ChainAnalyzer AML skill

This skill tells the agent when and how to use the chainanalyzer-aml MCP server tools. It does not replace a compliance officer: results are risk indicators with on-chain evidence, not legal determinations.

Prerequisites

The MCP server chainanalyzer-aml must be configured. If its tools are not available, tell the user:

{
  "mcpServers": {
    "chainanalyzer-aml": {
      "command": "npx",
      "args": ["-y", "chainanalyzer-mcp"],
      "env": { "CHAINANALYZER_API_KEY": "tfk_..." }
    }
  }
}

Authentication is one of:

• CHAINANALYZER_API_KEY (tfk_...). Preferred. API keys are available on every plan, including Free (10 scans/month): sign up at https://chain-analyzer.com/login?utm_source=skill and create a key under Account → Settings → API Keys (https://chain-analyzer.com/account/settings/api_keys).
• X402_PRIVATE_KEY (+ X402_NETWORK = base | solana) for pay-per-request USDC via x402, no account needed.

If a call fails with an auth or payment error

• 401 / 403 (missing, invalid or revoked key): stop and tell the user to create a key at the link above. Do not retry with guessed keys.
• 402 Payment Required (x402 mode without a funded wallet, or API-key mode where the key is absent): explain the two options (free API key vs. x402 wallet) and let the user choose. Never ask for or echo private keys in the conversation.
• 429 (monthly quota or per-minute rate limit): report which limit was hit and suggest upgrading or waiting. Rate limits by plan: Free 10/min, Starter 30/min, Pro 60/min, Business 120/min, Enterprise 300/min.

Tool selection

Costs apply only in x402 mode. In API-key mode each call consumes one scan from the plan quota (Free: 10/month; a batch consumes one scan per successfully screened address). Plan gates in API-key mode: batch_screening needs Starter or above (up to 50 addresses per call, 10 on Starter), bridge_flow_trace needs Business or above. A 403 from one of these means the plan is too low, not a bad key: say so and suggest the upgrade or x402.

Workflow

1. Identify the chain from the address format before calling anything.
   • bc1..., 1..., 3... → bitcoin
   • 0x + 40 hex → EVM. Ambiguous between Ethereum, Polygon, BNB Smart Chain, Base, Arbitrum, Optimism, Avalanche, Kaia. Use the chain the user named; if none, default to ethereum and say so.
   • Base58, 32–44 chars, no 0/O/I/l → solana
   • T + 33 Base58 chars → tron
   • r + 24–34 Base58 chars → xrp
   • Never lower-case or otherwise normalize Base58 addresses (Bitcoin, Solana, TRON, XRP). Case is significant.
2. Screen cheap first. Run sanctions_check, then check_address_risk. A sanctions hit alone is sufficient to stop and report.
3. Escalate only on signal or request. Use cluster_wallet, trace_transaction or bridge_flow_trace when the risk level is medium or above, when detections mention mixers / bridges / drainers, or when the user explicitly asks to follow the money.
4. Lists go through batch_screening (≤50 per call). Split larger lists and de-duplicate first; duplicates are not re-charged by the service but waste a slot.
5. Confirm before spending in x402 mode when a single turn would cost more than about $5 (e.g. several traces or a batch).
6. Pass lang: "ja" on check_address_risk when the user writes in Japanese.

Interpreting results

• risk_level is one of safe / low / medium / high / critical; risk_score is 0–100.
• detections list the rules that fired with evidence (counterparty, tx hash, amount). Quote the evidence, not just the rule name.
• ml_anomaly_score is an unsupervised signal. Treat it as corroboration, never as the sole reason for a conclusion.
• Sanctions sources are named per hit. OFAC SDN hits are the strongest; ScamDB hits are community / vendor intelligence and should be described as such.
• bridge_flow_trace returns nodes with roles (solver / relay / user / exchange / bridge) and edges with on-chain tx signatures. same_intent_correlation means the source and destination legs were matched by timing and amount, which is probabilistic.

Report format

Keep the answer short and evidence-first:

1. One-line verdict: risk level, score, sanctions status.
2. Key detections with the specific evidence (tx hash, counterparty label, amount).
3. Recommended next step framed as an option for the user's compliance policy (monitor / enhanced due diligence / escalate), never as a decision to file a report.
4. The raw address, chain and scan timestamp so the result can be reproduced.

Limitations

• bridge_flow_trace covers EVM chains, Solana and Kaia only. It does not accept tron or xrp.
• detect_coinjoin is Bitcoin only.
• Risk scores reflect public ledger data only. They do not include KYC data, Travel Rule messages or off-chain information.
• Do not present a safe result as a guarantee. Absence of detections is not evidence of legitimacy.