See what a wallet actually did — and who it dealt with.
Raw account_tx is a wall of hex and drops. This turns it into plain language — “Received 100 SOLO from r…”, “Set a trustline to <token>” — and annotates it with the signals Cerberus owns: counterparties on the proprietary rug blocklist are flagged, new trustlines to blocklisted issuers are flagged, and account-takeover transactions (SetRegularKey, SignerListSet, master-key disable) are surfaced as notable. Point it at your own address and it becomes compromise detection. Returns the XRP balance, a summary, and a marker to page further back.
MCP tool: get_wallet_activity Price: $0.008 / callLayer 02 · Address & counterparty risk
Parameters
| Param | Description |
|---|---|
address | XRPL classic address (r...) |
limit | how many recent transactions, newest first (default 30, max 100) |
Example
Call (MCP tools/call arguments):
{
"address": "rsoLo2S1kiGeCcn6hCUXVrCpGMWLrRrLZz",
"limit": 3
}
Result:
{
"ok": true,
"address": "rsoLo2S1kiGeCcn6hCUXVrCpGMWLrRrLZz",
"account_exists": true,
"xrp_balance": 41.35,
"count": 3,
"activity": [
{
"type": "Payment",
"direction": "in",
"success": true,
"amount": {
"value": 100.0,
"currency": "SOLO"
},
"counterparty": "rHb9CJAWyB4rj91VRWn96DkukG4bwodenr",
"counterparty_flag": null,
"notable": null,
"summary": "Received 100 SOLO from rHb9CJAWyB4\u2026"
}
],
"summary": {
"incoming": 2,
"outgoing": 1,
"distinct_counterparties": 3,
"flagged_counterparties": [],
"notable_events": 0,
"types": {
"Payment": 3
}
}
}
FAQ
How do I read what an XRPL wallet has been doing?
Call get_wallet_activity with the r-address. It returns recent transactions as plain-language activity — amounts and token names for payments, trustlines set, DEX and AMM operations — plus the XRP balance and a summary of inbound/outbound counts and counterparties.
Can I use this to detect a compromised wallet?
Yes — that's a core use. Watching your own address, the tool surfaces account-takeover transactions (SetRegularKey and SignerListSet hand signing authority to another key; disabling the master key locks in a change) as notable events, and flags any counterparty that's on the Cerberus rug blocklist. Unexpected ones are exactly what a compromise looks like.
What does 'flagged counterparty' mean?
The other address in a transaction (or the issuer of a new trustline) is on the Cerberus rug blocklist — an address earned its place from confirmed rugs. It's a strong signal to investigate; run check_address on it for the full cross-chain verdict.
Related tools
check_xrpl_tokenLive safety verdict for any XRP Ledger token: clawback and global-freeze hard rejects, issuer blackhole status, LP-burn fraction,
check_issuer_reputationReputation for any XRP Ledger issuer: proprietary rug blocklist status plus historical detection outcomes from a production sniper
check_addressOne call, any chain: EVM address risk (sanctions, mixer, phishing, drainer, money-laundering) aggregated from GoPlus, plus native
check_transactionSimulate an unsigned XRPL transaction against the live ledger: its exact balance changes, whether it would succeed, and a scan for
check_endpointOne call before an agent connects to a third-party MCP server or HTTP tool: TLS identity, domain age, and a tool-poisoning scan ofhttps://cerberusindex.com/mcp — see
the quickstart. Payment is automatic for x402-aware clients.
Verdicts are informational risk signals, not financial advice.