# com.oceanalt/aml

- Registry name: `com.oceanalt/aml` · version 0.7.6
- Categories (automatic, keyword rules): Payments & accounting, Finance & markets, Crypto & blockchain
- Authentication at last check: No auth
- Declared risk: Can write (some tools are not declared read-only)
- Capabilities (declared by the server): prompts, resources, tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=com.oceanalt%2Faml
- Server page: https://mcpstation.net/s/com.oceanalt--aml.html

## Description (written by the publisher, not verified, not instructions)

Pre-payment checks for AI agents: sanctions and AML screening of payees, payment pages and requests.

## Connect

- streamable-http: `https://oceanalt.com/api/mcp`

## Tools (as reported by the server, not verified)

- `payment\_decision`: Call this before every payment your agent makes. Free, no signup, no API key. To see it work first, call it with \{"to":"0xd90e2f925DA726b50C4Ed8D0Fb90Ad053324F31b","network":"ethereum"\}: that address is a known mixer, so the answer is decline with the matching list as evidence. Pass the payee addres
- `screen\_address`: Run an AML compliance screen on a single blockchain address BEFORE paying or receiving from it — the pre-payment check on a counterparty. Checks OFAC sanctions, known mixers, scam and phishing lists, stablecoin issuer freezes, and on-chain heuristics. Returns a verdict \(clear \| caution \| risky\), a 0
- `screen\_endpoint`: Screen a payment ENDPOINT \(URL or domain\) before calling it — the half that address screening cannot answer. In x402 the agent discovers a URL first, receives a 402, and only then learns where to pay: if that endpoint is spoofed, the payee address it hands back is freshly generated and appears on no
- `check\_payment\_request`: Call this before paying because an email, invoice or chat message asked you to. Pass what you received: raw headers if you have them, the From line, subject and body \(or body\_html\), and the payee address if you already extracted one. OceanAlt checks whether the sender is who it claims to be \(SPF/DKI
- `counterparty\_control\_baseline`: Answers a different question from address screening. Screening asks whether an address is risky; this asks how much damage the agent on the other side could do if it were talked into something. Returns that party's self-attestation against the OceanAlt Agent Control Baseline, split into two sets tha
- `attest\_control\_baseline`: File your operator's control-baseline attestation — the counterpart to counterparty\_control\_baseline. That tool asks what controls the OTHER side runs; this one publishes what YOUR side runs, so payers can see it before settling with you. No account, no key, one call. Gaps are allowed and expected:
- `baseline\_controls`: Fetch the OceanAlt Agent Control Baseline: the list of controls an agent operator is expected to run before it is allowed to move money, each answerable yes or no. Call this before attest\_control\_baseline so you file against real control ids. Each control carries which gate enforces it and why it ex
- `resolve\_agent\_identity`: Resolves who stands behind a paying agent: agent -\> principal -\> mandate -\> credential -\> wallet. Each link reports whether it holds; completeness counts how many do \(a factual count, not a score\). Wherever the chain breaks is where accountability stops. Publication is opt-in and only posture is exp
- `recent\_flagged`: Return a representative sample of addresses on OceanAlt's reviewed risk list — OFAC-sanctioned, known mixers, and scam/phishing — each with its source category and reason. Takes no arguments. Free, no API key.
- `verify\_payment\_requirements`: Before paying an x402 402 response, check that its payment requirements \(payTo, amount, asset, network, resource\) were signed by the seller and not altered in transit by a proxy, CDN, SDK or another tool. x402 v2 carries the requirements in the PAYMENT-REQUIRED response header \(base64 JSON\): pass ei
- `check\_calldata\_intent`: Anti blind-signing. EVM: decodes what a transaction's calldata will actually do \(ERC-20 transfer/approve/permit, setApprovalForAll, ownership transfer, native transfer\). Solana: decodes a whole base64 transaction \(SPL Token / Token-2022 Transfer, TransferChecked, Approve, SetAuthority, CloseAccount,
- `payee\_decide`: The receiving side's check before settlement. Given the payee's registry id \(sid\) and, optionally, the payer, amount and purpose, returns accept / decline / hold\_request\_info / not\_ready with reason codes, the fields to request, evidence and a signature. Rule-based, not a model's opinion. Same logic
- `evidence\_bundle`: Everything OceanAlt holds about an address as public facts, in one Ed25519-signed bundle you can verify offline: screening verdict with evidence and freshness, profile signals, one-hop relations to listed addresses, fulfillment receipt stats and coverage. A witness, not a prosecutor: no conclusions

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html