Skip to main content
Glama

CryptoGuard

Crypto risk scanner that detected every major crash in backtesting — 27 days early, on average.

Scan any token by name, ticker, or contract address. Get a deterministic verdict: PROCEED / CAUTION / BLOCK.

Version: 0.6.0  |  Live API: https://gpartin--cryptoguard-api-fastapi-app.modal.run  |  Free tier: 5 calls/day  |  MCP: 7 tools


Backtest Results

Tested against 7 historical crypto crashes (LUNA, FTX, Celsius, 3AC, UST, SOL/FTX, TITAN) and 4 calm-market control periods. Full methodology and data: CryptoGuard backtest.

Method

Recall

Avg Lead Time

False Positive Rate

CryptoGuard (WaveGuard engine)

100% (7/7)

27.4 days

6.1%

Z-score baseline

100% (7/7)

28.4 days

29.9%

Rolling volatility

86% (6/7)

15.5 days

4.0%

5× fewer false alarms than statistical baselines with the same recall.

Example: FTX Collapse (November 2022)

On October 16, 2022, FTT was trading at $23.73. Z-score analysis saw nothing (score 1.20, PROCEED).

CryptoGuard flagged CAUTION (anomaly score 4.72). The next day it escalated to BLOCK.

23 days later, FTX collapsed. FTT fell 94%.


Related MCP server: aegis-defi

Install

pip install CryptoGuardClient

Quick Start

from cryptoguard import CryptoGuardClient

client = CryptoGuardClient()

# Validate a trade — primary use case
result = client.validate_trade("bitcoin", action="buy", amount_usd=1000)
print(result["verdict"])  # PROCEED / CAUTION / BLOCK

# Scan a token
scan = client.scan("solana")
print(scan["risk_level"])

# Rug pull check
rug = client.rug_check("solana", "0xabc123...")
print(rug["risk_score"])

# Check free tier remaining
print(client.free_tier())

Primary Endpoint

curl -X POST https://gpartin--cryptoguard-api-fastapi-app.modal.run/v1/validate-trade \
  -H "Content-Type: application/json" \
  -d '{"token": "solana", "action": "buy", "amount_usd": 500}'

First 5 calls/day are free. After that: $0.05/call via x402 USDC, or via RapidAPI.

MCP Integration (Claude Desktop / AI Agents)

CryptoGuard is an MCP server with 7 tools. Works with Claude Desktop, Cursor, or any MCP client.

Option 1: Remote HTTP (no install)

{
  "mcpServers": {
    "cryptoguard": {
      "url": "https://gpartin--cryptoguard-api-fastapi-app.modal.run/mcp",
      "transport": "http"
    }
  }
}

Option 2: uvx

{
  "mcpServers": {
    "cryptoguard": {
      "command": "uvx",
      "args": ["--from", "CryptoGuardClient", "cryptoguard-mcp"]
    }
  }
}

Option 3: pip install

{
  "mcpServers": {
    "cryptoguard": {
      "command": "python",
      "args": ["-m", "mcp_server.server"]
    }
  }
}

MCP Tools

Tool

Description

cryptoguard_validate_trade

Validate a trade → PROCEED / CAUTION / BLOCK

cryptoguard_scan_token

Anomaly scan for any token

cryptoguard_validate_trade_plus

Premium stateless decision bundle with what-if analysis

cryptoguard_counterfactual_trade

What-if sensitivity analysis with tipping-point guidance

cryptoguard_rug_check

DEX pair rug pull risk assessment

cryptoguard_search

Search tokens by name/symbol/address

cryptoguard_health

Service health check

All Endpoints

Method

Endpoint

Price

Description

POST

/v1/validate-trade

5 free/day, then $0.05

Primary — single verdict for AI agents

POST

/v1/validate-trades

5 free/day, then $0.05

Batch validate up to 20 trades

GET

/v1/scan/{coin_id}

5 free/day, then $0.05

Single token anomaly scan

POST

/v1/portfolio/scan

5 free/day, then $0.05

Portfolio batch scan (up to 50 tokens)

