forensics-mcp

On-chain forensics MCP server providing x402-payable due-diligence tools for AI agents on Base, Ethereum, and XRPL. It offers token verdicts, settle-safe screens for RWAs, wallet trust analysis, and comprehensive token profiles to support decision-grade due diligence.

Endpoint and access

No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.

Community listingStreamable HTTPNo sign-inEndpoint checked 2026-11-01Published by Leo Sanders

You need:No API keys, no signup — the payment IS the auth.

MCP endpoint (Streamable HTTP)

https://solene-fa2010da.base44.app/functions/forensicsMcp

Vendor documentation

What you can do with it

Generate token verdict cards with activity scores and concentration flags
Screen tokenized equities and RWAs for freeze or clawback risks
Analyze wallet trust tiers and counterparty interaction risks
Produce composed token due-diligence memos with forensic evidence

Source and maintenance

Community listingRegistry 1.0.0

mcp-registry: io.github.leohoudinisanders-byte/forensics-mcp@1.0.0 Source repository

Maintenance checked: Nov 1, 2026, 8:44 AM UTC

Protocol and capabilities

Server: onchain-forensics-mcp 1.0.0
MCP protocol: 2025-06-18
Tools: 6 advertised
Resources: Not advertised
Resource templates: Not advertised
Prompts: Not advertised

Server-advertised capabilities

{
  "tools": {
    "listChanged": false
  }
}

Server-provided instructions

Untrusted server output shown for inspection. It is not Koskamo guidance and is excluded from knowledge search.

Paid tools charge per call via x402 (USDC on Base): a tools/call returns HTTP 402 with a PAYMENT-REQUIRED header until paid; sign and retry with X-PAYMENT. The forensics_info tool is free.

Tools

6 advertised

forensics_info

Advertised by the server during the last successful anonymous check.

FREE. Service directory for the On-chain Forensics MCP server: endpoint catalog, chains supported (Base, Ethereum, XRPL), pricing, tokenized-equity aliases (btsla, bcspx, rlusd, bitstamp-usd, ...) and usage examples.

forensics_info input schema

{
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

token_verdict

Advertised by the server during the last successful anonymous check.

$0.02. Token verdict card for any ERC-20 on Base or Ethereum (address+chain), any registered alias (token=btsla|ondo|edel|...), or any XRPL issued currency (chain=xrp + issuer + currency): activity score 0-100, verdict tier (RED_HOT/HEAVY_FIRE/ACTIVE/THIN/SUSPICIOUS_THIN/DORMANT), transfers, unique wallets, mints/burns, concentration, whale flags, plain-English take.

token_verdict input schema

{
  "type": "object",
  "properties": {
    "chain": {
      "enum": [
        "base",
        "ethereum",
        "xrp"
      ],
      "type": "string"
    },
    "token": {
      "type": "string",
      "description": "token alias (btsla, bcspx, ondo, edel, rlusd, bitstamp-usd, ...)"
    },
    "address": {
      "type": "string",
      "pattern": "^0x[a-fA-F0-9]{40}$|^r[1-9A-HJ-NP-Za-km-z]{24,34}$",
      "description": "EVM token contract (0x...) or XRPL issuer (r...)"
    },
    "currency": {
      "type": "string",
      "description": "XRPL issued-currency code (3 letters or 40-char hex), for chain=xrp"
    }
  },
  "additionalProperties": false
}

settle_safe

Advertised by the server during the last successful anonymous check.

$0.02. FLAGSHIP pre-trade settle-safe screen for AI agents trading tokenized equities/RWAs: canonical-asset check against the verified registry (EVM: btsla/bcspx/bnvda/aapl/nvda/usdy/ousg/...; XRPL issuers: rlusd, gatehub-usd, bitstamp-usd/eur), freeze/clawback flags, trustline breadth, optional counterparty wallet trust tier.

settle_safe input schema

{
  "type": "object",
  "properties": {
    "chain": {
      "enum": [
        "base",
        "ethereum",
        "xrp"
      ],
      "type": "string"
    },
    "token": {
      "type": "string",
      "description": "token alias (btsla, rlusd, bitstamp-usd, ...)"
    },
    "address": {
      "type": "string",
      "pattern": "^0x[a-fA-F0-9]{40}$|^r[1-9A-HJ-NP-Za-km-z]{24,34}$",
      "description": "EVM token contract or XRPL issuer"
    },
    "currency": {
      "type": "string",
      "description": "XRPL currency code (chain=xrp)"
    },
    "counterparty": {
      "type": "string",
      "pattern": "^0x[a-fA-F0-9]{40}$|^r[1-9A-HJ-NP-Za-km-z]{24,34}$",
      "description": "optional settlement counterparty wallet to trust-screen"
    }
  },
  "additionalProperties": false
}

wallet_screen

Advertised by the server during the last successful anonymous check.

$0.05. Wallet trust screen for any wallet on Base, Ethereum or XRPL (chain=xrp): balance, tx count, flows, top counterparties, contract-interaction risk, trust tier. For XRPL also trustlines and issuer screens.

wallet_screen input schema

{
  "type": "object",
  "required": [
    "address"
  ],
  "properties": {
    "chain": {
      "enum": [
        "base",
        "ethereum",
        "xrp"
      ],
      "type": "string"
    },
    "address": {
      "type": "string",
      "pattern": "^0x[a-fA-F0-9]{40}$|^r[1-9A-HJ-NP-Za-km-z]{24,34}$"
    }
  },
  "additionalProperties": false
}

token_profile

Advertised by the server during the last successful anonymous check.

