io.github.INJprotocol/sentinel-compliance

Est-ce que io.github.INJprotocol/sentinel-compliance est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.INJprotocol/sentinel-compliance » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 12 outils

• cancel_watchlist_monitor≈ 336 tokens

  Permanently stop a watchlist monitor: re-screening ends, its webhook URL is deleted and later checks report status cancelled. It cannot be resumed; create a new monitor with create_watchlist_monitor instead. Use it when monitoring is no longer needed or the webhook endpoint is retired; to read a monitor's status use check_watchlist_monitors. Pass the MON- id returned when the monitor was created: it is the only credential, so anyone holding it can cancel the monitor. Free, limited to 30 calls per minute per client.

  Paramètres, retour & exemple (1)

  Paramètres

  • monitor_id · string · requis
    Monitor id to cancel, MON- followed by 22 URL-safe characters

  Exemple d'appel

  {"name": "cancel_watchlist_monitor", "arguments": {"monitor_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"id": "texte", "cancelled": true, "cancelledAt": "texte"}}

• check_watchlist_monitors≈ 802 tokens

  Read the status of watchlist monitors created with create_watchlist_monitor. With exactly one id, the target is re-screened against the latest lists right now (and its webhook fires if the status changed); with 2-20 ids, the stored statuses from the last 6-hourly re-screen are returned without re-screening. Use one id when you need a fresh answer before acting and several ids for a periodic sweep; for a name or wallet without a monitor use screen_entity or screen_wallet, and to stop monitoring use cancel_watchlist_monitor. Unknown ids are reported as not found. Costs $0.001 USDC for one id or $0.002 for 2-20 ids via x402 on Base; unpaid calls return an x402 PaymentRequired result and failed calls are not charged.

  Paramètres, retour & exemple (1)

  Paramètres

  • monitor_ids · array · requis
    1-20 monitor ids (MON- followed by 22 URL-safe characters). One id = live re-screen; 2-20 ids = stored statuses.

  Exemple d'appel

  {"name": "check_watchlist_monitors", "arguments": {"monitor_ids": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• create_travel_rule_packet≈ 1227 tokens

  Screen the originator and beneficiary of a crypto transfer (wallets, plus names and countries when given) and store the result as a Travel Rule packet. The strictest threshold among the parties' countries applies (EU/EEA 0, Japan about 700, otherwise the FATF Recommendation 16 de-minimis of 1,000 USD); pass amount_usd to learn whether it applies. Returns a packetId, a free verification URL and an EdDSA-signed attestation valid for 90 days for the counterparty VASP. Use it when a transfer needs a Travel Rule record; use screen_wallet for a quick address check, and verify_travel_rule_packet to check a packet you received. Each call stores a new packet; names are stored only as keyed hashes and never returned, wallet addresses are stored. Costs $0.005 USDC per successful call via x402 on Base; unpaid calls return an x402 PaymentRequired result and failed calls are not charged.

  Paramètres, retour & exemple (8)

  Paramètres

  • purpose · string · optionnel
    Optional purpose of the transfer, up to 200 characters
  • amount_usd · number · optionnel
    Optional transfer value in USD; without it travelRule.applies is null
  • originator_name · string · optionnel
    Optional originator name; screened against watchlists and stored only as a keyed hash
  • beneficiary_name · string · optionnel
    Optional beneficiary name; screened and stored only as a keyed hash
  • originator_address · string · requis
    Originator wallet address, 10-256 letters, digits or ':'
  • originator_country · string · optionnel
    Optional originator ISO 3166-1 alpha-2 country; sets the applicable threshold (e.g. US, SG, JP)
  • beneficiary_address · string · requis
    Beneficiary wallet address, 10-256 letters, digits or ':'
  • beneficiary_country · string · optionnel
    Optional beneficiary ISO 3166-1 alpha-2 country

