Awesome MCP Servers by AI Anytime

Directory / Security

Iris

On-chain investigations: analyzes wallets on Solana, EVM chains, Bitcoin and Tron, traces transfers through mixers, exchanges and instant swaps, and finds a Solana token's insiders. API key with 10 free calls a day, or paid per call in USDC with x402. Endpoint: https://iriscan.app/mcp; Registry: io.github.0xVector0/iris

Live  Answered an MCP handshake without credentials and listed 6 tools.

Category
Security
Transport
http
Source
https://iriscan.app/mcp
Endpoint
https://iriscan.app/mcp
MCP Registry
io.github.0xVector0/iris
Reports itself as
iris 0.1.0
Protocol
2025-06-18
Tools
6
Context cost
about 2,393 tokens for the tool definitions (estimated at four characters per token)
Tool definitions last changed
2026-11-03
Handshake time
266 ms
Last checked
2026-11-03 10:54:41 UTC
Listed since
2026-10-28

Health and compatibility

Endpoint reachableVerifiedResponded in 266 ms
MCP handshake (initialize)VerifiedCompleted without credentials
Tool discovery (tools/list)Verified6 tools listed
AuthenticationVerifiedNone needed to connect
Protocol versionVerified2025-06-18
TransportVerifiedStreamable HTTP
Capabilities declaredVerifiedtools

Last checked . Verified means the check saw it happen; it says nothing about whether the server is safe.

Recent history

2 daily checks so far. Green answered, violet asked for auth, red did not answer.

Set up in your client

Claude Code

Run this in a terminal:

claude mcp add --transport http iris https://iriscan.app/mcp

Claude Desktop

Open Settings → Connectors → Add custom connector and paste this URL:

https://iriscan.app/mcp

Or bridge it through mcp-remote in claude_desktop_config.json (needs Node.js):

{
  "mcpServers": {
    "iris": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://iriscan.app/mcp"
      ]
    }
  }
}

Cursor

Add to Cursor

Or add it to ~/.cursor/mcp.json (or .cursor/mcp.json in a project):

{
  "mcpServers": {
    "iris": {
      "url": "https://iriscan.app/mcp"
    }
  }
}

VS Code

Add to VS Code

Or add it to .vscode/mcp.json:

{
  "servers": {
    "iris": {
      "type": "http",
      "url": "https://iriscan.app/mcp"
    }
  }
}

Or from a terminal:

code --add-mcp '{"name": "iris", "type": "http", "url": "https://iriscan.app/mcp"}'

Windsurf

Add it to ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "iris": {
      "serverUrl": "https://iriscan.app/mcp"
    }
  }
}

Other clients

Most clients accept this shape. The endpoint is:

https://iriscan.app/mcp
{
  "mcpServers": {
    "iris": {
      "type": "http",
      "url": "https://iriscan.app/mcp"
    }
  }
}

If it does not connect

Tools 6

Names, descriptions and input schemas exactly as the server returned them on 2026-11-03. This is the server author's own text. Nothing is run from this page. Labels such as read-only are declared by the server and are not verified. Raw JSON

analyze_addressread-onlyexternal accessAnalyze a wallet with Iris: on Solana (also a token mint or a program), Ethereum, Base, Arbitrum, Robinhood …

Analyze a wallet with Iris: on Solana (also a token mint or a program), Ethereum, Base, Arbitrum, Robinhood Chain, BNB Chain, Polygon, Bitcoin, Tron, dYdX or Noble. The chain is read from the address (0x is Ethereum unless chain says another EVM chain). Costs 1 credit (2 when depth is over 1000), or without an API key $0.05 ($0.10 deep) paid per call with x402; refunded (never settled) if it fails. A token, or a wallet Iris hasn't read recently, can take about a minute. For a wallet: what it is (exchange, MEV bot, drainer, sniper, scam or poisoning wallet, personal wallet...), its risk score, the database's labels on it, its behaviours with example transactions, who sent it its first SOL (Solana), where its money came from and went (largest counterparties, labeled), look-alike (address poisoning) addresses, and the exchanges and mixers it moved money with, with the latest transaction for each (to use with trace_transfer). For a token mint: its creator and the creator's funder, the launch bundle and who funded it, red flags, the wallets in its groups and its top holders. For a program: who can upgrade it, who deployed it, its top callers. Only the latest transactions (depth) are read. Returns a summary and a link to the full view on iriscan.app.