$0.05. Full ERC-20 forensics profile on Base or Ethereum: exact 24h net supply change, recent mint/burn events, holder concentration, top transfers, whale moves.

token_profile input schema

{
  "type": "object",
  "properties": {
    "chain": {
      "enum": [
        "base",
        "ethereum"
      ],
      "type": "string"
    },
    "token": {
      "type": "string",
      "description": "token alias (ondo, edel, buidl, ...)"
    },
    "address": {
      "type": "string",
      "pattern": "^0x[a-fA-F0-9]{40}$"
    }
  },
  "additionalProperties": false
}

diligence_memo

Advertised by the server during the last successful anonymous check.

$0.25 composed Token Due-Diligence Memo (decision-grade, reproducible, no LLM calls): verdict + supply/flow forensics + settle-safe screen + narrative risk assessment. $0.35 when counterparty is provided (adds the settlement counterparty trust screen). EVM or XRPL.

diligence_memo input schema

{
  "type": "object",
  "properties": {
    "chain": {
      "enum": [
        "base",
        "ethereum",
        "xrp"
      ],
      "type": "string"
    },
    "token": {
      "type": "string",
      "description": "token alias"
    },
    "address": {
      "type": "string",
      "pattern": "^0x[a-fA-F0-9]{40}$|^r[1-9A-HJ-NP-Za-km-z]{24,34}$"
    },
    "currency": {
      "type": "string",
      "description": "XRPL currency code (chain=xrp)"
    },
    "counterparty": {
      "type": "string",
      "pattern": "^0x[a-fA-F0-9]{40}$|^r[1-9A-HJ-NP-Za-km-z]{24,34}$",
      "description": "optional settlement counterparty (adds trust screen, +$0.10)"
    }
  },
  "additionalProperties": false
}

Prompts

Not advertised

No prompt definitions available.

Resources

Not advertised

No resource definitions available.

30-day availability

Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.

Successful checks: 1 of 1 (100%)
Average latency: 724 ms
95th percentile latency: 724 ms

Maintenance history

Public check and source-refresh events. Editorial and ownership records remain private.

Nov 1, 2026, 8:51 AM UTC · probe · passed · 724 ms · metadata changed · 6 tool(s)

Connect from your client

Each snippet registers the same endpoint; pick the client you use.

This server is operated by the named third party. Listing and endpoint checks are not an endorsement or a security audit. Review the operator's permissions, terms, and data handling before connecting. How listings are checked and corrected.

Claude Code

Run this once in a terminal. It registers the remote server. Use --scope project to write .mcp.json for the repo.

Claude Code configuration

claude mcp add --transport http forensics-mcp https://solene-fa2010da.base44.app/functions/forensicsMcp

Codex

Run this once. Codex stores MCP servers in ~/.codex/config.toml (or .codex/config.toml in a trusted project).

Codex configuration

codex mcp add forensics-mcp --url https://solene-fa2010da.base44.app/functions/forensicsMcp

Cursor

Merge this server into .cursor/mcp.json in your project, then enable forensics-mcp in your MCP settings.

Cursor configuration

{
  "mcpServers": {
    "forensics-mcp": {
      "url": "https://solene-fa2010da.base44.app/functions/forensicsMcp"
    }
  }
}

Cline

Merge this into cline_mcp_settings.json (Cline → MCP Servers → Configure).

Cline configuration

{
  "mcpServers": {
    "forensics-mcp": {
      "type": "streamableHttp",
      "url": "https://solene-fa2010da.base44.app/functions/forensicsMcp",
      "disabled": false
    }
  }
}

VS Code

Merge this server into .vscode/mcp.json. Use MCP: List Servers to start forensics-mcp and inspect its tools.

VS Code configuration

{
  "servers": {
    "forensics-mcp": {
      "type": "http",
      "url": "https://solene-fa2010da.base44.app/functions/forensicsMcp"
    }
  }
}

Gemini CLI

Run this once. It writes .gemini/settings.json in the current project; pass --scope user for ~/.gemini/settings.json.

Gemini CLI configuration

gemini mcp add --transport http forensics-mcp https://solene-fa2010da.base44.app/functions/forensicsMcp

Claude Desktop

Merge this into claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/, Windows: %APPDATA%\Claude\), then restart Claude Desktop.

Claude Desktop configuration

{
  "mcpServers": {
    "forensics-mcp": {
      "url": "https://solene-fa2010da.base44.app/functions/forensicsMcp"
    }
  }
}

Windsurf

Merge this into ~/.codeium/windsurf/mcp_config.json, then refresh MCP in Cascade. Windsurf remote servers use serverUrl, not url.

Windsurf configuration

{
  "mcpServers": {
    "forensics-mcp": {
      "serverUrl": "https://solene-fa2010da.base44.app/functions/forensicsMcp"
    }
  }
}

Let your agent find its tools

Find servers like forensics-mcp from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.

Connect Koskamo Explore workflows