  Exemple d'appel

  {"name": "create_travel_rule_packet", "arguments": {"originator_address": "texte", "beneficiary_address": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• create_watchlist_monitor≈ 894 tokens

  Start 30 days of watchlist monitoring for one wallet address (type wallet) or one person/company name (type entity): it is screened now, re-screened every 6 hours against the latest lists, and an optional HMAC-signed webhook (a public HTTPS URL) is called whenever its status changes between clear, review and alerted. Use it for ongoing monitoring after onboarding; use screen_entity or screen_wallet for a one-off check, check_watchlist_monitors to read statuses, and cancel_watchlist_monitor to stop. Each call creates a new monitor. The response contains the monitor id and, if a webhook is set, its signing secret, both shown only once: store them. Costs $0.010 USDC per successful call via x402 on Base; unpaid calls return an x402 PaymentRequired result and failed calls are not charged.

  Paramètres, retour & exemple (5)

  Paramètres

  • type · string · requis · wallet | entity
    What to monitor
  • chain · string · optionnel
    Optional chain hint for wallets, e.g. ethereum, base, tron (informational)
  • label · string · optionnel
    Optional reference of yours, up to 100 characters, echoed in results and webhooks
  • value · string · requis
    The wallet address (type wallet) or person/company name (type entity), 2-256 characters
  • webhook_url · string · optionnel
    Optional public https:// URL that receives a signed POST when the status changes

  Exemple d'appel

  {"name": "create_watchlist_monitor", "arguments": {"type": "wallet", "value": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_jurisdiction_risk≈ 800 tokens

  Look up one country's anti-money-laundering risk: FATF status (black/grey list), Basel AML Index, Corruption Perceptions Index, EU and US high-risk designations, tax-haven flag, and a derived risk level (critical, high, medium, low or standard). Use it to assess a counterparty's country or a payment corridor; it takes one country code per call, so check each end of a corridor separately. For a named person or company use run_due_diligence, which already assesses the countries found in its hits. A code not in the dataset returns found=false with risk_level unknown (a successful, charged call). Costs $0.001 USDC per successful call via x402 on Base; unpaid calls return an x402 PaymentRequired result and failed calls are not charged.

  Paramètres, retour & exemple (1)

  Paramètres

  • country_code · string · requis
    ISO 3166-1 alpha-2 country code, e.g. MU (Mauritius), KP (North Korea), AE (United Arab Emirates)

  Exemple d'appel

  {"name": "get_jurisdiction_risk", "arguments": {"country_code": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• run_due_diligence≈ 999 tokens

  Profile one person or company in a single call: global watchlist screening, AML risk of every country found in the hits, Mauritius registry records (with their FSC-licensing and PEP-role links), and a composite 0-100 risk score with its factors. Use it for onboarding (KYC/KYB) or enhanced due diligence; use screen_entity when a list check is enough and screen_cross_border_payment for both parties of a payment. Names match as case-insensitive substrings; exact matches weigh far more than partial ones, which alone only reach review level. Bank of Mauritius exchange rates are added when countries are found, unless include_forex is false. The score is a triage aid from public lists, not a legal determination. Limited to 10 calls per minute per client. The result states when each list was last updated (lists_as_of). Costs $0.010 USDC per successful call via x402 on Base; unpaid calls return an x402 PaymentRequired result and failed calls are not charged.

  Paramètres, retour & exemple (2)

  Paramètres

  • name · string · requis
    Person or company name, 2-200 characters
  • include_forex · boolean · optionnel
    Include Bank of Mauritius exchange rates for context when countries are detected (default true)

  Exemple d'appel

  {"name": "run_due_diligence", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• screen_cross_border_payment≈ 1012 tokens

  Screen both parties of a payment before it is sent: sender and receiver names against global watchlists, their countries' AML risk, and an optional Bank of Mauritius exchange rate for the corridor (set currency_from; currency_to defaults to MUR). Returns PROCEED (risk score below 15), REVIEW (15-39, minor indicators such as partial name matches), FLAG (40-74, enhanced due diligence) or BLOCK (75+, e.g. an exact sanctions match: stop and escalate), with a reason and each party's risk. Use it for fiat or crypto payments where you have names; use screen_wallet for wallet addresses only, and create_travel_rule_packet for a stored, verifiable Travel Rule record. The result states when each list was last updated (lists_as_of). Costs $0.008 USDC per successful call via x402 on Base; unpaid calls return an x402 PaymentRequired result and failed calls are not charged.

