mcpField
W
WalletTriage

WalletTriage

Local
wallettriage.comSecurity0Updated 16w ago
RepositoryVisit website

About WalletTriage

WalletTriage is an MCP server that checks EVM wallet addresses for risky token approvals linked to active threats. AI agents can request a live risk score and findings; each check is paid in USDC on Base through x402.

Key features

  1. 01Check EVM address approval risks
  2. 02Match approvals against a live threat feed
  3. 03Return risk score, level, and findings
  4. 04View service status and query pricing
  5. 05Sign x402 payments with a local session key

Use cases

  1. 01Assess an address before interacting with it
  2. 02Review token approvals for known active threats

MCP support

Exposes the paid check_address_risk tool and the free get_pricing tool to MCP clients. Queries use x402 payments in USDC on Base, signed locally by a session key.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "wallettriage-wallettriage": {
      "command": "npx",
      "args": [
        "-y",
        "wallettriage-mcp"
      ],
      "env": {
        "EVM_PRIVATE_KEY": "<EVM_PRIVATE_KEY>",
        "GATEWAY_URL": "<GATEWAY_URL>",
        "MAX_PAYMENT_ATOMIC": "<MAX_PAYMENT_ATOMIC>",
        "DEFAULT_SCAN_CHAIN": "<DEFAULT_SCAN_CHAIN>"
      }
    }
  }
}
Run commandnpx -y wallettriage-mcp
Environment variables to set
EVM_PRIVATE_KEYSecretPrivate key (0x + 64 hex) of a dedicated low-balance session wallet that signs gasless x402 USDC payments on Base. Never use your main key.
GATEWAY_URLWalletTriage API base URL. Defaults to the public production gateway; set to http://localhost:4021 for local development.
MAX_PAYMENT_ATOMICSafety cap: refuse any x402 payment requirement above this many atomic USDC units (6 decimals). Default 100000 = US$0.10.
DEFAULT_SCAN_CHAINDefault chain when the caller omits one: eth, base, polygon, arbitrum, optimism, bsc.

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npmwallettriage-mcp0.1.5

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

wallettriage-mcp

MCP server for WalletTriage — real-time exploit-exposure check for EVM wallets, built for AI agents. Each query is paid via x402 (USDC on Base) signed locally by a session key: no signup, no API key, no prompts. Stateless — nothing about you or your queries is persisted.

Tools

  • check_address_risk (paid) — real-time risk for an EVM address: dangerous ERC20 approvals cross-referenced with a live threat feed of contracts under attack. Returns risk_score (0–100), risk_level and actionable findings.
  • get_pricing (free) — service status and current price per query.

Setup (Claude Desktop, Claude Code, Cursor)

Requires Node 20+. Add to your MCP config (e.g. claude_desktop_config.json):

{
  "mcpServers": {
    "wallettriage": {
      "command": "npx",
      "args": ["-y", "wallettriage-mcp"],
      "env": {
        "GATEWAY_URL": "https://api.wallettriage.com",
        "EVM_PRIVATE_KEY": "0xREPLACE_WITH_SESSION_WALLET_PRIVATE_KEY",
        "MAX_PAYMENT_ATOMIC": "100000"
      }
    }
  }
}

Fund the session wallet with a few USDC on Base. Use a dedicated, low-balance wallet — never your main key. It only signs gasless EIP-3009 USDC payments; WalletTriage never holds or moves funds.

EVM_PRIVATE_KEY is the wallet's private key (0x + 64 hex), not its address. No ETH needed — payments are gasless (EIP-3009). Test connectivity first with the free get_pricing tool before funding.

Then ask your agent: "Check the risk of 0xd8dA… before I interact with it."

Troubleshooting

  • unable to verify the first certificate (common on Windows / corporate networks): your antivirus or proxy intercepts TLS and Node doesn't use the system certificate store by default. Add "NODE_OPTIONS": "--use-system-ca" to the env block. Never disable TLS verification — payments travel in headers and must not be tamperable.
  • EVM_PRIVATE_KEY is malformed: the value must be 0x + 64 hex characters (the private key of the session wallet). Check for placeholder text, missing 0x or stray whitespace.
  • Gateway unreachable: GATEWAY_URL defaults to https://api.wallettriage.com. If you overrode it (e.g. to a local gateway), make sure that host is reachable and running.

Environment variables

VariableRequiredDefaultPurpose
EVM_PRIVATE_KEYyes—Session key that signs x402 payments (USDC on Base)
GATEWAY_URLnohttps://api.wallettriage.comWalletTriage API base URL. Defaults to production; set http://localhost:4021 for local dev (https enforced for non-local hosts)
MAX_PAYMENT_ATOMICno100000 (US$0.10)Refuses any 402 requirement above this cap (atomic USDC units, 6 decimals)
DEFAULT_SCAN_CHAINnoethDefault chain: eth, base, polygon, arbitrum, optimism, bsc

Local development

npm install
cp .env.example .env   # set EVM_PRIVATE_KEY
npm start              # runs src/server.ts via tsx (stdio)

Point at a local gateway with GATEWAY_URL=http://localhost:4021, or test with the MCP Inspector:

npx @modelcontextprotocol/inspector npx tsx src/server.ts

npm run build emits dist/server.js (the published bin).

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.