Search / io.github.0xVector0/iris
protogridR0· no sign-inOn-chain investigations: wallet analysis and fund tracing on Solana, EVM chains, Bitcoin and Tron.
v0.2.0 · active · website · descriptor JSON · versions
{
"mcpServers": {
"iris": {
"type": "http",
"url": "https://iriscan.app/mcp",
"headers": {
"Authorization": "Bearer ${iris_api_key}"
}
}
}
}claude mcp add --transport http iris https://iriscan.app/mcp --header "Authorization: Bearer ${iris_api_key}"[mcp_servers.iris]
url = "https://iriscan.app/mcp"
bearer_token_env_var = "iris_api_key"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"iris": {
"type": "remote",
"url": "https://iriscan.app/mcp",
"enabled": true,
"headers": {
"Authorization": "Bearer {env:iris_api_key}"
}
}
}
}{
"mcpServers": {
"iris": {
"type": "http",
"url": "https://iriscan.app/mcp",
"headers": {
"Authorization": "Bearer ${iris_api_key}"
}
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=iris&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vaXJpc2Nhbi5hcHAvbWNwIiwiaGVhZGVycyI6eyJBdXRob3JpemF0aW9uIjoiQmVhcmVyICR7aXJpc19hcGlfa2V5fSJ9fQ%3D%3D"
}{
"servers": {
"iris": {
"type": "http",
"url": "https://iriscan.app/mcp",
"headers": {
"Authorization": "Bearer ${iris_api_key}"
}
}
}
}{
"mcpServers": {
"iris": {
"httpUrl": "https://iriscan.app/mcp",
"headers": {
"Authorization": "Bearer ${iris_api_key}"
}
}
}
}extensions:
"iris":
enabled: true
name: "iris"
type: streamable_http
uri: "https://iriscan.app/mcp"
headers:
"Authorization": "Bearer ${iris_api_key}"
timeout: 300
Placeholders to fill from your own secret store: ${iris_api_key}. The registry never accepts secret values.
protocol.modernprotocol.statelessprotocol.transportprotocol.list_ttlauth.prm, auth.as_metadata, auth.cimdauth.secret_in_urltools.descriptionstools.description_lengthtools.schemastools.annotationstools.directory_hintstools.token_costtools.api_dumptools.hidden_textstability.changesstability.rug_pullstability.new_linksdeps.known_vulns, deps.mcp_sdk_version, deps.resolvabletrace_transferchangeddescriptionFollow one transfer through the mixer (Privacy Cash, Cloak, Umbra, encrypt.trade, MagicBlock Private Payments, ShadowWire, Solana Privacy Rings...), exchange, or instant-swap service (SideShift, ChangeNOW, FixedFloat, SimpleSwap, StealthEX, Changelly...) on its other side, by timing and amount: for a deposit, the withdrawals that match it after; for a withdrawal, the deposits that match it before. Gives the likely wallets with a confidence, and how many transfers of the same amount could also fit (the anonymity set). A swap service pays out in another asset, often on another chain: a deposit into SideShift is matched exactly from SideShift's public record of completed shifts (the coin, network and amount it paid out, and the Solana recipient), any other by value at the prices of the time (1 of N candidates). One-time deposit addresses that sweep to the service count as the service. Give the wallet and the signature (transaction hash) of a transaction where it sent money to, or received money from, a mixer, an exchange or a swap service (analyze_address and get_connections list them). Off Solana: on Tron through an exchange or an instant exchange, on an EVM chain through an instant exchange or a privacy pool (Tornado Cash, Railgun, Privacy Pools), on Bitcoin through a CoinJoin or an instant exchange. Solana Privacy Rings (Helius) is followed by owner, not amount: its default ring hides amounts but publishes owners, so a deposit leads to the withdrawals and private transfers its owner signed, and a withdrawal to the owner that signed it and what paid that owner (exact links). With hops 2, a deposit is traced as a private swap through two exchanges, the way Houdini Swap routes through two of its 12 partner exchanges (a middle coin between them that isn't followed): on any chain, also when the wallet paid an address Iris doesn't know (a partner's one-time deposit address often names nothing on chain; the largest wallet paid, or the counterparty given, is taken as it), paired with the partners' payouts within 90 minutes by value. It is called a Houdini Swap route only when a Houdini partner's wallets are on both legs; otherwise "Private swap, Houdini-style (2 exchanges)". A lead, not proof: the middle leg isn't seen, and it says how many partners were searched. A deposit into Husher's known deposit address is traced through its exchange account (Husher pays out from Binance's, KuCoin's or Bybit's hot wallets, within minutes); a payout is named by the wallets' owner ("through ChangeNOW's wallets"), never by a brand that may route through them. The chain is read from the wallet's address (pass chain for an EVM chain other than Ethereum). Costs 1 trace (or 3 pack credits), or without an API key $0.25 paid per call with x402; refunded (never settled) if it fails. Results are leads, not proof.
