---
name: onyx-aml-screening
description: >-
  Screen a crypto address for sanctions, issuer blacklists, known-scam
  databases and behavioural risk before sending funds to it. Covers TRON,
  Ethereum, Solana and six EVM chains. Pay per call in USDC on Base, no
  account and no API key signup required.
homepage: https://onyxprotocol.trade
license: commercial-pay-per-call
---

# Onyx AML — address screening for agents

Call this before moving funds to an address you do not control. It answers one
question: are there public risk markers on this counterparty right now.

## What you can buy

| Operation | Price | What you get |
|---|---|---|
| `decide` | 0.10 USDC per call | allow / review / deny against your own policy, with reasons |
| `screen` | 0.10 USDC per call | the raw risk markers for one address |
| `screen/batch` | 0.08 USDC per address | up to 100 addresses in one call |
| `preflight` | 0.03 USDC per call | is this the address you mean: lookalike/poisoning, contract traps, chain mismatch |
| `trace` | 0.40 USDC per call | multi-hop flow of funds, with attribution where known |
| `watch` | 0.03 USDC per address per day | a signed webhook when an address becomes toxic |

`decide` is the one to start with. It answers the question an agent actually has
before moving money, instead of handing back a dataset to interpret.

## What one call returns

- `zone` — red / amber / green / gray, a client-readable risk band
- `blacklisted` — USDT issuer blacklist, read straight from the contract
- `usdc_blacklist` — Circle USDC blacklist on Ethereum and Base
- `sanctions` — Chainalysis on-chain oracle across six EVM chains, plus the
  OFAC SDN list for TRON and Solana
- `scam_db` — presence in an open threat-intel scam database
- `community_reports` — unverified user complaints, a fresh-signal layer
- `flags` — behavioural facts: fresh address, high fan-in, transit pattern
- `facts` — age, balance, exchange label where one is known

## Honest limits, stated up front

A green zone means no markers were found. It is not a guarantee that funds are
clean. We do not have the proprietary clustering that Chainalysis or TRM sell,
and we say so in every response rather than implying coverage we lack. Solana
screening is freeze-authority based, not an issuer blacklist.

## Connecting over MCP

If your runtime speaks the Model Context Protocol, point it at the endpoint below and
the tools appear on their own, with no client code:

```json
{"mcpServers": {"onyx-aml": {
  "type": "http",
  "url": "https://onyxprotocol.trade/mcp",
  "headers": {"X-Api-Key": "onyxa_..."}
}}}
```

Tools exposed: `onyx_decide`, `onyx_screen`, `onyx_screen_batch`, `onyx_preflight`,
`onyx_trace`, `onyx_watch`, `onyx_balance`, `onyx_payment_info`. The last one needs no key and
tells you how to get one.

## Paying

Payment: **USDC or USDT on Base** (chain id 8453), both accepted at par.
A screening call is **0.10**; heavier operations are priced in the table above.
Payment address: `0x3ce398418ca80baf9d2149bb2bcfd6937dc5f470`
First **3 calls are free** so you can evaluate before paying.

```
# 1. Discover terms (also returned as the body of any 402 response)
curl https://onyxprotocol.trade/.well-known/x402

# 2. Send any amount of USDC on Base to the payment address above,
#    then claim your key from the address you sent from
curl -X POST https://onyxprotocol.trade/api/v1/agent/claim \
     -H 'Content-Type: application/json' \
     -d '{"payer":"0xYOUR_SENDING_ADDRESS"}'

# 3. Screen an address
curl -X POST https://onyxprotocol.trade/api/v1/screen \
     -H 'X-Api-Key: onyxa_...' -H 'Content-Type: application/json' \
     -d '{"address":"0x..."}'

# 4. Check remaining credit at any time
curl https://onyxprotocol.trade/api/v1/agent/balance -H 'X-Api-Key: onyxa_...'
```

Credit is read from the chain, so topping up the same address adds calls with
no further setup.

**Key ownership.** While an address has no paid credit, the key is issued to
whoever asks first, so claim it right after your transfer. Once the address
holds credit, the claim must be signed by that wallet: the endpoint returns the
exact message to sign with `personal_sign` (EIP-191), and you retry with
`issued` and `signature`. That signature also lets you rotate a key you lost,
without losing the credit behind it.

## Custody

Payments go directly to the operator's own address. This service holds no
private keys, no balances and no funds belonging to you.

## Free endpoint, no payment

`GET https://onyxprotocol.trade/api/v1/scamfeed` — community scam reports and recent on-chain
freezes. Free, attribution required.