review | decline, plus verifiable evidence and retry semantics — use it as a gate: if the decision is not "allow", do not pay. On allow/review it also returns a verifiable compliance attestation you can attach to the settlement so the payment carries proof it passed OceanAlt's decision. Pass resource_url (the URL that returned the 402 quote) and OceanAlt also asks that site for its own payment quote: if the quote names a different payee, or the site cannot be checked, the decision is raised to review. A match only shows the site and the payee agree; it is not an endorsement of the seller. Every decision carries a receipt signed with Ed25519 that you can verify offline with the public key at https://oceanalt.com/.well-known/oceanalt-keys.json. Free, no API key.
  - after: Call this before every payment your agent makes. Free, no signup, no API key. To see it work first, call it with {"to":"0xd90e2f925DA726b50C4Ed8D0Fb90Ad053324F31b","network":"ethereum"}: that address is a known mixer, so the answer is decline with the matching list as evidence. Pass the payee address the agent is about to pay; get a machine-executable decision: allow | review | decline, plus verifiable evidence and retry semantics — use it as a gate: if the decision is not "allow", do not pay. On allow/review it also returns a verifiable compliance attestation you can attach to the settlement so the payment carries proof it passed OceanAlt's decision. Pass resource_url (the URL that returned the 402 quote) and OceanAlt also asks that site for its own payment quote: if the quote names a different payee, or the site cannot be checked, the decision is raised to review. A match only shows the site and the payee agree; it is not an endorsement of the seller. Every decision carries a receipt signed with Ed25519 that you can verify offline with the public key at https://oceanalt.com/.well-known/oceanalt-keys.json. Free, no API key.
- 2026-10-13 `payment_decision` changed (description, inputSchema)
  - before: Call this before every payment your agent makes. Free, no signup, no API key. Pass the payee address the agent is about to pay; get a machine-executable decision: allow | review | decline, plus verifiable evidence and retry semantics — use it as a gate: if the decision is not "allow", do not pay. On allow/review it also returns a verifiable compliance attestation you can attach to the settlement so the payment carries proof it passed OceanAlt's decision. Free, no API key.
  - after: Call this before every payment your agent makes. Free, no signup, no API key. Pass the payee address the agent is about to pay; get a machine-executable decision: allow | review | decline, plus verifiable evidence and retry semantics — use it as a gate: if the decision is not "allow", do not pay. On allow/review it also returns a verifiable compliance attestation you can attach to the settlement so the payment carries proof it passed OceanAlt's decision. Pass resource_url (the URL that returned the 402 quote) and OceanAlt also asks that site for its own payment quote: if the quote names a different payee, or the site cannot be checked, the decision is raised to review. A match only shows the site and the payee agree; it is not an endorsement of the seller. Every decision carries a receipt signed with Ed25519 that you can verify offline with the public key at https://oceanalt.com/.well-known/oceanalt-keys.json. Free, no API key.

Full history: https://api.protogrid.dev/v1/servers/com.oceanalt%2Faml/changes

## Dependencies

- npm oceanalt-aml-mcp@0.7.4: unknown

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://oceanalt.com/api/mcp (streamable-http, auth none, reachable true, uptime30d 0.9918699)

