Is this address safe to send to?

The screening giants cover EVM but aren't agent-native, and nobody screens the XRP Ledger at all. This does both behind one verdict. For an EVM address it aggregates GoPlus — sanctions, mixer, phishing, drainer, money-laundering, cybercrime — and tells you whether it's a contract or a wallet. For an XRPL r-address it runs Cerberus's own engine: the production rug blocklist, live clawback and global-freeze flags (can this address seize or freeze tokens it issues?), burn-address detection, and prior launch history. Chain is auto-detected.

MCP tool: check_address Price: $0.008 / callLayer 02 · Address & counterparty risk

Parameters

ParamDescription
address0x EVM address or XRPL classic address (r...)
chainEVM network: ethereum (default), base, bsc, polygon, arbitrum, optimism, avalanche… (ignored for XRPL)

Example

Call (MCP tools/call arguments):

{
  "address": "rDbS53G2nP3ksrNSea3rjFSZa3grkzVtf6"
}

Result:

{
  "ok": true,
  "address": "rDbS53G2nP3ksrNSea3rjFSZa3grkzVtf6",
  "chain": "xrpl",
  "address_type": "xrpl",
  "risk": "high_risk",
  "reasons": [
    "on the Cerberus rug blocklist: manual:UW_position_3_rug_relaunch"
  ],
  "source": "Cerberus XRPL engine",
  "flags": [
    "blocklisted"
  ]
}

FAQ

Which chains does address screening cover?

EVM chains — Ethereum, Base, BSC, Polygon, Arbitrum, Optimism, Avalanche and more — via GoPlus Address Security, plus the XRP Ledger via Cerberus's own engine. The chain is detected from the address format; pass `chain` to pick which EVM network to screen against (default Ethereum).

What can you tell me about an XRPL address that others can't?

The incumbents don't screen XRPL at all. This checks an r-address against a rug blocklist earned in production, reads its live account flags (clawback and global freeze mean it can seize or freeze tokens it issues — a total-loss power over holders), detects burn/blackhole addresses where funds are unrecoverable, and surfaces prior token-launch history.

Where does the EVM risk data come from?

GoPlus Address Security, aggregated and normalized into our verdict schema, always attributed as GoPlus. Coverage reflects theirs — it has gaps, and an address with no flags is 'no risk on record', not a guarantee of safety. When the provider can't be reached the verdict is 'unknown', never a fabricated 'safe'.

What do the risk levels mean?

high_risk: a definitive adverse signal (sanctions, drainer, money-laundering on EVM; blocklist or clawback/freeze power on XRPL) — do not proceed. caution: an associative or partial signal (honeypot association, burn address, prior launch history) worth verifying. safe: no adverse signal on record. unknown: the source couldn't be read.

Connect via MCP at https://cerberusindex.com/mcp — see the quickstart. Payment is automatic for x402-aware clients. Verdicts are informational risk signals, not financial advice.