See what a wallet actually did — and who it dealt with.

Raw account_tx is a wall of hex and drops. This turns it into plain language — “Received 100 SOLO from r…”, “Set a trustline to <token>” — and annotates it with the signals Cerberus owns: counterparties on the proprietary rug blocklist are flagged, new trustlines to blocklisted issuers are flagged, and account-takeover transactions (SetRegularKey, SignerListSet, master-key disable) are surfaced as notable. Point it at your own address and it becomes compromise detection. Returns the XRP balance, a summary, and a marker to page further back.

MCP tool: get_wallet_activity Price: $0.008 / callLayer 02 · Address & counterparty risk

Parameters

ParamDescription
addressXRPL classic address (r...)
limithow many recent transactions, newest first (default 30, max 100)

Example

Call (MCP tools/call arguments):

{
  "address": "rsoLo2S1kiGeCcn6hCUXVrCpGMWLrRrLZz",
  "limit": 3
}

Result:

{
  "ok": true,
  "address": "rsoLo2S1kiGeCcn6hCUXVrCpGMWLrRrLZz",
  "account_exists": true,
  "xrp_balance": 41.35,
  "count": 3,
  "activity": [
    {
      "type": "Payment",
      "direction": "in",
      "success": true,
      "amount": {
        "value": 100.0,
        "currency": "SOLO"
      },
      "counterparty": "rHb9CJAWyB4rj91VRWn96DkukG4bwodenr",
      "counterparty_flag": null,
      "notable": null,
      "summary": "Received 100 SOLO from rHb9CJAWyB4\u2026"
    }
  ],
  "summary": {
    "incoming": 2,
    "outgoing": 1,
    "distinct_counterparties": 3,
    "flagged_counterparties": [],
    "notable_events": 0,
    "types": {
      "Payment": 3
    }
  }
}

FAQ

How do I read what an XRPL wallet has been doing?

Call get_wallet_activity with the r-address. It returns recent transactions as plain-language activity — amounts and token names for payments, trustlines set, DEX and AMM operations — plus the XRP balance and a summary of inbound/outbound counts and counterparties.

Can I use this to detect a compromised wallet?

Yes — that's a core use. Watching your own address, the tool surfaces account-takeover transactions (SetRegularKey and SignerListSet hand signing authority to another key; disabling the master key locks in a change) as notable events, and flags any counterparty that's on the Cerberus rug blocklist. Unexpected ones are exactly what a compromise looks like.

What does 'flagged counterparty' mean?

The other address in a transaction (or the issuer of a new trustline) is on the Cerberus rug blocklist — an address earned its place from confirmed rugs. It's a strong signal to investigate; run check_address on it for the full cross-chain verdict.

Related tools

check_xrpl_tokenLive safety verdict for any XRP Ledger token: clawback and global-freeze hard rejects, issuer blackhole status, LP-burn fraction, check_issuer_reputationReputation for any XRP Ledger issuer: proprietary rug blocklist status plus historical detection outcomes from a production sniper check_addressOne call, any chain: EVM address risk (sanctions, mixer, phishing, drainer, money-laundering) aggregated from GoPlus, plus native check_transactionSimulate an unsigned XRPL transaction against the live ledger: its exact balance changes, whether it would succeed, and a scan for check_endpointOne call before an agent connects to a third-party MCP server or HTTP tool: TLS identity, domain age, and a tool-poisoning scan of

Browse the full tool suite →

Connect via MCP at https://cerberusindex.com/mcp — see the quickstart. Payment is automatic for x402-aware clients. Verdicts are informational risk signals, not financial advice.