## Packages

- npm oceanalt-aml-mcp@0.7.4

## Tools (13)

- `attest_control_baseline`: File your operator's control-baseline attestation — the counterpart to counterparty_control_baseline. That tool asks what controls the OTHER side runs; this one publishes what YOUR side runs, so payers can see it before settling with you. No account, no key, one call. Gaps are allowed and expected: answer false where a control is not in place and describe how you plan to close it in gapPlan. A filing with declared gaps is worth far more than no filing — it lets a payer decide against a known shape instead of a blank. Get the control ids from the baseline list first. Only file for a party you are actually authorised to speak for.
- `baseline_controls`: Fetch the OceanAlt Agent Control Baseline: the list of controls an agent operator is expected to run before it is allowed to move money, each answerable yes or no. Call this before attest_control_baseline so you file against real control ids. Each control carries which gate enforces it and why it exists.
- `check_calldata_intent`: Anti blind-signing. EVM: decodes what a transaction's calldata will actually do (ERC-20 transfer/approve/permit, setApprovalForAll, ownership transfer, native transfer). Solana: decodes a whole base64 transaction (SPL Token / Token-2022 Transfer, TransferChecked, Approve, SetAuthority, CloseAccount, Burn; System Transfer / Assign; ATA creation). Compares it with what you believe you are doing. EVM: pass intent:{action:'pay', to, amount} plus contract (the transaction's to) and data (hex calldata). Solana: pass network:'solana' and transaction (base64) instead of data. decision match = does what you declared; mismatch = different recipient/amount/asset, or an approval / authority change instead of a payment — do not sign; unknown = could not decode (including address-lookup-table accounts), which is not the same as safe.
- `check_payment_request`: Call this before paying because an email, invoice or chat message asked you to. Pass what you received: raw headers if you have them, the From line, subject and body (or body_html), and the payee address if you already extracted one. OceanAlt checks whether the sender is who it claims to be (SPF/DKIM/DMARC results, a display name that names another domain, Reply-To sent elsewhere), whether the sender domain or any link imitates a brand or is a known phishing host, whether the payee address is listed or differs from previous_pay_to, and whether the text pressures the reader, announces changed payment details, or carries instructions aimed at an AI. Returns allow | review | decline with findings. On decline, do not pay from this message; confirm through a channel you already trust. The text is processed in memory and not stored. Free, no API key.
- `counterparty_control_baseline`: Answers a different question from address screening. Screening asks whether an address is risky; this asks how much damage the agent on the other side could do if it were talked into something. Returns that party's self-attestation against the OceanAlt Agent Control Baseline, split into two sets that must NOT be conflated: verified_by_oceanalt (enforced by the gateway on every payment — provable) and self_claimed (what they state about their own side — NOT verified by OceanAlt). Most parties have not attested: found:false means no information, not a bad signal.
- `evidence_bundle`: Everything OceanAlt holds about an address as public facts, in one Ed25519-signed bundle you can verify offline: screening verdict with evidence and freshness, profile signals, one-hop relations to listed addresses, fulfillment receipt stats and coverage. A witness, not a prosecutor: no conclusions about people. Same as GET https://oceanalt.com/api/evidence/bundle.
- `payee_decide`: The receiving side's check before settlement. Given the payee's registry id (sid) and, optionally, the payer, amount and purpose, returns accept / decline / hold_request_info / not_ready with reason codes, the fields to request, evidence and a signature. Rule-based, not a model's opinion. Same logic as POST https://oceanalt.com/api/payee/decide.
- `payment_decision`: Call this before every payment your agent makes. Free, no signup, no API key. To see it work first, call it with {"to":"0xd90e2f925DA726b50C4Ed8D0Fb90Ad053324F31b","network":"ethereum"}: that address is a known mixer, so the answer is decline with the matching list as evidence. Pass the payee address the agent is about to pay; get a machine-executable decision: allow | review | decline, plus verifiable evidence and retry semantics — use it as a gate: if the decision is not "allow", do not pay. On allow/review it also returns a verifiable compliance attestation you can attach to the settlement so the payment carries proof it passed OceanAlt's decision. Pass resource_url (the URL that returned the 402 quote) and OceanAlt also asks that site for its own payment quote: if the quote names a different payee, or the site cannot be checked, the decision is raised to review. A match only shows the site and the payee agree; it is not an endorsement of the seller. Every decision carries a receipt signed with Ed25519 that you can verify offline with the public key at https://oceanalt.com/.well-known/oceanalt-keys.json. Free, no API key.
- `recent_flagged`: Return a representative sample of addresses on OceanAlt's reviewed risk list — OFAC-sanctioned, known mixers, and scam/phishing — each with its source category and reason. Takes no arguments. Free, no API key.
- `resolve_agent_identity`: Resolves who stands behind a paying agent: agent -> principal -> mandate -> credential -> wallet. Each link reports whether it holds; completeness counts how many do (a factual count, not a score). Wherever the chain breaks is where accountability stops. Publication is opt-in and only posture is exposed (that a ceiling exists, never its value), so found:false means the agent has not published — absence of information, not a bad signal.
- `screen_address`: Run an AML compliance screen on a single blockchain address BEFORE paying or receiving from it — the pre-payment check on a counterparty. Checks OFAC sanctions, known mixers, scam and phishing lists, stablecoin issuer freezes, and on-chain heuristics. Returns a verdict (clear | caution | risky), a 0–100 risk score, a blocked flag, and the matching signals — receipts, not a black-box score. A clear verdict means nothing was found in the data OceanAlt holds; it is not a statement that the address is safe. Depth varies by chain (see coverage.chains at /.well-known/agent-capabilities). Supports EVM (0x…), Tron (T…), Solana (base58). Free, no API key.
- `screen_endpoint`: Screen a payment ENDPOINT (URL or domain) before calling it — the half that address screening cannot answer. In x402 the agent discovers a URL first, receives a 402, and only then learns where to pay: if that endpoint is spoofed, the payee address it hands back is freshly generated and appears on no sanctions list. Checks the hostname and its parent domains against phishing-domain intelligence plus hostname shape signals (bare IP, punycode homograph, deep subdomain nesting, free hosting). Returns clear | caution | risky | unknown with language-independent signal_keys. A clear verdict means no match was found, NOT that the endpoint is safe — freshly registered phishing hosts always precede any list. Use together with screen_address. Free, no API key.
- `verify_payment_requirements`: Before paying an x402 402 response, check that its payment requirements (payTo, amount, asset, network, resource) were signed by the seller and not altered in transit by a proxy, CDN, SDK or another tool. x402 v2 carries the requirements in the PAYMENT-REQUIRED response header (base64 JSON): pass either the decoded JSON or the raw base64 value as body. Optionally pass expect:{payTo, amount} — the address and amount you are about to pay — and the tool also checks they match what was signed. verified:false with reason_code no_signature means the seller does not sign (unprotected, not necessarily malicious); digest_mismatch or signature_invalid means the response was tampered with — do not pay.