Skip to main content
Glama
wallettriage

WalletTriage MCP

Official
by wallettriage
OverviewSchemaRelated ServersScoreDiscussions
JavaScript
Remote

wallettriage-mcp

MCP server for WalletTriage — real-time exploit-exposure check for EVM wallets, built for AI agents. Each query is paid via x402 (USDC on Base) signed locally by a session key: no signup, no API key, no prompts. Stateless — nothing about you or your queries is persisted.

Tools

  • check_address_risk (paid) — real-time risk for an EVM address: dangerous ERC20 approvals cross-referenced with a live threat feed of contracts under attack. Returns risk_score (0–100), risk_level and actionable findings.

  • get_pricing (free) — service status and current price per query.

Related MCP server: Cabal-Hunter

Setup (Claude Desktop, Claude Code, Cursor)

Requires Node 20+. Add to your MCP config (e.g. claude_desktop_config.json):

{
  "mcpServers": {
    "wallettriage": {
      "command": "npx",
      "args": ["-y", "wallettriage-mcp"],
      "env": {
        "GATEWAY_URL": "https://api.wallettriage.com",
        "EVM_PRIVATE_KEY": "0xREPLACE_WITH_SESSION_WALLET_PRIVATE_KEY",
        "MAX_PAYMENT_ATOMIC": "100000"
      }
    }
  }
}

Fund the session wallet with a few USDC on Base. Use a dedicated, low-balance wallet — never your main key. It only signs gasless EIP-3009 USDC payments; WalletTriage never holds or moves funds.

EVM_PRIVATE_KEY is the wallet's private key (0x + 64 hex), not its address. No ETH needed — payments are gasless (EIP-3009). Test connectivity first with the free get_pricing tool before funding.

Then ask your agent: "Check the risk of 0xd8dA… before I interact with it."

Troubleshooting

  • unable to verify the first certificate (common on Windows / corporate networks): your antivirus or proxy intercepts TLS and Node doesn't use the system certificate store by default. Add "NODE_OPTIONS": "--use-system-ca" to the env block. Never disable TLS verification — payments travel in headers and must not be tamperable.

  • EVM_PRIVATE_KEY is malformed: the value must be 0x + 64 hex characters (the private key of the session wallet). Check for placeholder text, missing 0x or stray whitespace.

  • Gateway unreachable: GATEWAY_URL defaults to https://api.wallettriage.com. If you overrode it (e.g. to a local gateway), make sure that host is reachable and running.

Environment variables

Variable

Required

Default

Purpose

EVM_PRIVATE_KEY

yes

—

Session key that signs x402 payments (USDC on Base)

GATEWAY_URL

no

https://api.wallettriage.com

WalletTriage API base URL. Defaults to production; set http://localhost:4021 for local dev (https enforced for non-local hosts)

MAX_PAYMENT_ATOMIC

no

100000 (US$0.10)

Refuses any 402 requirement above this cap (atomic USDC units, 6 decimals)

DEFAULT_SCAN_CHAIN

no

eth

Default chain: eth, base, polygon, arbitrum, optimism, bsc

Local development

npm install
cp .env.example .env   # set EVM_PRIVATE_KEY
npm start              # runs src/server.ts via tsx (stdio)

Point at a local gateway with GATEWAY_URL=http://localhost:4021, or test with the MCP Inspector:

npx @modelcontextprotocol/inspector npx tsx src/server.ts

npm run build emits dist/server.js (the published bin).

Available Tools

2 tools
check_address_riskA

Real-time risk check for an EVM wallet address BEFORE acting on it. Cross-references active ERC20 approvals with a live exploit threat feed (contracts under attack right now). Returns risk_score (0-100), risk_level (low/medium/high/critical) and actionable findings. PAID per query via x402 (USDC on Base) using the configured session key — no signup, no API key.

ParametersJSON Schema
NameRequiredDescriptionDefault
chainNoChain to scan: eth, base, polygon, arbitrum, optimism, bsc. Default: eth
addressYesEVM address to check (0x...)

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It discloses real-time nature, cross-referencing with exploit feed, return fields (risk_score, risk_level, findings), and payment method (x402 USDC). Missing details on error handling or side effects, but overall strong behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is two sentences, front-loaded with purpose and key details. It is efficient but slightly verbose with payment info. Overall well-structured for an agent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, description adequately covers return types (risk_score, risk_level, findings) and payment context. Missing error behavior or address validation, but sufficient for typical use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has 100% description coverage for both parameters. The description adds minimal value beyond schema: it specifies default chain ('eth') and lists supported chains. Baseline 3 is appropriate as schema already covers meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: performing a real-time risk check on an EVM address before acting. It specifies the resource (EVM wallet address) and context (cross-referencing approvals with exploit feed). It distinguishes from sibling tool 'get_pricing' which is unrelated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description indicates when to use ('BEFORE acting on it') and mentions payment model. However, it does not explicitly state when not to use or provide alternatives to sibling tools. The guidance is clear but lacks exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_pricingA

Free: returns WalletTriage service status and the current price per risk query (paid via x402, USDC on Base).

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden for behavioral disclosure. It mentions that the tool is free and specifies the payment method (x402, USDC on Base), but does not disclose any potential side effects, rate limits, or authentication requirements. The behavioral context is minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence with no wasted words. It is front-loaded with 'Free:' and immediately states the purpose. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has zero parameters, no output schema, and no annotations, the description provides sufficient context: it returns service status and pricing, and the payment method. The sibling tool is mentioned in context, aiding selection. Minor gaps include lack of detail on what 'status' encompasses, but overall complete for a simple tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has no parameters, so schema_description_coverage is 100%. The baseline is 3, but the description adds value by explaining what the tool returns (status and price) beyond the empty schema, effectively compensating for the lack of parameter information.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'returns' and clearly identifies the resources: WalletTriage service status and current price per risk query. It implicitly distinguishes from the sibling tool 'check_address_risk' by focusing on pricing and status rather than risk assessment.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for obtaining pricing information but does not explicitly state when to use this tool versus the sibling 'check_address_risk'. No alternative names or exclusion criteria are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 2 tool updatesv0.1.4
    • First observedcheck_address_risk
    • First observedget_pricing
Install Server
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A3.9/5.0
Disambiguation5/5

The two tools have entirely distinct purposes: one performs a risk check on an address, the other retrieves pricing/status. There is no overlap or ambiguity.

Naming Consistency5/5

Both tools follow a clear verb_noun pattern (check_address_risk, get_pricing), using consistent snake_case naming.

Tool Count3/5

With only 2 tools, the server is very light. For a 'triage' server, one might expect more operations, but the focused paid-query model makes the count borderline acceptable.

Completeness2/5

The server only offers a single core risk-check tool plus a pricing tool. Missing features like batch checks, historical data, or transaction simulation leave notable gaps for a 'triage' service.

Maintenance

ActivitySlowing
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • Cabal-Hunter

    paulf280-ui
    A
    license
    A
    quality
    B
    maintenance
    On-chain Solana token safety for trading agents — traces coordinated wallet funding, same-block Jito bundles, serial-rug deployers and live coordinated dumps into one Exit-Liquidity Risk verdict before a swap. Free tier, then $0.02 USDC/query via x402.
    1
    43
    1
    MIT

  • soldefi-mcp

    thomenz
    A
    license
    A
    quality
    B
    maintenance
    Paid access to Solana DeFi risk intelligence — rug/honeypot scans, liquidity-pool analysis, and wash-trade-filtered pool rankings. Automatically settles micropayments in USDC via x402.
    10
    64
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/wallettriage/wallettriage-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server