Follow one transfer through the mixer (Privacy Cash, Cloak, Umbra, encrypt.trade, MagicBlock Private Payments, ShadowWire, Solana Privacy Rings...), exchange, or instant-swap service (SideShift, ChangeNOW, FixedFloat, SimpleSwap, StealthEX, Changelly...) on its other side, by timing and amount: for a deposit, the withdrawals that match it after; for a withdrawal, the deposits that match it before. Gives the likely wallets with a confidence, and how many transfers of the same amount could also fit (the anonymity set). A swap service pays out in another asset, often on another chain: a deposit into SideShift is matched exactly from SideShift's public record of completed shifts (the coin, network and amount it paid out, and the Solana recipient), any other by value at the prices of the time (1 of N candidates). One-time deposit addresses that sweep to the service count as the service. Give the wallet and the signature (transaction hash) of a transaction where it sent money to, or received money from, a mixer, an exchange or a swap service (analyze_address and get_connections list them). Off Solana: on Tron through an exchange or an instant exchange, on an EVM chain through an instant exchange or a privacy pool (Tornado Cash, Railgun, Privacy Pools), on Bitcoin through a CoinJoin or an instant exchange. Solana Privacy Rings (Helius) is followed by owner, not amount: its default ring hides amounts but publishes owners, so a deposit leads to the withdrawals and private transfers its owner signed, and a withdrawal to the owner that signed it and what paid that owner (exact links). With hops 2, a deposit is traced as a private swap through two exchanges, the way Houdini Swap routes through two of its 12 partner exchanges (a middle coin between them that isn't followed): on any chain, also when the wallet paid an address Iris doesn't know (a partner's one-time deposit address often names nothing on chain; the largest wallet paid, or the counterparty given, is taken as it), paired with the partners' payouts within 90 minutes by value. It is called a Houdini Swap route only when a Houdini partner's wallets are on both legs; otherwise "Private swap, Houdini-style (2 exchanges)". A lead, not proof: the middle leg isn't seen, and it says how many partners were searched. A deposit into an exchange's deposit address (Binance, KuCoin, Bybit, OKX...: labeled, or seen sweeping into the exchange) is traced every way it can come straight back out at once, on every chain: the same exchange's payouts within minutes ("Instant swap through a Binance account": a broker on an account there, or the owner withdrawing at once), a Houdini-style route's partner payouts, and, for Husher's known deposit addresses, "Swap through Husher". One verdict line says which fits best, or "No matching withdrawal ...: most likely a plain deposit", which is common: most deposits are just deposits, and a payout without an on-chain tie to the sender scores a few percent at most. A payout is named by the wallets' owner ("through ChangeNOW's wallets"), never by a brand that may route through them. The chain is read from the wallet's address (pass chain for an EVM chain other than Ethereum). Costs 1 trace (or 3 pack credits), or without an API key $0.25 paid per call with x402; refunded (never settled) if it fails. Results are leads, not proof.