ParameterTypeDescription
addressstringrequiredThe address: Solana or Tron base58, 0x (EVM), Bitcoin (bc1, 1 or 3), dydx1 or noble1. On Solana also a token mint or a program.
chainstringoptionalThe chain, when the address's form doesn't say it: an EVM chain for a 0x address (ethereum by default). Read from the address otherwise. One of: solana, ethereum, base, arbitrum, robinhood, bsc, polygon, bitcoin …
depthintegeroptionalHow many of the most recent transactions to read. Over 1000 is a deep analysis (2 credits, or $0.10 with x402). Smaller is faster: 200 is often enough for a first look.

Example call (required arguments only, placeholder values):

{
  "method": "tools/call",
  "params": {
    "name": "analyze_address",
    "arguments": {
      "address": "..."
    }
  }
}
find_token_insidersread-onlyexternal accessFind the wallets a token's creator is linked to by money (a Solana token, or a Robinhood Chain or BNB Chain …

Find the wallets a token's creator is linked to by money (a Solana token, or a Robinhood Chain or BNB Chain one with chain): wallets it funded, wallets that paid it, wallets with the same funder, among the token's earliest buyers, the wallets handed tokens at launch and its largest holders. Says how much of the supply they bought and hold, with the transactions that link them, and why none were found when none were. Costs 2 credits, or without an API key $0.10 paid per call with x402; refunded (never settled) if it fails. Can take up to two minutes. Results are leads, not proof.

ParameterTypeDescription
chainstringoptionalrobinhood for a Robinhood Chain token (Pons launches), bsc for a BNB Chain one (Flap and four.meme launches). One of: solana, robinhood, bsc
limitintegeroptionalHow many candidate wallets to check (early buyers and top holders). Fewer is faster.
mintstringrequiredThe token's address: a Solana mint (base58), or a 0x token with chain.

Example call (required arguments only, placeholder values):

{
  "method": "tools/call",
  "params": {
    "name": "find_token_insiders",
    "arguments": {
      "mint": "..."
    }
  }
}
get_connectionsread-onlyEvery counterparty of an address that analyze_address analyzed in the last hour on this account (without an …

Every counterparty of an address that analyze_address analyzed in the last hour on this account (without an API key: for the x402 payer whose receipt is given): wallets it sent to or received from and the venues it swapped on, with labels, the native coin (SOL, ETH, BTC, TRX...) and stablecoins moved each way, the number of transactions, and the date and signature of its first and last transfer (for trace_transfer). Covers the transactions that analysis read only. For a token: the wallets in its groups (creator, bundlers, insiders, wallets handed supply) and its top holders. Free, from the earlier analysis; run analyze_address first.

ParameterTypeDescription
addressstringrequiredThe address analyze_address analyzed.
chainstringoptionalOptional: the chain it was analyzed on, for a 0x address analyzed on several EVM chains. The latest analysis otherwise. One of: solana, ethereum, base, arbitrum, robinhood, bsc, polygon, bitcoin …
filterstringoptionalflagged: threats, sanctioned and mixer counterparties, and look-alike (address poisoning) ones; for a token, its creator, bundlers and insiders. exchange or mixer: only those. One of: all, flagged, exchange, mixer
limitintegeroptionalHow many to list, largest by value first.
receiptstringoptionalOnly without an API key: the receipt analyze_address gave when it was paid with x402.

Example call (required arguments only, placeholder values):

{
  "method": "tools/call",
  "params": {
    "name": "get_connections",
    "arguments": {
      "address": "..."
    }
  }
}
get_creditsread-onlyThe account's plan and what is left: analyses, traces and pack credits, when the allowance renews, and what …

The account's plan and what is left: analyses, traces and pack credits, when the allowance renews, and what each tool costs. Without an API key: what each tool costs per call with x402. Free.

Takes no parameters.

