cerberus-index

Live safety verdict for an XRPL token: clawback & global-freeze hard rejects, issuer blackhole status (can supply ever be re-minted?), NoFreeze, pool depth & trading fee, LP-burn fraction (is liquidity locked?), plus Cerberus's proprietary rug blocklist & detection history. Verdicts: unsafe | caution | likely_safe | unknown, with reasons. Covers BOTH XRPL fungible-token standards. `currency` may be a 3-char or 40-char hex trust-line code, OR a 48-char MPTokenIssuanceID — pass an issuance ID and the token is screened as a Multi-Purpose Token instead (issuance locked, clawback, freeze power, allow-listing, transferability, mint headroom and transfer fee), with `issuer` ignored because the issuance ID already identifies it. Price: $0.005 USDC. Missing something? Call `submit_feedback` (free) to request it. Pass `attest=true` to also get an Ed25519-SIGNED attestation of this verdict — portable proof you can log, hand to a counterparty, or verify later with `verify_attestation` (free) or the published key.

{
  "type": "object",
  "properties": {
    "issuer": {
      "title": "Issuer",
      "type": "string"
    },
    "currency": {
      "title": "Currency",
      "type": "string"
    },
    "attest": {
      "default": false,
      "title": "Attest",
      "type": "boolean"
    }
  },
  "required": [
    "issuer",
    "currency"
  ],
  "title": "check_xrpl_tokenArguments"
}

Reputation for an XRPL issuer: blocklist status + historical detection outcomes. Price: $0.002 USDC. Missing something? Call `submit_feedback` (free) to request it.

{
  "type": "object",
  "properties": {
    "issuer": {
      "title": "Issuer",
      "type": "string"
    }
  },
  "required": [
    "issuer"
  ],
  "title": "check_issuer_reputationArguments"
}

Cross-chain address & counterparty risk — one call before you send to, approve, or trust an address. EVM chains (ethereum, base, bsc, polygon, arbitrum, optimism, avalanche, …): sanctions, mixer, phishing, drainer, money-laundering & cybercrime flags aggregated from GoPlus, told whether it's a contract or a wallet. XRP Ledger (r-addresses): Cerberus's own engine — the production rug blocklist, live clawback/global-freeze flags (can this address seize or freeze tokens it issues?), burn-address detection, and prior launch history — coverage no incumbent offers. Chain is auto-detected; pass `chain` to pick the EVM network (default ethereum). Verdict: high_risk | caution | safe | unknown, source named. Price: $0.008 USDC. Missing something? Call `submit_feedback` (free) to request it. Pass `attest=true` to also get an Ed25519-SIGNED attestation of this verdict — portable proof you can log, hand to a counterparty, or verify later with `verify_attestation` (free) or the published key.

{
  "type": "object",
  "properties": {
    "address": {
      "title": "Address",
      "type": "string"
    },
    "chain": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Chain"
    },
    "attest": {
      "default": false,
      "title": "Attest",
      "type": "boolean"
    }
  },
  "required": [
    "address"
  ],
  "title": "check_addressArguments"
}

Simulate an unsigned XRPL transaction and tell you what it will ACTUALLY do — before you sign it. Pass the transaction JSON; get back (1) its intent in plain language, (2) a live-ledger dry-run (`simulate`): would it succeed, and the exact balance changes per account — computed, never submitted, never signed — and (3) drain vectors flagged: handing over your signing key (SetRegularKey / SignerListSet), disabling your master key, enabling clawback, partial-payment tricks, trustlines to blocklisted issuers, sends to flagged addresses. Verdict: danger | caution | safe | unknown. A transaction that would fail on-chain is reported as such. Price: $0.010 USDC. Missing something? Call `submit_feedback` (free) to request it. Pass `attest=true` to also get an Ed25519-SIGNED attestation of this verdict — portable proof you can log, hand to a counterparty, or verify later with `verify_attestation` (free) or the published key.

{
  "type": "object",
  "properties": {
    "transaction": {
      "anyOf": [
        {
          "additionalProperties": true,
          "type": "object"
        },
        {
          "type": "string"
        }
      ],
      "title": "Transaction"
    },
    "account": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Account"
    },
    "attest": {
      "default": false,
      "title": "Attest",
      "type": "boolean"
    }
  },
  "required": [
    "transaction"
  ],
  "title": "check_transactionArguments"
}

Endpoint & tool trust — one call before an agent connects to a third-party MCP server or HTTP tool. Pass the endpoint `url` (and, to unlock the strongest check, its `tools`: the name/description/inputSchema the agent is about to trust). Returns three signals behind one verdict: (1) transport & TLS identity — encrypted, valid chain, not expired or self-signed; (2) domain age via RDAP — freshly-registered hosts are a scam tell; (3) a TOOL-POISONING scan of the tool definitions for the hidden directives that hijack agents — instruction overrides, 'don't tell the user', data exfiltration, secret harvesting, tool-shadowing, and invisible-unicode / homoglyph steganography that a human reviewer can't see. Nobody else screens tool descriptions for injection. Verdict: trusted | caution | untrusted | unknown, with per-finding evidence. Price: $0.008 USDC. Missing something? Call `submit_feedback` (free) to request it. Pass `attest=true` to also get an Ed25519-SIGNED attestation of this verdict — portable proof you can log, hand to a counterparty, or verify later with `verify_attestation` (free) or the published key.