  Paramètres, retour & exemple (6)

  Paramètres

  • currency_to · string · optionnel
    Optional target currency, ISO 4217 (default MUR)
  • sender_name · string · requis
    Sender (originator) name, 2-200 characters
  • currency_from · string · optionnel
    Optional source currency, ISO 4217 (e.g. USD); adds the MUR corridor rate
  • receiver_name · string · requis
    Receiver (beneficiary) name, 2-200 characters
  • sender_country · string · optionnel
    Optional sender ISO 3166-1 alpha-2 country code, e.g. GB
  • receiver_country · string · optionnel
    Optional receiver ISO 3166-1 alpha-2 country code, e.g. MU

  Exemple d'appel

  {"name": "screen_cross_border_payment", "arguments": {"sender_name": "texte", "receiver_name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• screen_entity≈ 1011 tokens

  Screen one person or organisation name, including aliases, against sanctions lists (US, EU, UK, UN, Canada, Australia and national lists aggregated by OpenSanctions), politically exposed persons, wanted persons (incl. Interpol Red Notices), development-bank and US debarments, crypto-linked entities, ransomware groups and OFAC-listed vessels. Use it for a quick list check of a name; use run_due_diligence for a scored profile with country and Mauritius registry context, search_mauritius_registry for Mauritius licences, offshore records and local PEPs, and screen_wallet for blockchain addresses. Matching is case-insensitive substring: each hit is labelled exact or partial, and partial hits need human review. The result states when each list was last updated (lists_as_of). Costs $0.002 USDC per successful call via x402 on Base; unpaid calls return an x402 PaymentRequired result and failed calls are not charged.

  Paramètres, retour & exemple (3)

  Paramètres

  • list · string · optionnel · all | sanctions | pep | wanted | debarment | crypto | vessel | ransomware
    Search one list group only (default all); mauritius searches the Mauritius registry name index
  • name · string · requis
    Full name to screen, 2-200 characters: letters, digits, spaces and - ' . , ( ) & (e.g. "Lazarus Group"). Longer, more specific names give fewer partial matches.
  • limit · integer · optionnel
    Maximum hits to return, 1-25 (default 10). When the limit is reached the result has truncated=true.

  Exemple d'appel

  {"name": "screen_entity", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• screen_wallet≈ 880 tokens

  Check a blockchain address (any chain) against active sanctioned and frozen addresses: OFAC SDN, OpenSanctions, UK, Circle USDC and Tether USDT freeze lists, and Ransomwhere ransomware wallets. Use it before sending or accepting funds; owner_name also screens the owner's name and returns a composite risk (critical when the address is listed, elevated when only the name matched). For names alone use screen_entity, for a Travel Rule record create_travel_rule_packet, and for an EVM agent's on-chain reputation verify_agent_identity. Matching is exact and case-insensitive on the full address: clear means the address itself is not listed, not that its counterparties are clean. The result states when each list was last updated (lists_as_of). Costs $0.001 USDC, or $0.003 with owner_name, via x402 on Base; unpaid calls return an x402 PaymentRequired result and failed calls are not charged.