analyze_addresschangeddescriptionAnalyze a wallet with Iris: on Solana (also a token mint or a program), Ethereum, Base, Arbitrum, Robinhood Chain, BNB Chain, Polygon, Bitcoin, Tron, dYdX or Noble. The chain is read from the address (0x is Ethereum unless chain says another EVM chain). Costs 1 credit (2 when depth is over 1000), or without an API key $0.05 ($0.10 deep) paid per call with x402; refunded (never settled) if it fails. A token, or a wallet Iris hasn't read recently, can take about a minute. For a wallet: what it is (exchange, MEV bot, drainer, sniper, scam or poisoning wallet, personal wallet...), its risk score, the database's labels on it, its behaviours with example transactions, who sent it its first SOL (Solana), where its money came from and went (largest counterparties, labeled), look-alike (address poisoning) addresses, and the exchanges and mixers it moved money with, with the latest transaction for each (to use with trace_transfer). For a token mint: its creator and the creator's funder, the launch bundle and who funded it, red flags, the wallets in its groups and its top holders. For a program: who can upgrade it, who deployed it, its top callers. Only the latest transactions (depth) are read. Returns a summary and a link to the full view on iriscan.app.
Analyze a wallet with Iris: on Solana (also a token mint or a program), Ethereum, Base, Arbitrum, Robinhood Chain, BNB Chain, Polygon, Bitcoin, Tron, dYdX or Noble. The chain is read from the address (0x is Ethereum unless chain says another EVM chain). Costs 1 credit (2 when depth is over 1000), or without an API key $0.05 ($0.10 deep) paid per call with x402; refunded (never settled) if it fails. A token, or a wallet Iris hasn't read recently, can take about a minute. For a wallet: what it is (exchange, MEV bot, drainer, sniper, scam or poisoning wallet, personal wallet...), its risk score, the database's labels on it, its behaviours with example transactions, who sent it its first SOL (Solana), where its money came from and went (largest counterparties, labeled), look-alike (address poisoning) addresses, and the exchanges and mixers it moved money with, with the latest transaction for each (to use with trace_transfer). A Solana Privacy Rings user's steps there are read from the owners Rings publishes: what it deposited and for whom, whom it paid privately (amount hidden), who paid it, where its withdrawals went and whose fees it paid; a view tag alone is a lead, an anonymous policy ring is not traceable. For a token mint: its creator and the creator's funder, the launch bundle and who funded it, red flags, the wallets in its groups and its top holders. For a program: who can upgrade it, who deployed it, its top callers. Only the latest transactions (depth) are read. Returns a summary and a link to the full view on iriscan.app.
trace_transferchangeddescriptionFollow one transfer through the mixer (Privacy Cash, Cloak, Umbra, encrypt.trade, MagicBlock Private Payments, ShadowWire...), exchange, or instant-swap service (SideShift, ChangeNOW, FixedFloat, SimpleSwap, StealthEX, Changelly...) on its other side, by timing and amount: for a deposit, the withdrawals that match it after; for a withdrawal, the deposits that match it before. Gives the likely wallets with a confidence, and how many transfers of the same amount could also fit (the anonymity set). A swap service pays out in another asset, often on another chain: a deposit into SideShift is matched exactly from SideShift's public record of completed shifts (the coin, network and amount it paid out, and the Solana recipient), any other by value at the prices of the time (1 of N candidates). One-time deposit addresses that sweep to the service count as the service. Give the wallet and the signature (transaction hash) of a transaction where it sent money to, or received money from, a mixer, an exchange or a swap service (analyze_address and get_connections list them). Off Solana: on Tron through an exchange or an instant exchange, on an EVM chain through an instant exchange or a privacy pool (Tornado Cash, Railgun, Privacy Pools), on Bitcoin through a CoinJoin or an instant exchange. With hops 2, a deposit is traced as a private swap through two exchanges, the way Houdini Swap routes through two of its 12 partner exchanges (a middle coin between them that isn't followed): on any chain, also when the wallet paid an address Iris doesn't know (a partner's one-time deposit address often names nothing on chain; the largest wallet paid, or the counterparty given, is taken as it), paired with the partners' payouts within 90 minutes by value. It is called a Houdini Swap route only when a Houdini partner's wallets are on both legs; otherwise "Private swap, Houdini-style (2 exchanges)". A lead, not proof: the middle leg isn't seen, and it says how many partners were searched. A deposit into Husher's known deposit address is traced through its exchange account (Husher pays out from Binance's, KuCoin's or Bybit's hot wallets, within minutes); a payout is named by the wallets' owner ("through ChangeNOW's wallets"), never by a brand that may route through them. The chain is read from the wallet's address (pass chain for an EVM chain other than Ethereum). Costs 1 trace (or 3 pack credits), or without an API key $0.25 paid per call with x402; refunded (never settled) if it fails. Results are leads, not proof.
