{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_tnrf49mfynta","handle":"onyx-aml","url":"https://wellknown.network/agents/onyx-aml","links":{"self":"https://wellknown.network/agents/onyx-aml/record.json","html":"https://wellknown.network/agents/onyx-aml","markdown":"https://wellknown.network/agents/onyx-aml/record.md","api":"https://wellknown.network/api/v1/agents/onyx-aml","status":"https://wellknown.network/api/v1/agents/onyx-aml/status","claim":"https://wellknown.network/agents/onyx-aml/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/onyx-aml/claim.json","badge":"https://wellknown.network/agents/onyx-aml/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/onyx-aml/history","tools":"https://wellknown.network/api/v1/agents/onyx-aml/tools"},"ard":{"identifier":"urn:air:onyxprotocol.trade:server:onyx-aml","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"Onyx AML","summary":"Crypto address risk checks for agents: USDT/USDC blacklists, sanctions, scam lists, poisoning","description":"Crypto address risk checks for agents: USDT/USDC blacklists, sanctions, scam lists, poisoning","publisher":{"name":"trade.onyxprotocol","url":null},"homepage":"https://onyxprotocol.trade/en/agents","repository":null,"version":"1.0.0","license":null,"protocols":["mcp"],"tags":[],"pricing":null,"endpoints":[{"url":"https://onyxprotocol.trade/mcp","type":"mcp_streamable_http","auth":null,"probeable":true}],"skills":null,"tools":null,"extra":{"updatedAt":"2026-10-20T21:27:02.1985Z","publishedAt":"2026-10-20T21:27:02.1985Z","registryName":"trade.onyxprotocol/onyx-aml"},"attribution":{"kind":"mcp_registry","name":"mcp_registry","summary":"mcp_registry","version":"mcp_registry","description":"mcp_registry","homepageUrl":"mcp_registry","publisherName":"mcp_registry"}},"derived":{"capabilities":[{"slug":"finance.markets","name":"Markets & Trading","confidence":0.915,"provenance":"derived"},{"slug":"data.database","name":"Databases","confidence":0.525,"provenance":"derived"},{"slug":"commerce.payments","name":"Payments","confidence":0.51,"provenance":"derived"}],"categories":["commerce","data","finance"],"language":"en"},"observed":{"status":"live","statusReason":"Responded 3h ago.","lastOkAt":"2026-10-26T16:26:51.520Z","lastProbedAt":"2026-10-26T16:26:51.520Z","statusComputedAt":"2026-10-26T16:31:25.401Z","reliability30d":{"probes":20,"successRate":1,"p50Ms":39,"basis":"service","measures":{"availability":"availability","latency":"response time","tools":"tool surface observed","summary":"Checks reached the service itself."},"checks":{"total":20,"ok":20,"authBoundaryOk":0,"serviceOk":20,"note":"Counted from the observation rows for the window, checks of the server only (HTTP, A2A card, MCP initialize). ok = authBoundaryOk + serviceOk. `probes` is the sum of daily rollups and includes registry checks, so it can differ from `total`."}},"latestObservations":[{"at":"2026-10-26T16:26:51.520Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":41,"error":null,"detail":{"tools":[{"name":"onyx_decide","description":"Return allow / review / deny for a counterparty address against your own risk policy, with the reasons named. Use this before every outbound transfer. Checks is"},{"name":"onyx_screen","description":"Return the raw risk markers for one address: risk zone, issuer blacklists, sanctions coverage, scam databases, community reports, address age, balance and excha"},{"name":"onyx_screen_batch","description":"Screen up to 50 addresses in a single call, for example before a mass payout. Priced per address, and only addresses actually screened are charged. Each result "},{"name":"onyx_preflight","description":"Operational safety check for a payment, separate from risk screening. Detects address poisoning (a lookalike planted in your history so it gets copied instead o"},{"name":"onyx_trace","description":"Multi-hop trace of outgoing flows from an address, with attribution where a node is known (exchange labels, deposit addresses). Use it to establish provenance a"},{"name":"onyx_watch","description":"Subscribe to an address. When it enters an issuer blacklist, a sanctions list or a scam database, we POST a signed event to your callback URL. A one-off check c"},{"name":"onyx_balance","description":"How much credit your API key has left, and the current prices. Free."