Spree Commerce: open-source B2B and marketplace ecommerce
Open-source B2B and marketplace ecommerce; new stores include an MCP server for AI agents.
作者提供的说明(英文原文)
Pre-payment checks for AI agents: sanctions and AML screening of payees, payment pages and requests.
这三项永远不会合并成一个分数:意见、测量和人气是不同的东西。
我们还没有为它写通俗的介绍。下面是我们从注册中心读取到的事实。
选择你使用的 AI 应用,然后复制设置。
你需要
你用的是哪个应用?
在上方选择你的应用。我们会记住它,下次按钮会显示“安装到 …”。
适用于网页版、桌面版和手机版 Claude:
https://oceanalt.com/api/mcp打开 Claude Desktop → Settings → Developer → Edit Config,把下面的内容粘贴到 claude_desktop_config.json
{
"mcpServers": {
"aml": {
"command": "npx",
"args": [
"-y",
"oceanalt-aml-mcp"
]
}
}
}在终端中运行这条命令
claude mcp add --transport http aml https://oceanalt.com/api/mcpclaude mcp add aml -- npx -y oceanalt-aml-mcp粘贴到项目中的 .cursor/mcp.json,或 ~/.cursor/mcp.json
{
"mcpServers": {
"aml": {
"url": "https://oceanalt.com/api/mcp"
}
}
}粘贴到项目中的 .cursor/mcp.json,或 ~/.cursor/mcp.json
{
"mcpServers": {
"aml": {
"command": "npx",
"args": [
"-y",
"oceanalt-aml-mcp"
]
}
}
}浏览器会先询问是否打开应用,然后应用会显示设置并请你确认。密钥的值会留空,由你自己填写。
粘贴到项目中的 .vscode/mcp.json
{
"servers": {
"aml": {
"type": "http",
"url": "https://oceanalt.com/api/mcp"
}
}
}粘贴到项目中的 .vscode/mcp.json
{
"servers": {
"aml": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"oceanalt-aml-mcp"
]
}
}
}浏览器会先询问是否打开应用,然后应用会显示设置并请你确认。密钥的值会留空,由你自己填写。
ChatGPT 只能连接互联网上的服务器:
https://oceanalt.com/api/mcp菜单名称可能因套餐和版本不同而略有差异。
你的选择通过 Cookie 保存在这台设备上,无需账户。
这些设置是根据作者在注册中心的条目生成的。如果 README 的写法不同,请以 README 为准。
工具名称和描述与服务器在 2026年11月7日 报告的完全一致。这些内容由作者撰写,不是我们写的;我们以纯文本形式显示。
payment_decisionCall before sending funds, buying a service, settling an invoice or answering an x402 payment quote. Pass the payee address (to) and network to get allow | review | decline, evidence and retry semantics. Only an explicit allow passes this risk check; review, decline, missing or u
screen_addressRun an AML compliance screen on a single blockchain address BEFORE paying or receiving from it — the pre-payment check on a counterparty. Checks OFAC sanctions, known mixers, scam and phishing lists, stablecoin issuer freezes, and on-chain heuristics. Returns a verdict (clear | c
screen_endpointScreen a payment ENDPOINT (URL or domain) before calling it — the half that address screening cannot answer. In x402 the agent discovers a URL first, receives a 402, and only then learns where to pay: if that endpoint is spoofed, the payee address it hands back is freshly generat
check_payment_requestCall this before paying because an email, invoice or chat message asked you to. Pass what you received: raw headers if you have them, the From line, subject and body (or body_html), and the payee address if you already extracted one. OceanAlt checks whether the sender is who it c
counterparty_control_baselineAnswers a different question from address screening. Screening asks whether an address is risky; this asks how much damage the agent on the other side could do if it were talked into something. Returns that party's self-attestation against the OceanAlt Agent Control Baseline, spl
attest_control_baselineFile your operator's control-baseline attestation — the counterpart to counterparty_control_baseline. That tool asks what controls the OTHER side runs; this one publishes what YOUR side runs, so payers can see it before settling with you. No account, no key, one call. Gaps are al
baseline_controlsFetch the OceanAlt Agent Control Baseline: the list of controls an agent operator is expected to run before it is allowed to move money, each answerable yes or no. Call this before attest_control_baseline so you file against real control ids. Each control carries which gate enfor
resolve_agent_identityResolves who stands behind a paying agent: agent -> principal -> mandate -> credential -> wallet. Each link reports whether it holds; completeness counts how many do (a factual count, not a score). Wherever the chain breaks is where accountability stops. Publication is opt-in and
recent_flaggedReturn a representative sample of addresses on OceanAlt's reviewed risk list — OFAC-sanctioned, known mixers, and scam/phishing — each with its source category and reason. Takes no arguments. Free, no API key.
