The full upstream README, mirrored here for reference. Install config, tool schemas, adoption signals, and an original overview live on the ERC 8126 Scan listing page.
Security intelligence for ERC-8004 agents: search the on-chain agent index and read verification results.
Nothing to install. This is a remote MCP server — connect to the URL and the tools appear.
| Endpoint | https://erc8126scan.ai/api/mcp |
| Transport | streamable-http |
| Registry | uk.co.cybercentry/erc-8126-scan |
| Website | https://erc8126scan.ai |
Every agent minted in the ERC-8004 Identity Registry is indexed automatically — 378,000+ and counting. Each one carries verification results across five dimensions, produced by the Cybercentry verification services:
| Dimension | What it covers | |
|---|---|---|
| ETV | Token verification | The agent's token contract |
| SCV | Solidity code verification | The staking contract source |
| MCV | Media content verification | C2PA provenance of the agent's image |
| WAV | Web application verification | The agent's live site or dApp frontend |
| WV | Wallet verification | OFAC sanctions screening and funding-chain risk |
This server exposes that index. It does not run verifications — it serves results already computed and stored.
Remote servers are added as connectors, not through claude_desktop_config.json — that file is for local servers that run a command.
https://erc8126scan.ai/api/mcpAnything that speaks MCP over streamable HTTP can connect. Point it at:
Check your client's own documentation for where a remote MCP server URL goes — some use a settings pane, some a config file. If yours takes a config file, the field is the server URL rather than a command.
Six tools, all read-only. None of them mints, writes on-chain, or spends your credits.
Two are free — no payment, wallet or account:
| Tool | What it returns |
|---|---|
list_services | The catalogue: every tool, its price, and how to read the risk fields |
get_index_stats | How many agents are indexed, so you can judge coverage before paying |
The other four are paid:
| Tool | What it returns | Per call | Plan |
|---|---|---|---|
search_agents | Filter the index by chain, risk score range and verification status; paginated | $0.001 | Starter |
get_agent | Full detail for one agent by UUID | $0.001 | Starter |
get_agent_activity | On-chain activity and liveness for one agent | $0.002 | Starter |
get_agent_report | Full security assessment: per-dimension findings and evidence | $0.05 | Pro |
Call list_services first. It is free, and authoritative about current pricing.
get_agent_report returns data only for agents owned by the wallet bound to your API key. Other agents return FORBIDDEN_NOT_OWNER. Public scores for any agent are available through get_agent.
Tools you cannot reach on your plan are hidden from tools/list rather than listed and refused.
Judge an agent by risk_level, not overall_risk_score.
Scoring presumes risk: a check that applies to an agent but has not been verified counts as 100. So an agent nobody has paid to assess scores exactly the same as one assessed and found dangerous. Most of the index is the former.
risk_level separates them:
| Value | Meaning |
|---|---|
not_verified | Nobody has assessed this agent yet. Not a finding against it. |
not_assessed | No score recorded |
low / moderate / elevated / high | Verified, scoring in that band |
critical | Verified and genuinely high risk |
Treating a not_verified agent as dangerous is the most common way to misread this data.
Two free tools, then two ways to pay for the rest. tools/list is public, so an agent can see everything on offer and what it costs before deciding to pay for anything.
x402 — no account, no key. The client is quoted a price, pays in USDC, and retries. Pay on whichever chain you hold funds on:
| Tool | Per call |
|---|---|
list_services | free |
get_index_stats | free |
search_agents | $0.001 |
get_agent | $0.001 |
get_agent_activity | $0.002 |
get_agent_report | $0.05 |
An unpaid call returns a JSON-RPC error with code 402, carrying the payment requirements in error.data — the same shape as the Cybercentry verification server.
API key — for volume, or clients that do not speak x402 yet. Pass an erc8126_ key as a bearer token:
Keys come from erc8126scan.ai/my-api-keys. Calls draw on your plan's daily quota instead of being paid for individually, and tool availability and page sizes follow your tier. A key that is presented but invalid is rejected outright rather than quietly falling back to per-call billing.
Either way, get_agent_report is scoped to agents owned by the caller — the wallet bound to your key, or the wallet that paid.
Cybercentry Limited