Webacy MCP Server for AI Coding Agents

The Webacy API exposes an MCP (Model Context Protocol) server that lets AI coding assistants like Claude Code and Cursor query blockchain risk data directly from your development environment. Instead of switching to a browser or writing API calls manually, you can ask your AI assistant questions like “Analyze the risk of 0x742d…” and get real-time results inline.

Prerequisites

An API key from developers.webacy.co

Keep your API key secret. Never commit it to version control.

Installation

Claude Code

Add the Webacy MCP server using the CLI:

claude mcp add webacy-mcp --transport http https://api.webacy.com/mcp --header "x-api-key: YOUR_API_KEY"

Or add it manually to your .claude/mcp.json file:

{
  "mcpServers": {
    "webacy-mcp": {
      "type": "http",
      "url": "https://api.webacy.com/mcp",
      "headers": {
        "x-api-key": "YOUR_API_KEY"
      }
    }
  }
}

Cursor

Open Cursor Settings and navigate to MCP Servers. Click Add Server and configure:

{
  "mcpServers": {
    "webacy-mcp": {
      "url": "https://api.webacy.com/mcp",
      "headers": {
        "x-api-key": "YOUR_API_KEY"
      }
    }
  }
}

Other MCP Clients

Any MCP client that supports HTTP Streamable transport can connect to the Webacy MCP server. Use the following configuration:

Setting	Value
URL	`https://api.webacy.com/mcp`
Transport	HTTP Streamable
Auth Header	`x-api-key: YOUR_API_KEY`

Available Tools

The MCP server exposes seven tools for blockchain risk analysis: three address/token tools plus four vault and RWA tools.

There is no get_rwa_grades tool. To list RWA / pegged tokens with risk data, use list_rwa_tokens.

Choosing the right tool

Several tools accept a token address, so pick by what you are analyzing. Stablecoins, RWAs, and pegged tokens should use get_rwa_token_risk — it adds both depeg / peg-stability and structural-health analysis (collateral quality, governance, liquidity depth) that get_token_risk does not. AI assistants configured with this server are given the same guidance, so a prompt like “analyze PYUSD on Ethereum” routes to the RWA tool automatically.

If you want to analyze…	Use
A stablecoin, RWA, or pegged token (USDC, USDT, PYUSD, DAI, USDe, tokenized treasuries/funds like BUIDL, gold like PAXG)	`get_rwa_token_risk` (browse with `list_rwa_tokens`)
Any other token contract (security flags, market data)	`get_token_risk`
An ERC-4626 vault	`get_vault_risk` (browse with `list_vaults`)
A wallet or contract address (general security profile)	`get_address_risk`
A token’s holder distribution / concentration	`get_holder_analysis`

`get_address_risk`

Analyze the risk profile of a blockchain address (wallet or contract). Returns risk score, risk factors, and detailed security analysis.

Parameter	Type	Required	Description
`address`	string	Yes	The blockchain address to analyze
`chain`	string	Yes	Blockchain network (e.g. `eth`, `sol`, `base`)
`detailed_response`	boolean	No	Include detailed risk factor breakdowns
`show_low_risk`	boolean	No	Include low-risk factors in the response
`modules`	string[]	No	Specific risk analysis modules to run

`get_token_risk`

Analyze the risk profile of a general token contract. Returns token security flags, market data, and economic risk indicators. For stablecoins, RWAs, or other pegged tokens (e.g. USDC, USDT, PYUSD, DAI), prefer get_rwa_token_risk, which adds depeg / peg-stability and structural-health analysis.

Parameter	Type	Required	Description
`address`	string	Yes	The token contract address to analyze
`chain`	string	Yes	Blockchain network (e.g. `eth`, `sol`, `base`)
`metrics_date`	string	No	Date for historical metrics (DD-MM-YYYY format)
`modules`	string[]	No	Specific risk analysis modules to run

`get_holder_analysis`

Analyze the holder distribution and concentration of a token. Returns top holders, holder counts, and distribution metrics.

Parameter	Type	Required	Description
`address`	string	Yes	The token contract address to analyze
`chain`	string	No	Blockchain network (defaults to `sol`)
`disable_refetch`	boolean	No	Skip re-fetching data and use existing data only
`refresh_cache`	boolean	No	Force refresh cached holder data

`get_vault_risk`

Get detailed risk analysis for an ERC-4626 vault. Returns risk score, risk tier, risk decomposition across 7 categories (structure, governance, liquidity, code quality, asset, performance, protocol), looping data, Morpho markets, and Webacy findings. Each response also carries the Webacy A+→F composite grade (see Composite grade).