verify_payment_requirementsBefore paying an x402 402 response, check that its payment requirements (payTo, amount, asset, network, resource) were signed by the seller and not altered in transit by a proxy, CDN, SDK or another tool. x402 v2 carries the requirements in the PAYMENT-REQUIRED response header (b
check_calldata_intentAnti blind-signing. EVM: decodes what a transaction's calldata will actually do (ERC-20 transfer/approve/permit, setApprovalForAll, ownership transfer, native transfer). Solana: decodes a whole base64 transaction (SPL Token / Token-2022 Transfer, TransferChecked, Approve, SetAuth
payee_decideThe receiving side's check before settlement. Given the payee's registry id (sid) and, optionally, the payer, amount and purpose, returns accept / decline / hold_request_info / not_ready with reason codes, the fields to request, evidence and a signature. Rule-based, not a model's
evidence_bundleEverything OceanAlt holds about an address as public facts, in one Ed25519-signed bundle you can verify offline: screening verdict with evidence and freshness, profile signals, one-hop relations to listed addresses, fulfillment receipt stats and coverage. A witness, not a prosecu
我们检查的是任何人都能看到的信息;我们没有阅读代码。不适用的检查项不计入总数。 · 检查于 2026年11月9日
注册名称已通过域名 oceanalt.com 验证(注册中心会核实域名所有权)
我们还没有从 GitHub 读取这个仓库
我们还没有从 GitHub 读取这个仓库
在 1905 毫秒内响应(HTTP 200)
无需登录
已读取 13 个工具描述,未发现针对 AI 的隐藏指令
与注册中心里这个分类中所有活跃的服务器比较。只有当发布者拥有该仓库时,星标数才计入。
它在 3 项适用的基础检查中通过了 3 项。我们没有阅读代码。在添加密钥或令牌之前,请先看看这个服务器要求哪些权限,并使用只具备所需权限的密钥。
注册中心没有列出必需的密钥,不过有些服务器会在首次使用时要求你登录。
两种方式都可以:安装在你的电脑上,或者连接云端版本。
GitHub 仓库最后更新于–,最新版本(0.7.6)于19天前进入注册中心。
支持 MCP 的应用,例如 Claude Desktop、Claude Code、Cursor 和 VS Code。它通过 URL 连接,所以接受远程 MCP 服务器的应用也可以使用,例如开启开发者模式的 ChatGPT。
同一分类中有:Spree Commerce: open-source B2B and marketplace ecommerce, Stripe MCP, MCP Cn Commerce
同一分类中其他作者的服务器,按星标数排序。
如何看卡片:↓ 每周下载量i★ GitHub 星标i三大支柱:评价 · 检查 · 使用情况i更新 = 最新版本发布到注册中心的时间i
Open-source B2B and marketplace ecommerce; new stores include an MCP server for AI agents.
MCP server integrating with Stripe - tools for customers, products, payments, and more.
8 read-only MCP platform entries; support is operation-specific; merchant live acceptance pending
按原文从作者的仓库复制。PopNx MCP 没有审查或背书其内容。HTML、图片和脚本已被移除。链接会离开本站。
Native AML compliance for AI agents. An MCP server that lets Claude / Cursor / any MCP client call OceanAlt's on-chain address screening and compliance gateway. Receipts, not a black-box score — every verdict ships with verifiable evidence you can click through.