GET

/v1/scan/{coin_id}/history

5 free/day, then $0.05

Historical self-comparison

GET

/v1/rug-check/{chain}/{pair_address}

5 free/day, then $0.05

Rug pull risk assessment

GET

/v1/dex/new-pairs

5 free/day, then $0.05

New DEX pair discovery

GET

/v1/dex/search

5 free/day, then $0.05

DexScreener pair search

GET

/v1/dex/pair/{chain}/{pair_address}

5 free/day, then $0.05

DEX pair details

GET

/v1/dex/token/{token_address}

5 free/day, then $0.05

DEX token info

POST

/v1/intel/validate-trade-plus

$0.10/call

Premium stateless decision bundle

POST

/v1/intel/counterfactual-trade

$0.08/call

What-if sensitivity analysis

GET

/v1/track-record

Free

Historical prediction track record

POST

/v1/trend-detect

5 free/day, then $0.05

Physics-based trend detection

POST

/v1/regime-detect

5 free/day, then $0.05

Regime change detection

POST

/v1/correlation-scan

5 free/day, then $0.05

Anomalous correlation detection

POST

/v1/volatility-forecast

5 free/day, then $0.05

Physics-based volatility forecast

POST

/v1/spectral-scan

5 free/day, then $0.05

Hidden periodicity detection

POST

/v1/whale-detector

5 free/day, then $0.05

Whale activity detection

POST

/v1/momentum-pulse

5 free/day, then $0.05

Momentum pulse detection

GET

/v1/search?q=...

Free

Search tokens by name

GET

/v1/free-tier

Free

Check remaining free calls

GET

/v1/pricing

Free

Pricing details

GET

/v1/stats

Free

Service statistics

GET

/health

Free

Health check

POST

/mcp

Free

MCP endpoint (JSON-RPC 2.0)

GET

/mcp/tools

Free

List MCP tools

GET

/v1/agent/tools

Free

Agent tool catalog

GET

/v1/agent/mcp

Free

MCP server metadata

How It Works

  1. Resolves token input — CoinGecko ID, ticker symbol, or contract address (7 chains)

  2. Fetches live market data from CoinGecko + DexScreener

  3. Builds baseline from tier-matched peers (microcaps vs microcaps, large caps vs large caps)

  4. Extracts 10 time-series features per day (price ratios, volume dynamics, momentum, volatility)

  5. Runs anomaly detection — GPU-accelerated WaveGuard engine scores each token against its peer baseline

  6. Multi-check pipeline: peer scan + rug pull + history + CEX/DEX spread + concentration risk

  7. Returns verdict: PROCEED / CAUTION / BLOCK with anomaly scores and top contributing features

CryptoGuard's core scanner is powered by WaveGuard, a general-purpose anomaly detection engine that uses GPU-accelerated wave simulations instead of machine learning. Your token's feature vector is encoded onto a 3D lattice and evolved through coupled wave equations. Normal data produces stable wave patterns; anomalous data produces divergent ones.

The advantage over statistical methods: WaveGuard captures non-linear interactions between features that simple threshold checks miss. This is why it flagged FTT 13 days before z-score analysis in backtesting.

No model training, no drift, no retraining. Deterministic for the same input.

Key Features (v0.6.0)

  • Backtested: 100% recall on 7 historical crashes with 27-day average lead time

  • Free tier: 5 calls/day per IP, no signup required

  • 2 payment options: x402 USDC per-scan ($0.05) or RapidAPI plans

  • Deterministic: Same input always produces same verdict

  • MCP server: 7 tools for AI agent integration (stdio + HTTP)

  • Python SDK: pip install CryptoGuardClient with typed exceptions

  • Physics Intelligence: 7 endpoints for trend/regime/volatility/spectral/whale/momentum analysis

  • Intel endpoints: Premium validate-trade-plus ($0.10) and counterfactual-trade ($0.08)

  • Contract resolution: Accepts name, ticker, or contract address across 7 chains

  • Batch validation: Up to 20 trades or 50 tokens per call

  • Rug pull detection: DexScreener-powered liquidity and holder analysis

  • 30 REST endpoints: Complete crypto risk intelligence API

Pricing

Tier

Cost

Limit

Auth

Free

$0

5 calls/day per IP

None

Per-scan

$0.05/call

Unlimited

x402 USDC micropayment

RapidAPI Basic

$0/mo

500K requests

RapidAPI proxy key

RapidAPI Pro

$9.99/mo

10K requests

RapidAPI proxy key

RapidAPI Ultra

$29.99/mo

100K requests

RapidAPI proxy key

Architecture

AI Agent / User
    |
    v
CryptoGuard API (Modal, stateless)
    |-- MCP endpoint (7 tools, JSON-RPC 2.0)
    |-- Auth: RapidAPI → API key → x402 (USDC) → Free tier
    |-- Token resolution (name/ticker/address → CoinGecko ID, 7 chains)
    |-- Market data (CoinGecko + DexScreener, cached)
    |-- Physics Intelligence (trend, regime, correlation, volatility, spectral, whale, momentum)
    |-- Intel (validate-trade-plus, counterfactual-trade)
    +-- WaveGuard anomaly engine (GPU-accelerated)

License

MIT

Available Tools

5 tools
cryptoguard_healthA
Read-onlyIdempotent

Check CryptoGuard API health, version, and service status. No payment required. Use this to verify the service is running.

