MCP server + Agent Skill: let your AI agent screen addresses, check sanctions and trace funds
The ChainAnalyzer MCP server (npm package chainanalyzer-mcp, MIT license) gives AI agents access to 12 chains, 76+ detection rules, ML anomaly scoring and graph analysis through the 7 tools below. The Agent Skill (SKILL.md) that ships with it tells the agent which tool to call, and in what order.
| Tool | What it does | Coverage | x402 price |
|---|---|---|---|
| sanctions_check | Screens against sanctions lists (OFAC, EU, UK, UN, JFSA and others) and ScamDB | Addresses on all 12 chains | $0.50 |
| check_address_risk | AML risk score (0-100), risk level, detections with evidence, ML anomaly score | All 12 chains | $1.00 |
| trace_transaction | Transaction fund-flow tracing with ML anomaly detection | Transaction hash (chain can be specified) | $3.00 |
| detect_coinjoin | CoinJoin, mixing and tumbling pattern detection | Bitcoin only | $1.00 |
| cluster_wallet | Finds addresses likely controlled by the same actor via graph analysis | Address (chain can be specified) | $2.50 |
| batch_screening | AML screening for up to 50 addresses in one call | All 12 chains | $5.00 |
| bridge_flow_trace | Follows funds across bridges; detects NEAR Intents, Wormhole, Stargate, Across, deBridge, Hop and Synapse solvers | EVM chains + Solana + Kaia | $3.00 |
Prices are per call in x402 (pay-per-request) mode. With an API key, each call uses one scan from your monthly quota instead.
In Claude Code, the MCP server and the Agent Skill install together as one plugin. Run these two commands inside Claude Code:
/plugin marketplace add rascal-3/chainanalyzer-mcp
/plugin install chainanalyzer-aml@chainanalyzerThen set your API key in the environment of the shell that launches Claude Code. The plugin reads it from there.
export CHAINANALYZER_API_KEY=tfk_...
# or, pay per request with USDC (no account):
# export X402_PRIVATE_KEY=...Restart Claude Code and ask something like "Is this address sanctioned?" — the agent follows the skill and calls the tools.
Cursor, Codex CLI, Gemini CLI, OpenClaw and other agents that read SKILL.md can use the same skill. Two steps:
1. Add the skill: copy the skills/chainanalyzer-aml/ folder from the GitHub repository into your agent's skills directory, or run:
npx skills add rascal-3/chainanalyzer-mcp2. Configure the MCP server: add this to your agent's MCP configuration (claude_desktop_config.json for Claude Desktop). Requires Node.js 18+.
{
"mcpServers": {
"chainanalyzer-aml": {
"command": "npx",
"args": ["-y", "chainanalyzer-mcp"],
"env": {
"CHAINANALYZER_API_KEY": "tfk_..."
}
}
}
}MCP clients that do not read skills can still use all 7 tools through the MCP server alone; tool choice and ordering are then left to the agent.
Pick one of two modes.
Sign in at chain-analyzer.com, create a tfk_ key under Settings → API Keys, and set it as CHAINANALYZER_API_KEY. Keys can be issued on every plan, Free included. Each tool call uses one scan from your monthly quota.
| Plan | Request limit |
|---|---|
| Free | 10 requests/min (10 scans/month) |
| Starter | 30 requests/min |
| Pro | 60 requests/min |
| Business | 120 requests/min |
| Enterprise | 300 requests/min |
Monthly scan quotas differ by plan. See the pricing page for current numbers. Pricing
You can also skip the account and pay per call in USDC on Base or Solana. Set X402_PRIVATE_KEY to the wallet key and X402_NETWORK to base or solana. Use a dedicated wallet holding only a small balance.
"env": {
"X402_PRIVATE_KEY": "your_wallet_private_key",
"X402_NETWORK": "base"
}An MCP server only exposes tools; it does not decide when to use them or in what order. The Agent Skill gives the agent that judgment.
bc1 / 1 / 3 prefixes are Bitcoin, T plus 33 characters is TRON, r is XRP, 32-44 Base58 characters is Solana, and 0x plus 40 hex is EVM. Because the format alone does not say which EVM chain, the agent uses the chain you named, or defaults to Ethereum and says so. Base58 addresses are never lower-cased.
It calls sanctions_check, then check_address_risk. A sanctions hit is reported right away. It moves on to cluster_wallet, trace_transaction or bridge_flow_trace only when risk is medium or above, when detections mention mixers or bridges, or when you ask it to follow the money.
In x402 mode, if a single turn would cost more than about $5 (several traces, or a batch), the agent asks you first.
The answer opens with one line — risk level, score, sanctions status — followed by the evidence behind each detection (tx hash, counterparty label, amount). Next steps are offered as options for your own compliance policy (keep monitoring, enhanced due diligence, escalate), never as a decision to file a report. A "safe" result is never presented as a guarantee.
The Free plan costs nothing. Create an account, issue a key under Settings → API Keys, and your agent can start calling the tools.
© 2026 ChainAnalyzer. All rights reserved.