Built for agentic payments: ask *"should this payment proceed?"* before money moves, across 8 EVM chains + Tron + Solana.
For AI agents: call
screen_addressbefore any transfer — it returns aclear/caution/riskyverdict plus a 0–100 risk score and clickable evidence, so you can enforce a payment mandate with a receipt instead of a guess. Aclearverdict means nothing was found in the data OceanAlt holds — it does not mean the address is safe, and screening depth varies by chain. Free, no key.
| Tool | Input | What it does | Price |
|---|---|---|---|
payment_decision | to, amountUsdc?, purpose?, network? | Before your agent pays, call once → allow / review / decline + evidence + retry + a verifiable settlement attestation | Free |
screen_address | address (0x… / T… / Solana), network? | AML verdict + risk score + verifiable evidence | Free |
counterparty_control_baseline | entity? / agentId? | The other question: not "is this address risky" but "how much damage could the agent on the other side do if it were talked into something". Returns their control-baseline attestation, splitting what OceanAlt enforces from what they merely claim | Free |
resolve_agent_identity | agentId | Chain of accountability: agent → principal → mandate → credential → wallet. Wherever it breaks is where accountability stops | Free |
recent_flagged | — | Recently flagged high-risk addresses | Free |
check_calldata_intent | intent, EVM: contract, data · Solana: network:"solana", transaction (base64) | Anti blind-signing: decode what the transaction really does (ERC-20 approve dressed as a payment; SPL Approve / SetAuthority / CloseAccount) and compare with the declared payment → match / mismatch / unknown (unknown ≠ safe) | Free |
verify_payment_requirements | payment_required (decoded 402 JSON or raw base64), expect? | Was this x402 402 response tampered with in transit? Ed25519 check of the seller's signed requirements → ok / digest_mismatch / … | Free |
evidence_bundle | address, network? | One signed bundle of everything public OceanAlt can say about an address (screening + evidence + freshness, profile signals, one-hop relations, receipt stats); witness, not plaintiff | Free |
screen_endpoint | url | Is this payment URL or domain on a phishing list, or shaped like one? The half address screening cannot answer | Free |
check_payment_request | from, headers, body, pay_to … | An email, invoice or message asks you to pay: is the sender spoofed, are the links phishing, is the payee listed or changed, is there pressure or an instruction aimed at an AI? | Free |
baseline_controls | — | The Agent Control Baseline: controls an operator should run before its agent moves money | Free |
attest_control_baseline | entity, answers, gapPlan? | File your own side's control-baseline attestation so payers can look it up | Free |
payee_decide | payee (registry id), payer?, amountUsdc?, purpose? | The receiving side's check before settlement: accept / decline / hold_request_info / not_ready, with reason codes, the fields to request, evidence and a signature | Free |
compliance_decision | to, amountUsdc?, purpose?, network? | Full gateway verdict (allow / review / decline) + evidence | $0.002, or 1 credit |
deep_trace | address (T…) | Tron multi-hop USDT taint trace (depth ≤3) | $0.01 |
batch_screen | addresses[] (≤25) | Batch screening (up to 25 addresses) | $0.01 |
network (for 0x addresses): ethereum · base · bsc · polygon · arbitrum · optimism · avalanche (auto-detected if omitted). Tron & Solana are auto-detected.
Human-readable fields (signals, note, advice) come back in English by default; pass lang: "zh" for Chinese. Every response also carries signal_keys — language-independent keys such as list.mixer or taint.onehop. Branch on those, not on the prose: wording changes, keys do not.
counterparty_control_baseline and resolve_agent_identity return found: false for most parties, because publishing is voluntary. That means no information — it is not a negative signal, and an agent should never decline a payment on that basis alone. Fall back to payment_decision.