ParametersJSON Schema
NameRequiredDescriptionDefault
verboseNoReturn detailed health info including uptime and version details (default: false).

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds valuable context beyond annotations: it specifies that no payment is required (addressing cost implications) and clarifies the purpose as a verification tool. Annotations already cover read-only, non-destructive, and idempotent behavior, so the bar is lower, but the description enhances understanding without contradicting annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, followed by key usage notes, all in two concise sentences. Every sentence adds value: the first defines the tool's function, and the second provides practical guidance and exclusions, with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's low complexity (1 optional parameter, no output schema), rich annotations (covering safety and behavior), and high schema coverage, the description is mostly complete. It effectively communicates purpose and usage, though it could briefly note the idempotent nature or lack of output schema for full completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description does not mention the 'verbose' parameter or its semantics. However, with 100% schema description coverage, the schema fully documents the parameter, so the baseline is 3. The description adds no additional parameter information, but it doesn't need to compensate for gaps.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('Check'), resource ('CryptoGuard API health, version, and service status'), and scope ('verify the service is running'), distinguishing it from sibling tools that perform different operations like checking tokens or scanning. It goes beyond a tautology by detailing what aspects of the API are checked.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool ('Use this to verify the service is running') and provides a key exclusion ('No payment required'), which helps differentiate it from potential paid alternatives or other tools that might require authentication. It offers clear guidance on its intended context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cryptoguard_rug_checkA
Read-onlyIdempotent

Assess rug pull risk for a specific DEX trading pair. Scores 6 risk factors (0-100): liquidity depth, pair age, volume/liquidity ratio, price action, buy/sell imbalance, and metadata.

Example: check if a new Solana pair is a potential rug pull.

ParametersJSON Schema
NameRequiredDescriptionDefault
chainYesBlockchain (solana, ethereum, base, bsc).
pair_addressYesDEX pair contract address.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover key behavioral traits (read-only, open-world, idempotent, non-destructive), so the description adds value by detailing the six specific risk factors scored (liquidity depth, pair age, etc.) and providing an example. It does not contradict annotations, but it lacks additional context like rate limits or response format.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, followed by specific risk factors and a practical example. Every sentence adds value without redundancy, making it efficient and well-structured for quick understanding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (assessing multiple risk factors) and lack of output schema, the description is mostly complete—it explains what the tool does and the factors considered. However, it does not detail the output format (e.g., how scores are returned), which could be helpful for an agent. Annotations provide good behavioral coverage, compensating partially.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with clear descriptions for both parameters ('chain' and 'pair_address'). The description does not add meaning beyond the schema, as it focuses on the tool's purpose and risk factors rather than parameter details. Baseline 3 is appropriate given the high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('Assess rug pull risk') and resource ('for a specific DEX trading pair'), distinguishing it from siblings like health checks, token scans, searches, and trade validation. It provides concrete examples of the six risk factors being scored, making the purpose explicit and differentiated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context through the example ('check if a new Solana pair is a potential rug pull'), suggesting it's for evaluating new or suspicious pairs. However, it does not explicitly state when to use this tool versus alternatives like 'cryptoguard_scan_token' or 'cryptoguard_validate_trade', nor does it provide exclusions or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cryptoguard_scan_tokenA
Read-onlyIdempotent

Scan a single token for anomalous market behavior using WaveGuard physics-based anomaly detection. Compares the token to TIER-MATCHED peers (microcaps vs microcaps, large-caps vs large-caps). Returns anomaly scores, risk level, and explanations.

Example: scan 'solana' to check if its metrics are unusual.

ParametersJSON Schema
NameRequiredDescriptionDefault
coin_idYesCoinGecko coin ID (e.g., 'bitcoin', 'solana', 'pepe').
sensitivityNoAnomaly sensitivity multiplier (default: 1.0). Higher = more sensitive.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only, open-world, idempotent, and non-destructive behavior. The description adds valuable context beyond annotations by explaining the tier-matching peer comparison method and the types of outputs (anomaly scores, risk level, explanations), which helps the agent understand the tool's operational behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, followed by key details and a practical example. Every sentence adds value without redundancy, making it efficient and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity, rich annotations, and lack of output schema, the description is mostly complete. It explains the scanning method and output types but could benefit from more detail on result interpretation or error handling. However, it provides sufficient context for effective use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents both parameters. The description does not add any additional meaning or syntax details beyond what the schema provides, such as elaborating on the 'sensitivity' multiplier's impact. Baseline 3 is appropriate when the schema handles parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('Scan a single token for anomalous market behavior'), the method ('using WaveGuard physics-based anomaly detection'), and the comparison scope ('TIER-MATCHED peers'). It distinguishes this tool from siblings by focusing on anomaly detection rather than health checks, rug pulls, search, or trade validation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage by providing an example ('scan 'solana' to check if its metrics are unusual'), but it does not explicitly state when to use this tool versus alternatives like cryptoguard_rug_check or cryptoguard_validate_trade. No exclusions or prerequisites are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cryptoguard_validate_tradeA
Read-onlyIdempotent

Validate a crypto trade BEFORE execution. Returns a verdict: PROCEED, CAUTION, or BLOCK. Runs 5 checks: peer anomaly scan via WaveGuard physics engine, self-history comparison, rug pull risk assessment, CEX/DEX price cross-check, and concentration risk analysis. Accepts token name, symbol, or contract address.