{
  "type": "object",
  "properties": {
    "url": {
      "title": "Url",
      "type": "string"
    },
    "tools": {
      "anyOf": [
        {
          "items": {},
          "type": "array"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Tools"
    },
    "attest": {
      "default": false,
      "title": "Attest",
      "type": "boolean"
    }
  },
  "required": [
    "url"
  ],
  "title": "check_endpointArguments"
}

Holder distribution & concentration risk for an XRPL token: holder count, top-1 and top-10 share of circulating supply, AMM pool excluded from whale math. Flags single-wallet dump risk. Best for newer tokens (large tokens report 'unknown_large' honestly rather than guessing). Price: $0.008 USDC. Missing something? Call `submit_feedback` (free) to request it.

{
  "type": "object",
  "properties": {
    "issuer": {
      "title": "Issuer",
      "type": "string"
    },
    "currency": {
      "title": "Currency",
      "type": "string"
    }
  },
  "required": [
    "issuer",
    "currency"
  ],
  "title": "token_holdersArguments"
}

Bidirectional domain verification for an XRPL issuer: decodes the on-chain Domain field and checks the domain's /.well-known/xrp-ledger.toml actually claims the issuer back. verified true/false with reasons — a strong legitimacy signal (its absence is a yellow flag). Price: $0.003 USDC. Missing something? Call `submit_feedback` (free) to request it.

{
  "type": "object",
  "properties": {
    "issuer": {
      "title": "Issuer",
      "type": "string"
    }
  },
  "required": [
    "issuer"
  ],
  "title": "verify_issuer_domainArguments"
}

Cross-chain identity for an XRPL token — 'what is this, everywhere it exists?' Resolves the token's real identity across chains and catches IMPOSTORS: a token using a famous symbol (USDC, WBTC, SOLO…) from an issuer that is NOT that asset's canonical deployment is flagged — a fake USDC is a fake USDC on every chain, and a single-chain check misses it. Combines XRPLMeta (the XRPL registry: name, issuer, trust_level), CoinGecko (the canonical multi-chain asset and every chain it lives on), and Cerberus's rug blocklist. Verdict: verified_crosschain | native_xrpl | impostor_suspected | unverified | unknown. Price: $0.008 USDC. Missing something? Call `submit_feedback` (free) to request it. Pass `attest=true` to also get an Ed25519-SIGNED attestation of this verdict — portable proof you can log, hand to a counterparty, or verify later with `verify_attestation` (free) or the published key.

{
  "type": "object",
  "properties": {
    "issuer": {
      "title": "Issuer",
      "type": "string"
    },
    "currency": {
      "title": "Currency",
      "type": "string"
    },
    "attest": {
      "default": false,
      "title": "Attest",
      "type": "boolean"
    }
  },
  "required": [
    "issuer",
    "currency"
  ],
  "title": "resolve_assetArguments"
}

Cross-chain value truth for an XRPL token — 'is the price real?' Reconstructs the token's USD price on XRPL (XRPLMeta price × live XRP/USD) and checks it two ways: for a stablecoin, whether the PEG still holds (is USDC actually ~$1 here?); for any cross-chain asset, whether the XRPL price has DIVERGED from its canonical price elsewhere (manipulation, stale liquidity, or arbitrage). Weighs it against real 24h volume — a price on a dead pool is a number, not a market. Verdict: price_consistent | price_divergent | depegged | thin_liquidity | native_no_reference | unknown. Price: $0.008 USDC. Missing something? Call `submit_feedback` (free) to request it. Pass `attest=true` to also get an Ed25519-SIGNED attestation of this verdict — portable proof you can log, hand to a counterparty, or verify later with `verify_attestation` (free) or the published key.

{
  "type": "object",
  "properties": {
    "issuer": {
      "title": "Issuer",
      "type": "string"
    },
    "currency": {
      "title": "Currency",
      "type": "string"
    },
    "attest": {
      "default": false,
      "title": "Attest",
      "type": "boolean"
    }
  },
  "required": [
    "issuer",
    "currency"
  ],
  "title": "verify_priceArguments"
}

Recently detected XRPL AMM pools (newest first, max 100), enriched: readable name, age, initial liquidity and fee, plus an honest launch-time screening label. Price: $0.010 USDC. Missing something? Call `submit_feedback` (free) to request it.