Follow one transfer through the mixer (Privacy Cash, Cloak, Umbra, encrypt.trade, MagicBlock Private Payments, ShadowWire, Solana Privacy Rings...), exchange, or instant-swap service (SideShift, ChangeNOW, FixedFloat, SimpleSwap, StealthEX, Changelly...) on its other side, by timing and amount: for a deposit, the withdrawals that match it after; for a withdrawal, the deposits that match it before. Gives the likely wallets with a confidence, and how many transfers of the same amount could also fit (the anonymity set). A swap service pays out in another asset, often on another chain: a deposit into SideShift is matched exactly from SideShift's public record of completed shifts (the coin, network and amount it paid out, and the Solana recipient), any other by value at the prices of the time (1 of N candidates). One-time deposit addresses that sweep to the service count as the service. Give the wallet and the signature (transaction hash) of a transaction where it sent money to, or received money from, a mixer, an exchange or a swap service (analyze_address and get_connections list them). Off Solana: on Tron through an exchange or an instant exchange, on an EVM chain through an instant exchange or a privacy pool (Tornado Cash, Railgun, Privacy Pools), on Bitcoin through a CoinJoin or an instant exchange. Solana Privacy Rings (Helius) is followed by owner, not amount: its default ring hides amounts but publishes owners, so a deposit leads to the withdrawals and private transfers its owner signed, and a withdrawal to the owner that signed it and what paid that owner (exact links). With hops 2, a deposit is traced as a private swap through two exchanges, the way Houdini Swap routes through two of its 12 partner exchanges (a middle coin between them that isn't followed): on any chain, also when the wallet paid an address Iris doesn't know (a partner's one-time deposit address often names nothing on chain; the largest wallet paid, or the counterparty given, is taken as it), paired with the partners' payouts within 90 minutes by value. It is called a Houdini Swap route only when a Houdini partner's wallets are on both legs; otherwise "Private swap, Houdini-style (2 exchanges)". A lead, not proof: the middle leg isn't seen, and it says how many partners were searched. A deposit into Husher's known deposit address is traced through its exchange account (Husher pays out from Binance's, KuCoin's or Bybit's hot wallets, within minutes); a payout is named by the wallets' owner ("through ChangeNOW's wallets"), never by a brand that may route through them. The chain is read from the wallet's address (pass chain for an EVM chain other than Ethereum). Costs 1 trace (or 3 pack credits), or without an API key $0.25 paid per call with x402; refunded (never settled) if it fails. Results are leads, not proof.
trace_transferchangeddescription, input schemaFollow one transfer through the mixer (Privacy Cash, Cloak, Umbra, encrypt.trade, MagicBlock Private Payments, ShadowWire...), exchange, or instant-swap service (SideShift, ChangeNOW, FixedFloat, SimpleSwap, StealthEX, Changelly...) on its other side, by timing and amount: for a deposit, the withdrawals that match it after; for a withdrawal, the deposits that match it before. Gives the likely wallets with a confidence, and how many transfers of the same amount could also fit (the anonymity set). A swap service pays out in another asset, often on another chain: a deposit into SideShift is matched exactly from SideShift's public record of completed shifts (the coin, network and amount it paid out, and the Solana recipient), any other by value at the prices of the time (1 of N candidates). One-time deposit addresses that sweep to the service count as the service. Give the wallet and the signature (transaction hash) of a transaction where it sent money to, or received money from, a mixer, an exchange or a swap service (analyze_address and get_connections list them). Off Solana: on Tron through an exchange or an instant exchange, on an EVM chain through an instant exchange or a privacy pool (Tornado Cash, Railgun, Privacy Pools), on Bitcoin through a CoinJoin or an instant exchange. The chain is read from the wallet's address (pass chain for an EVM chain other than Ethereum). Costs 1 trace (or 3 pack credits), or without an API key $0.25 paid per call with x402; refunded (never settled) if it fails. Results are leads, not proof.