  Paramètres, retour & exemple (2)

  Paramètres

  • address · string · requis
    Full wallet address, 10-128 characters of letters, digits, ':', '_' or '-' (e.g. 0x08723392Ed15743cc38513C4925f5e6be5c17243)
  • owner_name · string · optionnel
    Optional name of the wallet's owner to screen in the same call (switches to the combined wallet + name check)

  Exemple d'appel

  {"name": "screen_wallet", "arguments": {"address": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• search_mauritius_registry≈ 859 tokens

  Search Mauritius-specific records by name: Financial Services Commission licensees (category fsc_licensee), licensed banks, insurers, payment and other financial institutions (licensed_entity), offshore entities from the ICIJ leak databases (offshore_entity), local politically exposed persons (pep) and adverse-media mentions (adverse_media); omit category to search all. Use it for Mauritius counterparties or to confirm a licence; use screen_entity for global sanctions and watchlists, and run_due_diligence to combine both with a risk score. Case-insensitive substring match on the name; an offshore-leak or adverse-media record is a lead to investigate, not proof of wrongdoing. The result states when each list was last updated (lists_as_of). Costs $0.005 USDC per successful call via x402 on Base; unpaid calls return an x402 PaymentRequired result and failed calls are not charged.

  Paramètres, retour & exemple (3)

  Paramètres

  • name · string · requis
    Company or person name, 2-200 characters (e.g. "Absa Bank")
  • limit · integer · optionnel
    Maximum records, 1-25 (default 10)
  • category · string · optionnel · fsc_licensee | licensed_entity | offshore_entity | pep | adverse_media
    Optional record type filter

  Exemple d'appel

  {"name": "search_mauritius_registry", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• verify_agent_identity≈ 661 tokens

  Run a Know-Your-Agent check on an AI agent's EVM wallet: ERC-8004 agent-registry lookup and operator, sanctions screening (result clear or sanctioned), on-chain behaviour (wallet age, activity, fund-flow taint, mixer and scam contacts, threat-intel alerts), a 0-100 risk score with its band (minimal, low, moderate, elevated, high or critical), and a signed W3C Verifiable Credential plus a sanctions-list Merkle proof that third parties can verify. Use it before paying, hiring or accepting payment from an autonomous agent, passing that agent's 0x wallet address; for an address on another chain, or a list-only check, use screen_wallet. Free, limited to 60 calls per minute per client; it reads public blockchain data live, so it can take several seconds and results change as the wallet transacts.

  Paramètres, retour & exemple (1)

  Paramètres

  • address · string · requis
    EVM wallet address: 0x followed by 40 hex characters

  Exemple d'appel

  {"name": "verify_agent_identity", "arguments": {"address": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"kya": {}, "proofs": {}, "result": "texte", "address": "texte", "fundFlow": {}, "riskBand": "texte", "riskFlags": [], "riskScore": 1, "threatIntel": {}, "walletProfile": {}, "verifiableCredentials": {}}}

• verify_travel_rule_packet≈ 545 tokens

  Verify a Travel Rule packet you received from a counterparty: returns its stored risk level, recommendation, flags, threshold result and masked wallet addresses. Pass the packet_id you received and, optionally, the originator and beneficiary names and wallet addresses you hold; each is compared with what was screened and reported only as match true/false, so names are never revealed. Use it on the beneficiary side after receiving a packetId; use create_travel_rule_packet to create one. Free, no payment needed, limited to 60 calls per minute per client; an unknown packet_id returns a not-found error.

  Paramètres, retour & exemple (5)

  Paramètres

  • packet_id · string · requis
    Packet id from the originator, TR- followed by 22 URL-safe characters
  • originator_name · string · optionnel
    Optional originator name you hold; checked against the stored keyed hash
  • beneficiary_name · string · optionnel
    Optional beneficiary name you hold
  • originator_address · string · optionnel
    Optional originator wallet address you hold
  • beneficiary_address · string · optionnel
    Optional beneficiary wallet address you hold

  Exemple d'appel

  {"name": "verify_travel_rule_packet", "arguments": {"packet_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"packet": {}, "matches": {}, "verified": true}}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://mru-oracle.com/mcp