},{"name":"onyx_payment_info","description":"Machine-readable payment terms: which asset and network to send, the address, prices per operation, and how to claim an API key from the address you paid from. "}],"toolCount":8,"toolsHash":"9b0f4a29272ed16424c0b0f0e0b720ae4d16e7b9fe333d31bd1fac3531052255","serverName":"onyx-aml","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-26T08:27:05.890Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":41,"error":null,"detail":{"tools":[{"name":"onyx_decide","description":"Return allow / review / deny for a counterparty address against your own risk policy, with the reasons named. Use this before every outbound transfer. Checks is"},{"name":"onyx_screen","description":"Return the raw risk markers for one address: risk zone, issuer blacklists, sanctions coverage, scam databases, community reports, address age, balance and excha"},{"name":"onyx_screen_batch","description":"Screen up to 50 addresses in a single call, for example before a mass payout. Priced per address, and only addresses actually screened are charged. Each result "},{"name":"onyx_preflight","description":"Operational safety check for a payment, separate from risk screening. Detects address poisoning (a lookalike planted in your history so it gets copied instead o"},{"name":"onyx_trace","description":"Multi-hop trace of outgoing flows from an address, with attribution where a node is known (exchange labels, deposit addresses). Use it to establish provenance a"},{"name":"onyx_watch","description":"Subscribe to an address. When it enters an issuer blacklist, a sanctions list or a scam database, we POST a signed event to your callback URL. A one-off check c"},{"name":"onyx_balance","description":"How much credit your API key has left, and the current prices. Free."},{"name":"onyx_payment_info","description":"Machine-readable payment terms: which asset and network to send, the address, prices per operation, and how to claim an API key from the address you paid from. "}],"toolCount":8,"toolsHash":"9b0f4a29272ed16424c0b0f0e0b720ae4d16e7b9fe333d31bd1fac3531052255","serverName":"onyx-aml","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-26T01:31:43.880Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":42,"error":null,"detail":{"tools":[{"name":"onyx_decide","description":"Return allow / review / deny for a counterparty address against your own risk policy, with the reasons named. Use this before every outbound transfer. Checks is"},{"name":"onyx_screen","description":"Return the raw risk markers for one address: risk zone, issuer blacklists, sanctions coverage, scam databases, community reports, address age, balance and excha"},{"name":"onyx_screen_batch","description":"Screen up to 50 addresses in a single call, for example before a mass payout. Priced per address, and only addresses actually screened are charged. Each result "},{"name":"onyx_preflight","description":"Operational safety check for a payment, separate from risk screening. Detects address poisoning (a lookalike planted in your history so it gets copied instead o"},{"name":"onyx_trace","description":"Multi-hop trace of outgoing flows from an address, with attribution where a node is known (exchange labels, deposit addresses). Use it to establish provenance a"},{"name":"onyx_watch","description":"Subscribe to an address. When it enters an issuer blacklist, a sanctions list or a scam database, we POST a signed event to your callback URL. A one-off check c"},{"name":"onyx_balance","description":"How much credit your API key has left, and the current prices. Free."},{"name":"onyx_payment_info","description":"Machine-readable payment terms: which asset and network to send, the address, prices per operation, and how to claim an API key from the address you paid from. "}],"toolCount":8,"toolsHash":"9b0f4a29272ed16424c0b0f0e0b720ae4d16e7b9fe333d31bd1fac3531052255","serverName":"onyx-aml","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-25T18:28:24.331Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":39,"error":null,"detail":{"tools":[{"name":"onyx_decide","description":"Return allow / review / deny for a counterparty address against your own risk policy, with the reasons named. Use this before every outbound transfer. Checks is"},{"name":"onyx_screen","description":"Return the raw risk markers for one address: risk zone, issuer blacklists, sanctions coverage, scam databases, community reports, address age, balance and excha"},{"name":"onyx_screen_batch","description":"Screen up to 50 addresses in a single call, for example before a mass payout. Priced per address, and only addresses actually screened are charged. Each result "},{"name":"onyx_preflight","description":"Operational safety check for a payment, separate from risk screening. Detects address poisoning (a lookalike planted in your history so it gets copied instead o"},{"name":"onyx_trace","description":"Multi-hop trace of outgoing flows from an address, with attribution where a node is known (exchange labels, deposit addresses). Use it to establish provenance a"},{"name":"onyx_watch","description":"Subscribe to an address. When it enters an issuer blacklist, a sanctions list or a scam database, we POST a signed event to your callback URL. A one-off check c"},{"name":"onyx_balance","description":"How much credit your API key has left, and the current prices. Free."