Follow one transfer through the mixer (Privacy Cash, Cloak, Umbra, encrypt.trade, MagicBlock Private Payments, ShadowWire...), exchange, or instant-swap service (SideShift, ChangeNOW, FixedFloat, SimpleSwap, StealthEX, Changelly...) on its other side, by timing and amount: for a deposit, the withdrawals that match it after; for a withdrawal, the deposits that match it before. Gives the likely wallets with a confidence, and how many transfers of the same amount could also fit (the anonymity set). A swap service pays out in another asset, often on another chain: a deposit into SideShift is matched exactly from SideShift's public record of completed shifts (the coin, network and amount it paid out, and the Solana recipient), any other by value at the prices of the time (1 of N candidates). One-time deposit addresses that sweep to the service count as the service. Give the wallet and the signature (transaction hash) of a transaction where it sent money to, or received money from, a mixer, an exchange or a swap service (analyze_address and get_connections list them). Off Solana: on Tron through an exchange or an instant exchange, on an EVM chain through an instant exchange or a privacy pool (Tornado Cash, Railgun, Privacy Pools), on Bitcoin through a CoinJoin or an instant exchange. With hops 2, a deposit is traced as a private swap through two exchanges, the way Houdini Swap routes through two of its 12 partner exchanges (a middle coin between them that isn't followed): on any chain, also when the wallet paid an address Iris doesn't know (a partner's one-time deposit address often names nothing on chain; the largest wallet paid, or the counterparty given, is taken as it), paired with the partners' payouts within 90 minutes by value. It is called a Houdini Swap route only when a Houdini partner's wallets are on both legs; otherwise "Private swap, Houdini-style (2 exchanges)". A lead, not proof: the middle leg isn't seen, and it says how many partners were searched. A deposit into Husher's known deposit address is traced through its exchange account (Husher pays out from Binance's, KuCoin's or Bybit's hot wallets, within minutes); a payout is named by the wallets' owner ("through ChangeNOW's wallets"), never by a brand that may route through them. The chain is read from the wallet's address (pass chain for an EVM chain other than Ethereum). Costs 1 trace (or 3 pack credits), or without an API key $0.25 paid per call with x402; refunded (never settled) if it fails. Results are leads, not proof.
get_connectionschangedinput schematrace_transferchangedinput schemaanalyze_addresschangeddescription, input schemaAnalyze a wallet with Iris: on Solana (also a token mint or a program), Ethereum, Base, Arbitrum, Robinhood Chain, BNB Chain, Bitcoin, Tron, dYdX or Noble. The chain is read from the address (0x is Ethereum unless chain says another EVM chain). Costs 1 credit (2 when depth is over 1000), or without an API key $0.05 ($0.10 deep) paid per call with x402; refunded (never settled) if it fails. A token, or a wallet Iris hasn't read recently, can take about a minute. For a wallet: what it is (exchange, MEV bot, drainer, sniper, scam or poisoning wallet, personal wallet...), its risk score, the database's labels on it, its behaviours with example transactions, who sent it its first SOL (Solana), where its money came from and went (largest counterparties, labeled), look-alike (address poisoning) addresses, and the exchanges and mixers it moved money with, with the latest transaction for each (to use with trace_transfer). For a token mint: its creator and the creator's funder, the launch bundle and who funded it, red flags, the wallets in its groups and its top holders. For a program: who can upgrade it, who deployed it, its top callers. Only the latest transactions (depth) are read. Returns a summary and a link to the full view on iriscan.app.
Analyze a wallet with Iris: on Solana (also a token mint or a program), Ethereum, Base, Arbitrum, Robinhood Chain, BNB Chain, Polygon, Bitcoin, Tron, dYdX or Noble. The chain is read from the address (0x is Ethereum unless chain says another EVM chain). Costs 1 credit (2 when depth is over 1000), or without an API key $0.05 ($0.10 deep) paid per call with x402; refunded (never settled) if it fails. A token, or a wallet Iris hasn't read recently, can take about a minute. For a wallet: what it is (exchange, MEV bot, drainer, sniper, scam or poisoning wallet, personal wallet...), its risk score, the database's labels on it, its behaviours with example transactions, who sent it its first SOL (Solana), where its money came from and went (largest counterparties, labeled), look-alike (address poisoning) addresses, and the exchanges and mixers it moved money with, with the latest transaction for each (to use with trace_transfer). For a token mint: its creator and the creator's funder, the launch bundle and who funded it, red flags, the wallets in its groups and its top holders. For a program: who can upgrade it, who deployed it, its top callers. Only the latest transactions (depth) are read. Returns a summary and a link to the full view on iriscan.app.
