Search / trade.onyxprotocol/onyx-aml
protogridR0· no sign-inCrypto address risk checks for agents: USDT/USDC blacklists, sanctions, scam lists, poisoning
v1.0.0 · active · website · descriptor JSON · versions
{
"mcpServers": {
"onyx-aml": {
"type": "http",
"url": "https://onyxprotocol.trade/mcp"
}
}
}claude mcp add --transport http onyx-aml https://onyxprotocol.trade/mcp[mcp_servers.onyx-aml]
url = "https://onyxprotocol.trade/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"onyx-aml": {
"type": "remote",
"url": "https://onyxprotocol.trade/mcp",
"enabled": true
}
}
}{
"mcpServers": {
"onyx-aml": {
"type": "http",
"url": "https://onyxprotocol.trade/mcp"
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=onyx-aml&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vb255eHByb3RvY29sLnRyYWRlL21jcCJ9"
}{
"servers": {
"onyx-aml": {
"type": "http",
"url": "https://onyxprotocol.trade/mcp"
}
}
}{
"mcpServers": {
"onyx-aml": {
"httpUrl": "https://onyxprotocol.trade/mcp"
}
}
}extensions:
"onyx-aml":
enabled: true
name: "onyx-aml"
type: streamable_http
uri: "https://onyxprotocol.trade/mcp"
timeout: 300
protocol.modernnewest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28protocol.statelessonly applies to 2026-07-28 serversprotocol.transportstreamable HTTPprotocol.list_ttlonly applies to 2026-07-28 serversauth.prm, auth.as_metadata, auth.cimdno remote uses OAuthauth.secret_in_urlno templated URLtools.descriptionsevery tool has a descriptiontools.description_lengthdescriptions are concisetools.schemasevery tool has an object input schematools.annotationsno tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky onestools.directory_hintsno tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: onyx_payment_info (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); onyx_preflight (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); onyx_screen_batch (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …tools.token_costabout 1,105 tokens to load every tooltools.api_dumptools are not a one-to-one API dumpstability.changes1 tool changes in 30 daysstability.rug_pullno tool changed its meaning under the same namedeps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI packageonyx_preflightchangeddescriptionOperational safety check for a payment, separate from risk screening. Detects address poisoning (a lookalike planted in your history so it gets copied instead of the real address), contract recipients that would swallow the tokens, and addresses that behave differently on different chains. Pass known_addresses (the counterparties you already use) to enable poisoning detection. In our live-traffic sample this class of loss came up far more often than sanctioned counterparties. Dedicated transaction-security services cover part of it; no AML screening does. Run this together with onyx_decide before every payment.
Operational safety check for a payment, separate from risk screening. Detects address poisoning (a lookalike planted in your history so it gets copied instead of the real address), contract recipients that would swallow the tokens, and addresses that behave differently on different chains. Pass known_addresses (the counterparties you already use) to enable poisoning detection. Verdicts: stop, caution, clear, or unknown: on EVM chains the recipient check could not run (retry, not charged); on TRON and Solana only the lookalike check exists (partial: true) and known_addresses is required. In our live-traffic sample this class of loss came up far more often than sanctioned counterparties. Dedicated transaction-security services cover part of it; no AML screening does. Run this together with onyx_decide before every payment.
Full history: list_changes · trend: quality JSON.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+dns-namespace +website +reachable +uptime-99% +updated-18d-ago -no-repository
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
| remote | auth | reachable | uptime 30d | p50 | protocol | last ok |
|---|---|---|---|---|---|---|
https://onyxprotocol.trade/mcp streamable-http | none | yes | 99% | 653 ms | 2025-06-18 | 2026-11-07 |
onyx_balance | How much credit your API key has left, and the current prices. Free. |
onyx_decide | Return allow / review / deny for a counterparty address against your own risk policy, with the reasons named. Use this before every outbound transfer. Checks issuer blacklists (USDT, USDC), sanctions across six EVM chains plus the OFAC list, open scam databases, community reports and behavioural patterns. Costs credit. |
onyx_payment_info | Machine-readable payment terms: which asset and network to send, the address, prices per operation, and how to claim an API key from the address you paid from. No account or signup is involved. Free, and works without a key. |
onyx_preflight | Operational safety check for a payment, separate from risk screening. Detects address poisoning (a lookalike planted in your history so it gets copied instead of the real address), contract recipients that would swallow the tokens, and addresses that behave differently on different chains. Pass known_addresses (the counterparties you already use) to enable poisoning detection. Verdicts: stop, caution, clear, or unknown: on EVM chains the recipient check could not run (retry, not charged); on TRON and Solana only the lookalike check exists (partial: true) and known_addresses is required. In our live-traffic sample this class of loss came up far more often than sanctioned counterparties. Dedicated transaction-security services cover part of it; no AML screening does. Run this together with onyx_decide before every payment. |
onyx_screen | Return the raw risk markers for one address: risk zone, issuer blacklists, sanctions coverage, scam databases, community reports, address age, balance and exchange attribution where known. Use this when you want the facts rather than a decision. Costs credit. |
onyx_screen_batch | Screen up to 50 addresses in a single call, for example before a mass payout. Priced per address, and only addresses actually screened are charged. Each result carries facts_complete so you can tell whether the behavioural facts finished loading. |
onyx_trace | Multi-hop trace of outgoing flows from an address, with attribution where a node is known (exchange labels, deposit addresses). Use it to establish provenance after receiving funds. Costs more than a screening call. |
onyx_watch | Subscribe to an address. When it enters an issuer blacklist, a sanctions list or a scam database, we POST a signed event to your callback URL. A one-off check cannot warn you about a freeze that has not happened yet. Billed per address per day. The callback must be public https. |
Schemas: list_tools.
{
"name": "trade.onyxprotocol/onyx-aml",
"title": "Onyx AML",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://onyxprotocol.trade/mcp",
"type": "streamable-http"
}
],
"version": "1.0.0",
"websiteUrl": "https://onyxprotocol.trade/en/agents",
"description": "Crypto address risk checks for agents: USDT/USDC blacklists, sanctions, scam lists, poisoning"
}