},{"name":"onyx_payment_info","description":"Machine-readable payment terms: which asset and network to send, the address, prices per operation, and how to claim an API key from the address you paid from. "}],"toolCount":8,"toolsHash":"9b0f4a29272ed16424c0b0f0e0b720ae4d16e7b9fe333d31bd1fac3531052255","serverName":"onyx-aml","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-25T11:28:24.311Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":40,"error":null,"detail":{"tools":[{"name":"onyx_decide","description":"Return allow / review / deny for a counterparty address against your own risk policy, with the reasons named. Use this before every outbound transfer. Checks is"},{"name":"onyx_screen","description":"Return the raw risk markers for one address: risk zone, issuer blacklists, sanctions coverage, scam databases, community reports, address age, balance and excha"},{"name":"onyx_screen_batch","description":"Screen up to 50 addresses in a single call, for example before a mass payout. Priced per address, and only addresses actually screened are charged. Each result "},{"name":"onyx_preflight","description":"Operational safety check for a payment, separate from risk screening. Detects address poisoning (a lookalike planted in your history so it gets copied instead o"},{"name":"onyx_trace","description":"Multi-hop trace of outgoing flows from an address, with attribution where a node is known (exchange labels, deposit addresses). Use it to establish provenance a"},{"name":"onyx_watch","description":"Subscribe to an address. When it enters an issuer blacklist, a sanctions list or a scam database, we POST a signed event to your callback URL. A one-off check c"},{"name":"onyx_balance","description":"How much credit your API key has left, and the current prices. Free."},{"name":"onyx_payment_info","description":"Machine-readable payment terms: which asset and network to send, the address, prices per operation, and how to claim an API key from the address you paid from. "}],"toolCount":8,"toolsHash":"9b0f4a29272ed16424c0b0f0e0b720ae4d16e7b9fe333d31bd1fac3531052255","serverName":"onyx-aml","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-25T04:25:48.236Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":40,"error":null,"detail":{"tools":[{"name":"onyx_decide","description":"Return allow / review / deny for a counterparty address against your own risk policy, with the reasons named. Use this before every outbound transfer. Checks is"},{"name":"onyx_screen","description":"Return the raw risk markers for one address: risk zone, issuer blacklists, sanctions coverage, scam databases, community reports, address age, balance and excha"},{"name":"onyx_screen_batch","description":"Screen up to 50 addresses in a single call, for example before a mass payout. Priced per address, and only addresses actually screened are charged. Each result "},{"name":"onyx_preflight","description":"Operational safety check for a payment, separate from risk screening. Detects address poisoning (a lookalike planted in your history so it gets copied instead o"},{"name":"onyx_trace","description":"Multi-hop trace of outgoing flows from an address, with attribution where a node is known (exchange labels, deposit addresses). Use it to establish provenance a"},{"name":"onyx_watch","description":"Subscribe to an address. When it enters an issuer blacklist, a sanctions list or a scam database, we POST a signed event to your callback URL. A one-off check c"},{"name":"onyx_balance","description":"How much credit your API key has left, and the current prices. Free."},{"name":"onyx_payment_info","description":"Machine-readable payment terms: which asset and network to send, the address, prices per operation, and how to claim an API key from the address you paid from. "}],"toolCount":8,"toolsHash":"9b0f4a29272ed16424c0b0f0e0b720ae4d16e7b9fe333d31bd1fac3531052255","serverName":"onyx-aml","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-24T20:25:41.877Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":39,"error":null,"detail":{"tools":[{"name":"onyx_decide","description":"Return allow / review / deny for a counterparty address against your own risk policy, with the reasons named. Use this before every outbound transfer. Checks is"},{"name":"onyx_screen","description":"Return the raw risk markers for one address: risk zone, issuer blacklists, sanctions coverage, scam databases, community reports, address age, balance and excha"},{"name":"onyx_screen_batch","description":"Screen up to 50 addresses in a single call, for example before a mass payout. Priced per address, and only addresses actually screened are charged. Each result "},{"name":"onyx_preflight","description":"Operational safety check for a payment, separate from risk screening. Detects address poisoning (a lookalike planted in your history so it gets copied instead o"},{"name":"onyx_trace","description":"Multi-hop trace of outgoing flows from an address, with attribution where a node is known (exchange labels, deposit addresses). Use it to establish provenance a"},{"name":"onyx_watch","description":"Subscribe to an address. When it enters an issuer blacklist, a sanctions list or a scam database, we POST a signed event to your callback URL. A one-off check c"},{"name":"onyx_balance","description":"How much credit your API key has left, and the current prices. Free."