Example: validate buying $500 of PEPE before executing.

ParametersJSON Schema
NameRequiredDescriptionDefault
tokenYesToken to validate. Can be a name (bitcoin), symbol (BTC), or contract address (0x...).
actionNoTrade action type (default: buy).
chainNoBlockchain for contract address resolution (ethereum, solana, base, bsc, polygon, avalanche, arbitrum).
pair_addressNoDEX pair address for rug pull check.
amount_usdNoTrade amount in USD for concentration risk analysis.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint=true, destructiveHint=false, openWorldHint=true, and idempotentHint=true. The description adds valuable behavioral context beyond annotations: it specifies the 5 specific checks performed (peer anomaly scan, self-history comparison, rug pull risk assessment, CEX/DEX price cross-check, concentration risk analysis) and the three possible verdict outcomes (PROCEED, CAUTION, BLOCK). This gives the agent important information about what the tool actually does.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Perfectly structured and concise. First sentence states the core purpose, second sentence explains the return value, third sentence lists the 5 checks performed, fourth sentence provides parameter guidance, and final sentence gives a concrete example. Every sentence earns its place with zero waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with rich annotations (readOnlyHint, openWorldHint, idempotentHint, destructiveHint) and 100% schema coverage, the description provides excellent context about what the tool actually does, the checks performed, and the verdict system. The only minor gap is the lack of output schema, but the description adequately explains the return values (PROCEED, CAUTION, BLOCK verdicts).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already fully documents all 5 parameters. The description adds some context by mentioning 'Accepts token name, symbol, or contract address' which reinforces the token parameter flexibility, and the example shows usage with amount_usd. However, it doesn't add significant meaning beyond what's already in the comprehensive schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific purpose: 'Validate a crypto trade BEFORE execution' with the verb 'validate' and resource 'crypto trade'. It distinguishes from siblings by focusing on pre-execution validation rather than health checks, rug checks, scans, or searches mentioned in sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use: 'BEFORE execution' and provides a concrete example ('validate buying $500 of PEPE before executing'). It implicitly distinguishes from alternatives by listing the 5 specific checks performed, which helps differentiate from sibling tools like cryptoguard_rug_check that might only do one type of check.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 5 tool updatesv0.5.0
    • First observedcryptoguard_health
    • First observedcryptoguard_rug_check
    • First observedcryptoguard_scan_token
    • First observedcryptoguard_search
    • First observedcryptoguard_validate_trade

TDQS

A4.4/5.0
Disambiguation5/5

Each tool has a clearly distinct purpose with no overlap: health check, rug pull risk assessment, token anomaly scanning, token search, and trade validation. The descriptions explicitly differentiate their functions, making it easy for an agent to select the right tool.

Naming Consistency5/5

All tools follow a consistent 'cryptoguard_' prefix with descriptive suffixes (health, rug_check, scan_token, search, validate_trade). This uniform pattern enhances readability and predictability across the toolset.

Tool Count5/5

With 5 tools, this server is well-scoped for crypto security analysis, covering essential functions from health checks to trade validation. Each tool serves a unique and necessary role without bloat or redundancy.

Completeness5/5

The toolset provides complete coverage for crypto risk assessment workflows: service verification, token search, risk scanning, rug pull detection, and trade validation. There are no obvious gaps, enabling agents to handle end-to-end security analysis.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    C
    maintenance
    Enables AI agents to scan crypto tokens for rug pulls, scams, and risk using a six-agent consensus system. It provides real-time security audits and risk scoring for tokens on Solana, Ethereum, Base, and BSC.
    6
    2
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    Provides post-deploy Solana threat intelligence, enabling AI agents to check operators, tokens, and network stats for detecting rug pulls and malicious activity.
    5
    27
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    Non-custodial agent wallet with a transaction preflight that decodes an unsigned EVM tx and flags drain patterns (unlimited/large approval, approve-all, token & NFT transferFrom, proxy upgrade, on-chain permit, approvals hidden in multicall) before signing.
    9
    1
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/gpartin/CryptoGuardClient'

If you have feedback or need assistance with the MCP directory API, please join our Discord server