Skip to main content
Every result below is the same envelope the REST API returns, delivered as the tool result’s structured content.

​
Screen a withdrawal address

Before I process this withdrawal, check 0x098B716B8Aaf21512996dC57EB0615e2383E2f96 against the sanctions lists.
The agent calls screen_crypto_address:
Tool call
Result (truncated)
sanctioned: true means a government sanctions list matched — the agent should block the withdrawal and cite the source_url from the match.

​
Vet a signup

A new user signed up as [email protected] from IP 91.218.114.206 — anything concerning?
The agent chains three tools: screen_email ({ "email": "[email protected]" }), then detect_vpn and geolocate_ip on the IP. A clean email plus { "sanctioned": true, "country": "RU" } from geolocate_ip tells the agent the account needs enhanced review even though the identity itself is unlisted.

​
Narrow the lists

Check vitalik.eth, but only against OFAC and the EU list.
Tool call
The ENS name is resolved before screening, lists_checked comes back as ["ofac", "eu_fsf"], and matches from any other list are excluded. Slugs come from the source list registry — an unknown slug returns a tool error the agent can read and correct.

​
Interpreting flagged without sanctioned

A Tornado Cash association hit is list_type: "risk": it sets flagged: true but never sanctioned: true. Prompt your agent with your own policy for these — e.g. “treat risk-list hits as requiring manual review, not automatic blocking” — since the right response is a business decision, not a legal designation.