Parameter	Type	Required	Description
`address`	string	Yes	The vault contract address (e.g. `0x1234...`)
`chain`	string	Yes	Blockchain network: `eth`, `arb`, `base`, `opt`, `pol`, `bsc`, `avax`, `gnosis`, `sol`

`list_vaults`

List ERC-4626 vaults with risk scores, filtering, and sorting. Returns paginated vault items with ecosystem aggregates (tier counts, TVL, highest risk, largest TVL). Each item carries the Webacy A+→F composite grade (see Composite grade), or null when the vault could not be graded.

Parameter	Type	Required	Description
`chain`	string	No	Filter by chain: `eth`, `arb`, `base`, `opt`, `pol`, `bsc`, `avax`, `gnosis`, `sol`
`tier`	string	No	Filter by risk tier: `low`, `medium`, `high`, `critical`, `unknown`
`protocol`	string	No	Filter by protocol: `morpho`, `aave`, `compound`, `euler`, `spark`, `fluid`, `beefy`, `yearn`, `lagoon`, `centrifuge`, `gauntlet`
`underlying`	string	No	Filter by underlying asset symbol (e.g. `USDC`)
`min_tvl`	number	No	Minimum TVL in USD
`min_score`	number	No	Minimum risk score (0–100)
`max_score`	number	No	Maximum risk score (0–100)
`q`	string	No	Search by symbol, name, or address
`sort`	string	No	Sort: `score_desc`, `score_asc`, `tvl_desc`, `tvl_asc`, `apy_desc`, `looping_desc`, `utilization_desc`, `utilization_asc`, `name_asc`, `lockup_asc`, `protocol_asc`
`page`	number	No	Page number (1-indexed, default 1)
`page_size`	number	No	Items per page (max 50, default 20). Lower than other lists because each item is graded with a full composite fetch.

`get_rwa_token_risk`

Depeg and structural-health risk analysis for a stablecoin, RWA, or pegged token — e.g. USDC, USDT, PYUSD, DAI, USDe, tokenized treasuries or money-market funds (BUIDL), or commodity tokens (PAXG). Prefer this over get_token_risk whenever the asset is pegged. Returns the depeg risk score, depeg snapshot, score decomposition, depeg history, and risk tier, plus the structural composite grade, weighted category scores, and coverage metadata.

Parameter	Type	Required	Description
`address`	string	Yes	The token contract address
`chain`	string	No	Blockchain network (required if the address exists on multiple chains)
`hours`	number	No	Hours of depeg history to return (default 24, max 168)

`list_rwa_tokens`

List RWA and pegged tokens (stablecoins) with depeg and structural risk data. Returns paginated items with ecosystem aggregates (tier counts, denomination breakdown). Each item carries the Webacy A+→F composite grade (see Composite grade), or null when the token is not in the graded dataset.

Parameter	Type	Required	Description
`chain`	string	No	Filter by blockchain network
`denomination`	string	No	Filter by denomination code (e.g. `USD`, `EUR`, `XAU`)
`tier`	string	No	Filter by risk tier: `critical`, `warning`, `watch`, `ok`, `premium`
`tags`	string[]	No	Filter by token labels: `standard`, `yield`, `rwa`, `gold`, `bridged`, `vault`
`min_score`	number	No	Minimum risk score (0–100)
`max_score`	number	No	Maximum risk score (0–100)
`min_mcap`	number	No	Minimum market cap in USD
`liquidity`	string	No	Filter by liquidity tier: `high`, `medium`, `low`, `very_low`
`q`	string	No	Search by symbol, name, or address
`sort`	string	No	Sort field: `score`, `symbol`, `chain`, `tier`, `abs_dev_clean`, `market_cap_usd`, `ts`
`order`	string	No	Sort order: `asc`, `desc`
`page`	number	No	Page number (1-indexed, default 1)
`page_size`	number	No	Items per page (max 100, default 20)

Vault and RWA tools cover different chains than the address/token tools. get_vault_risk and list_vaults support 9 chains (eth, arb, base, opt, pol, bsc, avax, gnosis, sol). The address/token tools use the chain list below.