},{"name":"onyx_payment_info","description":"Machine-readable payment terms: which asset and network to send, the address, prices per operation, and how to claim an API key from the address you paid from. "}],"toolCount":8,"toolsHash":"9b0f4a29272ed16424c0b0f0e0b720ae4d16e7b9fe333d31bd1fac3531052255","serverName":"onyx-aml","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-24T13:30:51.299Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":39,"error":null,"detail":{"tools":[{"name":"onyx_decide","description":"Return allow / review / deny for a counterparty address against your own risk policy, with the reasons named. Use this before every outbound transfer. Checks is"},{"name":"onyx_screen","description":"Return the raw risk markers for one address: risk zone, issuer blacklists, sanctions coverage, scam databases, community reports, address age, balance and excha"},{"name":"onyx_screen_batch","description":"Screen up to 50 addresses in a single call, for example before a mass payout. Priced per address, and only addresses actually screened are charged. Each result "},{"name":"onyx_preflight","description":"Operational safety check for a payment, separate from risk screening. Detects address poisoning (a lookalike planted in your history so it gets copied instead o"},{"name":"onyx_trace","description":"Multi-hop trace of outgoing flows from an address, with attribution where a node is known (exchange labels, deposit addresses). Use it to establish provenance a"},{"name":"onyx_watch","description":"Subscribe to an address. When it enters an issuer blacklist, a sanctions list or a scam database, we POST a signed event to your callback URL. A one-off check c"},{"name":"onyx_balance","description":"How much credit your API key has left, and the current prices. Free."},{"name":"onyx_payment_info","description":"Machine-readable payment terms: which asset and network to send, the address, prices per operation, and how to claim an API key from the address you paid from. "}],"toolCount":8,"toolsHash":"9b0f4a29272ed16424c0b0f0e0b720ae4d16e7b9fe333d31bd1fac3531052255","serverName":"onyx-aml","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-24T06:27:16.458Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":39,"error":null,"detail":{"tools":[{"name":"onyx_decide","description":"Return allow / review / deny for a counterparty address against your own risk policy, with the reasons named. Use this before every outbound transfer. Checks is"},{"name":"onyx_screen","description":"Return the raw risk markers for one address: risk zone, issuer blacklists, sanctions coverage, scam databases, community reports, address age, balance and excha"},{"name":"onyx_screen_batch","description":"Screen up to 50 addresses in a single call, for example before a mass payout. Priced per address, and only addresses actually screened are charged. Each result "},{"name":"onyx_preflight","description":"Operational safety check for a payment, separate from risk screening. Detects address poisoning (a lookalike planted in your history so it gets copied instead o"},{"name":"onyx_trace","description":"Multi-hop trace of outgoing flows from an address, with attribution where a node is known (exchange labels, deposit addresses). Use it to establish provenance a"},{"name":"onyx_watch","description":"Subscribe to an address. When it enters an issuer blacklist, a sanctions list or a scam database, we POST a signed event to your callback URL. A one-off check c"},{"name":"onyx_balance","description":"How much credit your API key has left, and the current prices. Free."