Onyx AML · Blockchain Forensics MCP server

• Registry nametrade.onyxprotocol/onyx-amlverified in the MCP registry

The registry name sits under onyxprotocol.trade. The registry only lets a publisher use that namespace after proving control of the domain through DNS or HTTP.

• Stateanswerschecked 2026-10-28
• Tools8
• Server calls itselfonyx-aml
• Server version1.0.0
• Protocol version2025-06-18

On 2026-10-28 the server answered initialize and tools/list without a sign-in. First answer in 531 ms.

• Its tools do every use case we checked: Trace where stolen USDT moved and whether it reached an exchange; Check a crypto address against blacklists and sanctions before a deal; Build a source-of-funds dossier for an exchange compliance review.

Said by rules from the measurements above. The likely first call is a model's pick from the tool list; read its description before relying on it.

• INITE MCP score96 of 100answers 100 · does the job 100 · definitions 81 · context 100 · connects 100
• What an agent can do with it3 of 3 use cases
• Answered100% of days7 of 7 daily checks
• Median first answer702 ms
• Space in an agent's context≈ 1,133 tokensthe definitions of all its tools (8), which an agent carries on every turn
• Tool definitionsB · 81 of 100
• Typed results0 of 8 toolsdeclared outputSchema: results come typed, read once

• Parameters without a description: in 1 of 8
• Not saying whether it only reads or can destroy: 8 of 8

A program checks the server once a day: initialize and tools/list, no model. Tokens are the definitions' length at about four characters a token. The grade averages six checks of every tool's name, description, schema and annotations; it says how well the tools are described, not whether they work. The score weighs what was measured and nothing else: answering (25%), doing the product's job (25%), definitions (20%), context (10%), use (10%) and how readily a client connects (10%). A part that was not measured is left out, and a hidden instruction caps the score at 40. The state of vendors' MCP servers: method and numbers →

• onyx_decide

  Return allow / review / deny for a counterparty address against your own risk policy, with the reasons named. Use this before every outbound transfer. Checks issuer blacklists (USDT, USDC), sanctions across six EVM chains plus the OFAC…

• onyx_screen

  Return the raw risk markers for one address: risk zone, issuer blacklists, sanctions coverage, scam databases, community reports, address age, balance and exchange attribution where known. Use this when you want the facts rather than a…

• onyx_screen_batch

  Screen up to 50 addresses in a single call, for example before a mass payout. Priced per address, and only addresses actually screened are charged. Each result carries facts_complete so you can tell whether the behavioural facts finished…

• onyx_preflight

  Operational safety check for a payment, separate from risk screening. Detects address poisoning (a lookalike planted in your history so it gets copied instead of the real address), contract recipients that would swallow the tokens, and…

• onyx_trace

  Multi-hop trace of outgoing flows from an address, with attribution where a node is known (exchange labels, deposit addresses). Use it to establish provenance after receiving funds. Costs more than a screening call.

• onyx_watch

  Subscribe to an address. When it enters an issuer blacklist, a sanctions list or a scam database, we POST a signed event to your callback URL. A one-off check cannot warn you about a freeze that has not happened yet. Billed per address…

• onyx_balance

  How much credit your API key has left, and the current prices. Free.

• onyx_payment_info

  Machine-readable payment terms: which asset and network to send, the address, prices per operation, and how to claim an API key from the address you paid from. No account or signup is involved. Free, and works without a key.