Is this address safe to send to?

The screening giants cover EVM but aren't agent-native, and nobody screens the XRP Ledger at all. This does both behind one verdict. For an EVM address it aggregates GoPlus — sanctions, mixer, phishing, drainer, money-laundering, cybercrime — and tells you whether it's a contract or a wallet. For an XRPL r-address it runs Cerberus's own engine: the production rug blocklist, live clawback and global-freeze flags (can this address seize or freeze tokens it issues?), burn-address detection, and prior launch history. Chain is auto-detected.

MCP tool: check_address Price: $0.008 / callLayer 02 · Address & counterparty risk

Parameters

ParamDescription
address0x EVM address or XRPL classic address (r...)
chainEVM network: ethereum (default), base, bsc, polygon, arbitrum, optimism, avalanche… (ignored for XRPL)

Example

Call (MCP tools/call arguments):

{
  "address": "rDbS53G2nP3ksrNSea3rjFSZa3grkzVtf6"
}

Result:

{
  "ok": true,
  "address": "rDbS53G2nP3ksrNSea3rjFSZa3grkzVtf6",
  "chain": "xrpl",
  "address_type": "xrpl",
  "risk": "high_risk",
  "reasons": [
    "on the Cerberus rug blocklist: manual:UW_position_3_rug_relaunch"
  ],
  "source": "Cerberus XRPL engine",
  "flags": [
    "blocklisted"
  ]
}

FAQ

Which chains does address screening cover?

EVM chains — Ethereum, Base, BSC, Polygon, Arbitrum, Optimism, Avalanche and more — via GoPlus Address Security, plus the XRP Ledger via Cerberus's own engine. The chain is detected from the address format; pass `chain` to pick which EVM network to screen against (default Ethereum).

What can you tell me about an XRPL address that others can't?

The incumbents don't screen XRPL at all. This checks an r-address against a rug blocklist earned in production, reads its live account flags (clawback and global freeze mean it can seize or freeze tokens it issues — a total-loss power over holders), detects burn/blackhole addresses where funds are unrecoverable, and surfaces prior token-launch history.

Where does the EVM risk data come from?

GoPlus Address Security, aggregated and normalized into our verdict schema, always attributed as GoPlus. Coverage reflects theirs — it has gaps, and an address with no flags is 'no risk on record', not a guarantee of safety. When the provider can't be reached the verdict is 'unknown', never a fabricated 'safe'.

What do the risk levels mean?

high_risk: a definitive adverse signal (sanctions, drainer, money-laundering on EVM; blocklist or clawback/freeze power on XRPL) — do not proceed. caution: an associative or partial signal (honeypot association, burn address, prior launch history) worth verifying. safe: no adverse signal on record. unknown: the source couldn't be read.

Related tools

check_xrpl_tokenLive safety verdict for any XRP Ledger token: clawback and global-freeze hard rejects, issuer blackhole status, LP-burn fraction, check_issuer_reputationReputation for any XRP Ledger issuer: proprietary rug blocklist status plus historical detection outcomes from a production sniper get_wallet_activityTurn raw XRPL account_tx into readable activity: sent/received amounts with token names, trustlines, DEX/AMM ops — with rug-blockl check_transactionSimulate an unsigned XRPL transaction against the live ledger: its exact balance changes, whether it would succeed, and a scan for check_endpointOne call before an agent connects to a third-party MCP server or HTTP tool: TLS identity, domain age, and a tool-poisoning scan of

Browse the full tool suite →

Connect via MCP at https://cerberusindex.com/mcp — see the quickstart. Payment is automatic for x402-aware clients. Verdicts are informational risk signals, not financial advice.