Full history: list_changes · trend: quality JSON.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+website +reachable +uptime-95% +updated-16d-ago -no-repository
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
| remote | auth | reachable | uptime 30d | p50 | protocol | last ok |
|---|---|---|---|---|---|---|
https://iriscan.app/mcp streamable-http | none | yes | 95% | 464 ms | 2025-06-18 | 2026-11-14 |
analyze_addressread-only | Analyze a wallet with Iris: on Solana (also a token mint or a program), Ethereum, Base, Arbitrum, Robinhood Chain, BNB Chain, Polygon, Bitcoin, Tron, dYdX or Noble. The chain is read from the address (0x is Ethereum unless chain says another EVM chain). Costs 1 credit (2 when depth is over 1000), or without an API key $0.05 ($0.10 deep) paid per call with x402; refunded (never settled) if it fails. A token, or a wallet Iris hasn't read recently, can take about a minute. For a wallet: what it is (exchange, MEV bot, drainer, sniper, scam or poisoning wallet, personal wallet...), its risk score, the database's labels on it, its behaviours with example transactions, who sent it its first SOL (Solana), where its money came from and went (largest counterparties, labeled), look-alike (address poisoning) addresses, and the exchanges and mixers it moved money with, with the latest transaction for each (to use with trace_transfer). A Solana Privacy Rings user's steps there are read from the owners Rings publishes: what it deposited and for whom, whom it paid privately (amount hidden), who paid it, where its withdrawals went and whose fees it paid; a view tag alone is a lead, an anonymous policy ring is not traceable. For a token mint: its creator and the creator's funder, the launch bundle and who funded it, red flags, the wallets in its groups and its top holders. For a program: who can upgrade it, who deployed it, its top callers. Only the latest transactions (depth) are read. Returns a summary and a link to the full view on iriscan.app. |
find_token_insidersread-only | Find the wallets a token's creator is linked to by money (a Solana token, or a Robinhood Chain or BNB Chain one with chain): wallets it funded, wallets that paid it, wallets with the same funder, among the token's earliest buyers, the wallets handed tokens at launch and its largest holders. Says how much of the supply they bought and hold, with the transactions that link them, and why none were found when none were. Costs 2 credits, or without an API key $0.10 paid per call with x402; refunded (never settled) if it fails. Can take up to two minutes. Results are leads, not proof. |
get_connectionsread-only | Every counterparty of an address that analyze_address analyzed in the last hour on this account (without an API key: for the x402 payer whose receipt is given): wallets it sent to or received from and the venues it swapped on, with labels, the native coin (SOL, ETH, BTC, TRX...) and stablecoins moved each way, the number of transactions, and the date and signature of its first and last transfer (for trace_transfer). Covers the transactions that analysis read only. For a token: the wallets in its groups (creator, bundlers, insiders, wallets handed supply) and its top holders. Free, from the earlier analysis; run analyze_address first. |
get_creditsread-only | The account's plan and what is left: analyses, traces and pack credits, when the allowance renews, and what each tool costs. Without an API key: what each tool costs per call with x402. Free. |
scan_launch_toolread-only | Whether a Solana wallet launched or traded memecoins with a launch kit, Proxima (proxima.tools) or BlockX, with the evidence. Proxima: its 5% sell fees (a separate bare transfer after each sell, built with it), its 5% cut of pump.fun creator-fee claims, its receipt round trips (895,880 lamports out, 890,880 back). BlockX: its fee inside each trade (0.4% to 0.8%), its nonce relay funding, cash-outs through nonce accounts created and emptied within seconds, its sweep of their rent. Lists the tokens the wallet launched and the relays tipped, the sells the tool took its fee on, each fee wallet (what it was paid, its balance now, whether it ever sent anything out), the creator-fee claims, and the tree of wallets that funded it, walked up to its root funder with what Iris knows of that root. A token's mint scans its creator. Free with an API key, or without one $0.02 paid per call with x402; never settled if it fails. Can take up to two minutes. |