{
  "type": "object",
  "properties": {
    "limit": {
      "default": 20,
      "title": "Limit",
      "type": "integer"
    }
  },
  "title": "get_new_poolsArguments"
}

Discover XRPL tokens — a DexScreener-style feed over 160k+ tokens. Rank by `sort` (volume_24h | marketcap | holders | trustlines | price), `query` to search by name, `limit`/`offset` to page, `trust_only` for XRPLMeta-trusted only. Each row returns name, icon, USD price, 24h volume, market cap, holder count, XRPLMeta trust level, AND our rug-blocklist flag — discovery with a trust signal built in. Run check_xrpl_token on any row for the full verdict. Price: $0.004 USDC. Missing something? Call `submit_feedback` (free) to request it.

{
  "type": "object",
  "properties": {
    "sort": {
      "default": "volume_24h",
      "title": "Sort",
      "type": "string"
    },
    "query": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Query"
    },
    "limit": {
      "default": 30,
      "title": "Limit",
      "type": "integer"
    },
    "offset": {
      "default": 0,
      "title": "Offset",
      "type": "integer"
    },
    "trust_only": {
      "default": false,
      "title": "Trust Only",
      "type": "boolean"
    }
  },
  "title": "explore_tokensArguments"
}

OHLC price-history candles for an XRPL token — open/high/low/close plus volume per interval, the series behind a candlestick chart. `interval` is 5 | 15 | 60 | 240 | D | W (minutes, or Day/Week); `bars` is how many candles (max 1000); prices are quoted in XRP, or pass `fx="USD"` for USD. Sourced from the XRPL DEX/AMM; returns ok:false with a reason when the pair is unknown or the source is unreachable — never invented prices. Price: $0.004 USDC. Missing something? Call `submit_feedback` (free) to request it.

{
  "type": "object",
  "properties": {
    "issuer": {
      "title": "Issuer",
      "type": "string"
    },
    "currency": {
      "title": "Currency",
      "type": "string"
    },
    "interval": {
      "default": "60",
      "title": "Interval",
      "type": "string"
    },
    "bars": {
      "default": 168,
      "title": "Bars",
      "type": "integer"
    },
    "fx": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Fx"
    }
  },
  "required": [
    "issuer",
    "currency"
  ],
  "title": "get_token_ohlcArguments"
}

A readable, risk-annotated history of what an XRPL wallet did: recent transactions turned into plain language (sent/received amounts with token names, trustlines, DEX/AMM ops), with counterparties on the Cerberus rug blocklist flagged, new trustlines to blocklisted issuers flagged, and account-takeover transactions (SetRegularKey, SignerListSet, master-key disable) surfaced as notable — watching your OWN wallet is compromise detection. Returns XRP balance, a summary (in/out counts, distinct and flagged counterparties, notable events), and a `marker` to page further back. Read-only. Price: $0.008 USDC. Missing something? Call `submit_feedback` (free) to request it.

{
  "type": "object",
  "properties": {
    "address": {
      "title": "Address",
      "type": "string"
    },
    "limit": {
      "default": 30,
      "title": "Limit",
      "type": "integer"
    }
  },
  "required": [
    "address"
  ],
  "title": "get_wallet_activityArguments"
}

A data-driven technical read on an XRPL token. Computes real indicators from OHLC — trend (9/21 EMA), RSI momentum, support/resistance, volatility, volume trend — with a plain-language assessment, and (when the server has an LLM configured) an AI-written outlook plus a genuine counter-argument. `interval` is 5|15|60|240|D|W, `bars` how many candles. Returns `ai_available` so you know whether the narrative is live. Always an informational signal, NEVER financial advice or a price target. Price: $0.020 USDC. Missing something? Call `submit_feedback` (free) to request it.

{
  "type": "object",
  "properties": {
    "issuer": {
      "title": "Issuer",
      "type": "string"
    },
    "currency": {
      "title": "Currency",
      "type": "string"
    },
    "interval": {
      "default": "D",
      "title": "Interval",
      "type": "string"
    },
    "bars": {
      "default": 90,
      "title": "Bars",
      "type": "integer"
    }
  },
  "required": [
    "issuer",
    "currency"
  ],
  "title": "analyze_token_trendArguments"
}

Quote an XRP->token swap against the live XLS-30 AMM pool: tokens out, spot vs effective price, price impact. Price: $0.001 USDC. Missing something? Call `submit_feedback` (free) to request it.