Example call (required arguments only, placeholder values):

{
  "method": "tools/call",
  "params": {
    "name": "get_credits",
    "arguments": {}
  }
}
scan_launch_toolread-onlyexternal accessWhether a Solana wallet launched or traded memecoins with a launch kit, Proxima (proxima.tools) or BlockX, …

Whether a Solana wallet launched or traded memecoins with a launch kit, Proxima (proxima.tools) or BlockX, with the evidence. Proxima: its 5% sell fees (a separate bare transfer after each sell, built with it), its 5% cut of pump.fun creator-fee claims, its receipt round trips (895,880 lamports out, 890,880 back). BlockX: its fee inside each trade (0.4% to 0.8%), its nonce relay funding, cash-outs through nonce accounts created and emptied within seconds, its sweep of their rent. Lists the tokens the wallet launched and the relays tipped, the sells the tool took its fee on, each fee wallet (what it was paid, its balance now, whether it ever sent anything out), the creator-fee claims, and the tree of wallets that funded it, walked up to its root funder with what Iris knows of that root. A token's mint scans its creator. Free with an API key, or without one $0.02 paid per call with x402; never settled if it fails. Can take up to two minutes.

ParameterTypeDescription
mintstringoptionalOptional: narrow the report to this token (base58 mint).
walletstringrequiredThe Solana wallet (a dev or trader), or a token's mint to scan its creator (base58).

Example call (required arguments only, placeholder values):

{
  "method": "tools/call",
  "params": {
    "name": "scan_launch_tool",
    "arguments": {
      "wallet": "..."
    }
  }
}
trace_transferread-onlyexternal accessFollow one transfer through the mixer (Privacy Cash, Cloak, Umbra, encrypt.trade, MagicBlock Private …

Follow one transfer through the mixer (Privacy Cash, Cloak, Umbra, encrypt.trade, MagicBlock Private Payments, ShadowWire...), exchange, or instant-swap service (SideShift, ChangeNOW, FixedFloat, SimpleSwap, StealthEX, Changelly...) on its other side, by timing and amount: for a deposit, the withdrawals that match it after; for a withdrawal, the deposits that match it before. Gives the likely wallets with a confidence, and how many transfers of the same amount could also fit (the anonymity set). A swap service pays out in another asset, often on another chain: a deposit into SideShift is matched exactly from SideShift's public record of completed shifts (the coin, network and amount it paid out, and the Solana recipient), any other by value at the prices of the time (1 of N candidates). One-time deposit addresses that sweep to the service count as the service. Give the wallet and the signature (transaction hash) of a transaction where it sent money to, or received money from, a mixer, an exchange or a swap service (analyze_address and get_connections list them). Off Solana: on Tron through an exchange or an instant exchange, on an EVM chain through an instant exchange or a privacy pool (Tornado Cash, Railgun, Privacy Pools), on Bitcoin through a CoinJoin or an instant exchange. The chain is read from the wallet's address (pass chain for an EVM chain other than Ethereum). Costs 1 trace (or 3 pack credits), or without an API key $0.25 paid per call with x402; refunded (never …

ParameterTypeDescription
chainstringoptionalThe transfer's chain, when the wallet's address doesn't say it: an EVM chain for a 0x wallet (ethereum by default). One of: solana, ethereum, base, arbitrum, robinhood, bsc, polygon, bitcoin …
counterpartystringoptionalOptional: the exchange, swap service or mixer wallet (or pool contract) on the other side, when the transaction moved money with several. Iris picks the one it knows otherwise.
directionstringoptionalOptional, with counterparty: out when the wallet paid it (a deposit), in when it paid the wallet (a withdrawal). One of: in, out
signaturestringrequiredThe transaction: a Solana signature (base58), an EVM or Tron transaction hash, or a Bitcoin txid.
walletstringrequiredThe wallet whose deposit or withdrawal is traced (not the exchange or the mixer).

Example call (required arguments only, placeholder values):

{
  "method": "tools/call",
  "params": {
    "name": "trace_transfer",
    "arguments": {
      "wallet": "...",
      "signature": "..."
    }
  }
}

Badge

Maintain this server? Put its live status in your README:

MCP status badge

[![MCP status](https://mcp.aianytime.net/badge/iris.svg)](https://mcp.aianytime.net/s/iris/)

Edit this entry · Report a problem

More in Security

Checks record what a server answered, not whether it is safe. A listing is not a security audit; read a server's source and permissions before you connect it. Add a server · JSON · llms.txt · llms-full.txt

Browse: Agents, IDEs & developer tools · Search & discovery · Knowledge, memory & context · Media & generation · Security · Finance & markets · Marketing, content & social · Cloud, ops & data · Commerce, travel & logistics · Work & productivity · No account needed · Local servers