trace_transferread-only | Follow one transfer through the mixer (Privacy Cash, Cloak, Umbra, encrypt.trade, MagicBlock Private Payments, ShadowWire, Solana Privacy Rings...), exchange, or instant-swap service (SideShift, ChangeNOW, FixedFloat, SimpleSwap, StealthEX, Changelly...) on its other side, by timing and amount: for a deposit, the withdrawals that match it after; for a withdrawal, the deposits that match it before. Gives the likely wallets with a confidence, and how many transfers of the same amount could also fit (the anonymity set). A swap service pays out in another asset, often on another chain: a deposit into SideShift is matched exactly from SideShift's public record of completed shifts (the coin, network and amount it paid out, and the Solana recipient), any other by value at the prices of the time (1 of N candidates). One-time deposit addresses that sweep to the service count as the service. Give the wallet and the signature (transaction hash) of a transaction where it sent money to, or received money from, a mixer, an exchange or a swap service (analyze_address and get_connections list them). Off Solana: on Tron through an exchange or an instant exchange, on an EVM chain through an instant exchange or a privacy pool (Tornado Cash, Railgun, Privacy Pools), on Bitcoin through a CoinJoin or an instant exchange. Solana Privacy Rings (Helius) is followed by owner, not amount: its default ring hides amounts but publishes owners, so a deposit leads to the withdrawals and private transfers its owner signed, and a withdrawal to the owner that signed it and what paid that owner (exact links). With hops 2, a deposit is traced as a private swap through two exchanges, the way Houdini Swap routes through two of its 12 partner exchanges (a middle coin between them that isn't followed): on any chain, also when the wallet paid an address Iris doesn't know (a partner's one-time deposit address often names nothing on chain; the largest wallet paid, or the counterparty given, is taken as it), paired with the partners' payouts within 90 minutes by value. It is called a Houdini Swap route only when a Houdini partner's wallets are on both legs; otherwise "Private swap, Houdini-style (2 exchanges)". A lead, not proof: the middle leg isn't seen, and it says how many partners were searched. A deposit into an exchange's deposit address (Binance, KuCoin, Bybit, OKX...: labeled, or seen sweeping into the exchange) is traced every way it can come straight back out at once, on every chain: the same exchange's payouts within minutes ("Instant swap through a Binance account": a broker on an account there, or the owner withdrawing at once), a Houdini-style route's partner payouts, and, for Husher's known deposit addresses, "Swap through Husher". One verdict line says which fits best, or "No matching withdrawal ...: most likely a plain deposit", which is common: most deposits are just deposits, and a payout without an on-chain tie to the sender scores a few percent at most. A payout is named by the wallets' owner ("through ChangeNOW's wallets"), never by a brand that may route through them. The chain is read from the wallet's address (pass chain for an EVM chain other than Ethereum). Costs 1 trace (or 3 pack credits), or without an API key $0.25 paid per call with x402; refunded (never settled) if it fails. Results are leads, not proof. |
Schemas: list_tools.
{
"name": "io.github.0xVector0/iris",
"icons": [
{
"src": "https://iriscan.app/icon-512.png",
"sizes": [
"512x512"
],
"mimeType": "image/png"
},
{
"src": "https://iriscan.app/icon.svg",
"sizes": [
"any"
],
"mimeType": "image/svg+xml"
}
],
"title": "Iris",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://iriscan.app/mcp",
"type": "streamable-http",
"headers": [
{
"name": "Authorization",
"value": "Bearer {iris_api_key}",
"isSecret": true,
"variables": {
"iris_api_key": {
"isSecret": true,
"description": "Your Iris API key, starting with iris_live_."
}
},
"description": "Optional. 'Bearer iris_live_...', an Iris API key from Account > API on iriscan.app (10 free calls a day, paid plans above that). Without it, paid tools are paid per call in USDC with x402."
}
]
}
],
"version": "0.2.0",
"websiteUrl": "https://iriscan.app/mcp",
"description": "On-chain investigations: wallet analysis and fund tracing on Solana, EVM chains, Bitcoin and Tron."
}