Composite grade

The RWA and vault tools (get_rwa_token_risk, list_rwa_tokens, get_vault_risk, list_vaults) return a Webacy composite grade — the same A+→F rating shown on dd.xyz. It is the v3 composite (risk-polarity: a lower score earns a better grade), so a token or vault grades identically across the detail and list tools.

{
  "grade": {
    "letter": "A-",
    "score": 12,
    "stars": 5
  }
}

Where letter is the A+ (lowest risk) → F (highest risk) band, score is 0–100 (higher = worse), and stars is 1–5 derived from the letter band. The grade is best-effort and nullable: grade is null when the asset is not in the graded dataset or the grade could not be computed, and its absence never fails the underlying risk response. The generic get_token_risk and get_address_risk tools do not return a composite grade — it applies to stablecoins/RWAs and vaults only.

Hard-gating and pre-execution use

REST is the primary integration path for hard-gate and pre-execution decisioning. The MCP server is a convenience wrapper over a subset of the REST surface. Treat missing, stale, or errored data as unknown — never as safe, and check the relevant freshness field before using a result in a decisioning path. See the API introduction for the full fail-behavior guidance.

Supported Chains

The chain parameter accepts: eth, sol, arb, pol, opt, base, bsc, ton, sui, stellar, btc, sei, hedera.

See Supported Blockchains for full details on each chain.

Example Usage

Once configured, you can query Webacy risk data directly from your AI assistant:

You:    Analyze the risk of 0x742d35Cc6634C0532925a3b844Bc454e4438f44e on Ethereum

Claude: I'll check the risk profile using the Webacy MCP tools...

        The address has an overall risk score of 25.99/100 (low risk).
        No high-severity issues were found. The address is an EOA (not a contract).

Because USDC is a stablecoin, an assistant analyzing it reaches for the RWA tool, which covers both peg stability and structural health:

You:    Analyze the risk of USDC on Ethereum (0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48)

Claude: This is a stablecoin, so I'll use get_rwa_token_risk for depeg and structural analysis...

        USDC is holding its $1.00 peg (deviation < 0.1%), risk tier "ok",
        with a structural composite grade of A.

The same routing applies to any pegged asset by name — a stablecoin like PYUSD goes to the RWA tool, not the generic token tool:

You:    Analyze PYUSD on Ethereum

Claude: PYUSD is a stablecoin, so I'll use get_rwa_token_risk...

        PYUSD is holding its $1.00 peg, risk tier "ok", structural composite grade A-.

You can also analyze generic token contracts and holder distributions:

You:    What's the contract security risk for this token: 0x... on Ethereum?

You:    Show me the holder analysis for this Solana token: EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v

Next Steps

API Reference

Explore all available endpoints

SDK

Use the TypeScript SDK for programmatic access

Risk Levels

Understand how to interpret risk scores

RWA Diligence Walkthrough

Extract a full DD picture for a real-world asset, end to end

Getting Started

Guides & Walkthroughs

Risk Ratings, Scoring, and Documentation

SDK

Integrations

Essentials

Glossary

Webacy MCP Server for AI Coding Agents

Prerequisites

Installation

Claude Code

Cursor

Other MCP Clients

Available Tools

Choosing the right tool

`get_address_risk`

`get_token_risk`

`get_holder_analysis`

`get_vault_risk`

`list_vaults`

`get_rwa_token_risk`

`list_rwa_tokens`

Composite grade

Hard-gating and pre-execution use

Supported Chains

Example Usage

Next Steps

API Reference

SDK

Risk Levels

RWA Diligence Walkthrough

​Prerequisites

​Installation

​Claude Code

​Cursor

​Other MCP Clients

​Available Tools

​Choosing the right tool

​get_address_risk

​get_token_risk

​get_holder_analysis

​get_vault_risk

​list_vaults

​get_rwa_token_risk

​list_rwa_tokens

​Composite grade

​Hard-gating and pre-execution use

​Supported Chains

​Example Usage

​Next Steps

API Reference

SDK

Risk Levels

RWA Diligence Walkthrough

Prerequisites

Installation

Claude Code

Cursor

Other MCP Clients

Available Tools

Choosing the right tool

`get_address_risk`

`get_token_risk`

`get_holder_analysis`

`get_vault_risk`

`list_vaults`

`get_rwa_token_risk`

`list_rwa_tokens`

Composite grade

Hard-gating and pre-execution use

Supported Chains

Example Usage

Next Steps