},{"name":"onyx_payment_info","description":"Machine-readable payment terms: which asset and network to send, the address, prices per operation, and how to claim an API key from the address you paid from. "}],"toolCount":8,"toolsHash":"9b0f4a29272ed16424c0b0f0e0b720ae4d16e7b9fe333d31bd1fac3531052255","serverName":"onyx-aml","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-23T23:27:57.163Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":38,"error":null,"detail":{"tools":[{"name":"onyx_decide","description":"Return allow / review / deny for a counterparty address against your own risk policy, with the reasons named. Use this before every outbound transfer. Checks is"},{"name":"onyx_screen","description":"Return the raw risk markers for one address: risk zone, issuer blacklists, sanctions coverage, scam databases, community reports, address age, balance and excha"},{"name":"onyx_screen_batch","description":"Screen up to 50 addresses in a single call, for example before a mass payout. Priced per address, and only addresses actually screened are charged. Each result "},{"name":"onyx_preflight","description":"Operational safety check for a payment, separate from risk screening. Detects address poisoning (a lookalike planted in your history so it gets copied instead o"},{"name":"onyx_trace","description":"Multi-hop trace of outgoing flows from an address, with attribution where a node is known (exchange labels, deposit addresses). Use it to establish provenance a"},{"name":"onyx_watch","description":"Subscribe to an address. When it enters an issuer blacklist, a sanctions list or a scam database, we POST a signed event to your callback URL. A one-off check c"},{"name":"onyx_balance","description":"How much credit your API key has left, and the current prices. Free."},{"name":"onyx_payment_info","description":"Machine-readable payment terms: which asset and network to send, the address, prices per operation, and how to claim an API key from the address you paid from. "}],"toolCount":8,"toolsHash":"9b0f4a29272ed16424c0b0f0e0b720ae4d16e7b9fe333d31bd1fac3531052255","serverName":"onyx-aml","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}}],"tools":[{"name":"onyx_decide","description":"Return allow / review / deny for a counterparty address against your own risk policy, with the reasons named. Use this before every outbound transfer. Checks is"},{"name":"onyx_screen","description":"Return the raw risk markers for one address: risk zone, issuer blacklists, sanctions coverage, scam databases, community reports, address age, balance and excha"},{"name":"onyx_screen_batch","description":"Screen up to 50 addresses in a single call, for example before a mass payout. Priced per address, and only addresses actually screened are charged. Each result "},{"name":"onyx_preflight","description":"Operational safety check for a payment, separate from risk screening. Detects address poisoning (a lookalike planted in your history so it gets copied instead o"},{"name":"onyx_trace","description":"Multi-hop trace of outgoing flows from an address, with attribution where a node is known (exchange labels, deposit addresses). Use it to establish provenance a"},{"name":"onyx_watch","description":"Subscribe to an address. When it enters an issuer blacklist, a sanctions list or a scam database, we POST a signed event to your callback URL. A one-off check c"},{"name":"onyx_balance","description":"How much credit your API key has left, and the current prices. Free."},{"name":"onyx_payment_info","description":"Machine-readable payment terms: which asset and network to send, the address, prices per operation, and how to claim an API key from the address you paid from. "}],"package":null,"toolSurface":{"id":"ts_tqrabdr5s9d8","endpointId":"ep_9ey7y8y6xrpc","hash":"9b0f4a29272ed16424c0b0f0e0b720ae4d16e7b9fe333d31bd1fac3531052255","toolCount":8,"serverName":"onyx-aml","serverVersion":"1.0.0","protocolVersion":"2025-06-18","firstSeenAt":"2026-10-21T01:25:30.206Z","lastSeenAt":"2026-10-26T16:26:51.531Z","observations":20,"toolNames":["onyx_decide","onyx_screen","onyx_screen_batch","onyx_preflight","onyx_trace","onyx_watch","onyx_balance","onyx_payment_info"],"distinctSurfaces":1},"endpointFacts":[{"id":"ep_9ey7y8y6xrpc","url":"https://onyxprotocol.trade/mcp","type":"mcp_streamable_http","factsCheckedAt":"2026-10-22T22:26:43.287Z","auth":{"observedAt":"2026-10-22T22:26:43.342Z","authRequired":false,"scheme":null,"resourceMetadata":null,"authorizationServer":null,"conformance":{"dpop":false,"rfc8414":false,"rfc9728":false,"pkceS256":false,"clientIdMetadataDocument":false,"dynamicClientRegistration":false}},"tls":{"observedAt":"2026-10-22T22:26:43.435Z","protocol":"TLSv1.3","chainValid":true,"chainError":null,"hostMatches":true,"subject":"onyxprotocol.trade","issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validFrom":"2026-10-02T05:41:36.000Z","validTo":"2026-12-31T05:41:35.000Z","daysToExpiry":65,"sanCount":2,"fingerprint256":"70:3F:EC:77:74:E3:45:B6:54:D1:4C:4B:DC:72:9D:E2:69:DC:AA:3A:D6:49:5C:03:C6:2C:29:31:8A:BF:44:66"}}]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"mcp_registry","key":"trade.onyxprotocol/onyx-aml","url":"https://registry.modelcontextprotocol.io/v0/servers/trade.onyxprotocol%2Fonyx-aml","firstSeenAt":"2026-10-21T00:22:39.827Z","fetchedAt":"2026-10-24T15:18:51.056Z","normalizedAt":"2026-10-24T15:18:51.056Z"}]},"firstSeenAt":"2026-10-21T00:22:39.827Z","updatedAt":"2026-10-26T16:34:55.294Z"}