Add to your MCP client config (Claude Desktop, Claude Code, Cursor, …):
{
"mcpServers": { "oceanalt-aml": { "command": "npx", "args": ["-y", "oceanalt-aml-mcp"] } } }
The free tools need no API key and no signup.
The paid tools pay per call over x402 — HTTP 402 → sign one USDC authorization → 200. Add a payer wallet key to env and install the x402 peer deps:
{
"mcpServers": { "oceanalt-aml": { "command": "npx", "args": ["-y", "oceanalt-aml-mcp"], "env": { "OCEANALT_PAYER_KEY": "0x " } } } }
npm i @x402/core @x402/evm viem # in the MCP's environment
⚠️ Real money — Base mainnet. The paid endpoints settle real USDC on Base mainnet (
eip155:8453); the$prices above are charged in real USDC. Always confirm the live network/pricing manifest at https://oceanalt.com/api/x402 before paying, and use a dedicated low-balance payer wallet.
🔐 Wallet safety.
OCEANALT_PAYER_KEYis used only in your local process to sign one EIP-3009 authorization. It is never bundled in this package, never uploaded, never logged. The facilitator pays gas and never custodies your funds. Use a dedicated low-balance payer wallet, not your main funds.
| Var | Purpose | Default |
|---|---|---|
OCEANALT_BASE | Backend base URL | https://oceanalt.com (production) |
OCEANALT_PAYER_KEY | Payer wallet key — enables the paid tools | unset (free tools only) |
OCEANALT_CREDIT_TOKEN | Credit pack token from POST https://oceanalt.com/api/x402/credits ($0.10 = 100 decisions, valid 365 days). compliance_decision then uses one credit per call and signs nothing | unset |
This package is a thin (~9KB) client that calls OceanAlt's public API. It contains no proprietary logic and no data — the AML engine, scoring, and address-intelligence all run server-side at oceanalt.com. Every query still enriches OceanAlt's own address-intelligence DB (it grows with use).
oceanalt-amlMIT © OceanAlt
让 Claude / Cursor / 任意 MCP 客户端原生调用 OceanAlt 的链上地址合规筛查 + 合规网关。给收据,不给黑箱分:每条判决都带可点开核验的证据。覆盖 8 条 EVM 链 + 波场 TRON + Solana,付款前先问一句「这个收款方安不安全」。
payment_decision(付款前调一次 → allow/review/decline + 证据 + 可核验结算凭证)、screen_address(单查 + 证据)、payee_decide(收款方三态决策)、counterparty_control_baseline / resolve_agent_identity(对方的控制基线与责任链)、recent_flagged(近期被标记)、check_calldata_intent(盲签检查,EVM calldata 或整笔 Solana 交易)、screen_endpoint(付款网址是否钓鱼)、check_payment_request(收到让你付钱的邮件、发票或消息时,查发件人真假、钓鱼链接、收款地址、催付话术和写给 AI 的指令)、baseline_controls / attest_control_baseline(控制基线清单与自证)、verify_payment_requirements(402 应答验签)、evidence_bundle(签名证据包)。无需 key、无需注册。compliance_decision(网关判决)、deep_trace(波场深度追踪)、batch_screen(批量)。按需加载 @x402+viem,设置 OCEANALT_PAYER_KEY 才启用。价格:判决 $0.002、追踪 $0.01、批量 $0.01。也可以设置 OCEANALT_CREDIT_TOKEN(充值包 $0.10 = 100 次判决,在 POST https://oceanalt.com/api/x402/credits 购买),compliance_decision 每次扣 1 次,不再逐笔签名。eip155:8453),上表 $ 价按真实 USDC 收取。付款前务必以实时清单 https://oceanalt.com/api/x402 为准,并使用小额专用付款钱包。OCEANALT_PAYER_KEY 只在本地签一次 EIP-3009 授权,绝不随包发布/上传/打日志;facilitator 代付 gas、不托管资金。建议用小额专用钱包,别用主资金钱包私钥。oceanalt-aml;在线文档:https://oceanalt.com/en/api-docs;合规标准:https://oceanalt.com/en/rap。