English Français العربية

WalletTriage

Official registry Finance and payments

Real-time exploit-exposure risk check for EVM wallets, paid per query via x402 (USDC on Base).

Source code Website Documentation

What can you do with WalletTriage?

  • check_address_risk (paid) — real-time risk for an EVM address: dangerous
  • get_pricing (free) — service status and current price per query.

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

NPM package wallettriage-mcp
Claude Code 
claude mcp add wallettriage -e 'EVM_PRIVATE_KEY=<your evm_private_key>' -e 'GATEWAY_URL=https://api.wallettriage.com' -e 'MAX_PAYMENT_ATOMIC=100000' -e 'DEFAULT_SCAN_CHAIN=eth' -- npx -y wallettriage-mcp@0.1.5
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "wallettriage": {
            "command": "npx",
            "args": [
                "-y",
                "wallettriage-mcp@0.1.5"
            ],
            "env": {
                "EVM_PRIVATE_KEY": "<your evm_private_key>",
                "GATEWAY_URL": "https://api.wallettriage.com",
                "MAX_PAYMENT_ATOMIC": "100000",
                "DEFAULT_SCAN_CHAIN": "eth"
            }
        }
    }
}

Environment variables

  • EVM_PRIVATE_KEY required secret Private key (0x + 64 hex) of a dedicated low-balance session wallet that signs gasless x402 USDC payments on Base. Never use your main key.
  • GATEWAY_URL WalletTriage API base URL. Defaults to the public production gateway; set to http://localhost:4021 for local development.
  • MAX_PAYMENT_ATOMIC Safety cap: refuse any x402 payment requirement above this many atomic USDC units (6 decimals). Default 100000 = US$0.10.
  • DEFAULT_SCAN_CHAIN Default chain when the caller omits one: eth, base, polygon, arbitrum, optimism, bsc.

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. wallettriage-mcp
  2. Tools
  3. Setup (Claude Desktop, Claude Code, Cursor)
  4. Troubleshooting
  5. Environment variables
  6. Local development

wallettriage-mcp

MCP server for WalletTriage — real-time exploit-exposure check for EVM wallets, built for AI agents. Each query is paid via x402 (USDC on Base) signed locally by a session key: no signup, no API key, no prompts. Stateless — nothing about you or your queries is persisted.

Tools

  • check_address_risk (paid) — real-time risk for an EVM address: dangerous ERC20 approvals cross-referenced with a live threat feed of contracts under attack. Returns risk_score (0–100), risk_level and actionable findings.
  • get_pricing (free) — service status and current price per query.

Setup (Claude Desktop, Claude Code, Cursor)

Requires Node 20+. Add to your MCP config (e.g. claude_desktop_config.json):

{
  "mcpServers": {
    "wallettriage": {
      "command": "npx",
      "args": ["-y", "wallettriage-mcp"],
      "env": {
        "GATEWAY_URL": "https://api.wallettriage.com",
        "EVM_PRIVATE_KEY": "0xREPLACE_WITH_SESSION_WALLET_PRIVATE_KEY",
        "MAX_PAYMENT_ATOMIC": "100000"
      }
    }
  }
}

Fund the session wallet with a few USDC on Base. Use a dedicated, low-balance wallet — never your main key. It only signs gasless EIP-3009 USDC payments; WalletTriage never holds or moves funds.

EVM_PRIVATE_KEY is the wallet's private key (0x + 64 hex), not its address. No ETH needed — payments are gasless (EIP-3009). Test connectivity first with the free get_pricing tool before funding.

Then ask your agent: "Check the risk of 0xd8dA… before I interact with it."

Troubleshooting

  • unable to verify the first certificate (common on Windows / corporate networks): your antivirus or proxy intercepts TLS and Node doesn't use the system certificate store by default. Add "NODE_OPTIONS": "--use-system-ca" to the env block. Never disable TLS verification — payments travel in headers and must not be tamperable.
  • EVM_PRIVATE_KEY is malformed: the value must be 0x + 64 hex characters (the private key of the session wallet). Check for placeholder text, missing 0x or stray whitespace.
  • Gateway unreachable: GATEWAY_URL defaults to https://api.wallettriage.com. If you overrode it (e.g. to a local gateway), make sure that host is reachable and running.

Environment variables

VariableRequiredDefaultPurpose
EVM_PRIVATE_KEYyes—Session key that signs x402 payments (USDC on Base)
GATEWAY_URLnohttps://api.wallettriage.comWalletTriage API base URL. Defaults to production; set http://localhost:4021 for local dev (https enforced for non-local hosts)
MAX_PAYMENT_ATOMICno100000 (US$0.10)Refuses any 402 requirement above this cap (atomic USDC units, 6 decimals)
DEFAULT_SCAN_CHAINnoethDefault chain: eth, base, polygon, arbitrum, optimism, bsc

Local development

npm install
cp .env.example .env   # set EVM_PRIVATE_KEY
npm start              # runs src/server.ts via tsx (stdio)

Point at a local gateway with GATEWAY_URL=http://localhost:4021, or test with the MCP Inspector:

npx @modelcontextprotocol/inspector npx tsx src/server.ts

npm run build emits dist/server.js (the published bin).

Frequently asked questions

What is WalletTriage?

Real-time exploit-exposure risk check for EVM wallets, paid per query via x402 (USDC on Base).

How do I install WalletTriage?

It runs on your machine. In Claude Code: claude mcp add wallettriage -e 'EVM_PRIVATE_KEY=<your evm_private_key>' -e 'GATEWAY_URL=https://api.wallettriage.com' -e 'MAX_PAYMENT_ATOMIC=100000' -e 'DEFAULT_SCAN_CHAIN=eth' -- npx -y wallettriage-mcp@0.1.5. For other clients, paste the JSON configuration from this page into their MCP settings.

Does WalletTriage need an API key?

Yes. It expects EVM_PRIVATE_KEY, which you set in its configuration.

Is WalletTriage open source?

Its code is public on GitHub, but the repository does not declare a standard license.

Who maintains WalletTriage?

It is published by wallettriage. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.