{
  "type": "object",
  "properties": {
    "issuer": {
      "title": "Issuer",
      "type": "string"
    },
    "currency": {
      "title": "Currency",
      "type": "string"
    },
    "xrp_in": {
      "default": 10,
      "title": "Xrp In",
      "type": "number"
    }
  },
  "required": [
    "issuer",
    "currency"
  ],
  "title": "quote_ammArguments"
}

Find the safest EXECUTABLE route to acquire an XRPL token and screen every hop. Unlike quote_amm (one direct AMM pool), this asks the ledger for real payment paths (order books + AMM + multi-hop) and runs the rug-safety engine over every issuer and gateway the route touches — a clean token reached through a hop that can freeze or claw back mid-route is a trap a destination-only check misses. Returns the cheapest route, its effective price, hop count, and a verdict: route_safe | route_caution | route_unsafe | no_route, with the risk on each hop. Pass your `account` for routes specific to your trustlines, or omit it for an indicative route. Price: $0.006 USDC. Missing something? Call `submit_feedback` (free) to request it.

{
  "type": "object",
  "properties": {
    "to_currency": {
      "title": "To Currency",
      "type": "string"
    },
    "to_issuer": {
      "title": "To Issuer",
      "type": "string"
    },
    "to_amount": {
      "default": 100,
      "title": "To Amount",
      "type": "number"
    },
    "from_currency": {
      "default": "XRP",
      "title": "From Currency",
      "type": "string"
    },
    "from_issuer": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "From Issuer"
    },
    "account": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Account"
    }
  },
  "required": [
    "to_currency",
    "to_issuer"
  ],
  "title": "find_best_pathArguments"
}

Monitor an XRPL token you hold and get alerted when it turns dangerous. A one-time check can't catch a rug that happens later — this watches the chain continuously for: AMM pool destroyed (completed rug), liquidity drained past your threshold, clawback enabled, global freeze set, issuer un-blackholed (supply re-mintable), issuer blocklisted, LP lock weakened. Returns a `subscriber_key` — STORE IT — then poll `check_alerts` (free). Registration is refused (with the reason) for tokens that are ALREADY compromised — blocklisted, clawback-enabled, frozen, or a husk pool — since those need a verdict now, not monitoring later. Sold as packages by monitoring window (`duration_days`): 1d $0.005 · 3d $0.012 · 7d $0.020 · 14d $0.035 · 21d $0.048 · 30d $0.060 USDC (longer = cheaper per day). The x402 payment demand lists every tier; pay the one you want and the watch length is set by what you pay. Calling again renews (extends) the watch. Missing something? Call `submit_feedback` (free) to request it.

{
  "type": "object",
  "properties": {
    "issuer": {
      "title": "Issuer",
      "type": "string"
    },
    "currency": {
      "title": "Currency",
      "type": "string"
    },
    "subscriber_key": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Subscriber Key"
    },
    "duration_days": {
      "default": 7,
      "title": "Duration Days",
      "type": "integer"
    },
    "drain_threshold_pct": {
      "default": 50,
      "title": "Drain Threshold Pct",
      "type": "number"
    },
    "rebaseline": {
      "default": false,
      "title": "Rebaseline",
      "type": "boolean"
    }
  },
  "required": [
    "issuer",
    "currency"
  ],
  "title": "watch_tokenArguments"
}

Collect alerts raised by your `watch_token` watches: what changed, how severe (critical | warning | info), and the on-chain numbers behind it — plus the status of every watch you own. Requires the `subscriber_key` from watch_token. Each alert is delivered once. FREE — poll it as often as every couple of minutes.

{
  "type": "object",
  "properties": {
    "subscriber_key": {
      "title": "Subscriber Key",
      "type": "string"
    },
    "limit": {
      "default": 50,
      "title": "Limit",
      "type": "integer"
    }
  },
  "required": [
    "subscriber_key"
  ],
  "title": "check_alertsArguments"
}

Verify a signed Cerberus attestation (from any tool called with `attest=true`). Recomputes the canonical claim and checks the Ed25519 signature against this server's published key. Returns valid true/false with the claim. FREE — and you can verify independently with the public key at /api/attestation; this is a convenience, not a trust bottleneck.

{
  "type": "object",
  "properties": {
    "attestation": {
      "additionalProperties": true,
      "title": "Attestation",
      "type": "object"
    }
  },
  "required": [
    "attestation"
  ],
  "title": "verify_attestationArguments"
}

Request a tool/feature or report an issue. FREE. High-volume requests get built first — this is how you shape Cerberus's roadmap.

{
  "type": "object",
  "properties": {
    "message": {
      "title": "Message",
      "type": "string"
    },
    "tool": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Tool"
    },
    "requested_capability": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Requested Capability"
    }
  },
  "required": [
    "message"
  ],
  "title": "submit_feedbackArguments"
}