| Tool |
Summary |
aggregate_events |
Rank senders or event types by event count, or by a summed event field, across a window in one call instead of paging query_events. |
analyze_attack_tx |
Investigate one exploit transaction. |
analyze_multisig |
Read which of a multisig wallet’s committee keys sign and which never have, across its recent sent transactions rather than one. |
build_timeline |
Reconstruct an incident across up to 10 wallets or objects as one decoded timeline, deduplicated and ordered by checkpoint. |
build_wallet_edges |
Find possible shared operators when a fund trace reaches fresh wallets. |
check_coin_restrictions |
Read issuer freezes and whole-coin pauses from regulated coins’ on-chain deny lists. |
classify_deposit_address |
Classify exchange deposit behaviour over a chosen window. |
delete_finding |
Remove a finding by id, for retracting something that turned out to be wrong. |
export_case |
Render a case’s findings as a Markdown report, ready to paste into a ticket, post-mortem or writeup. |
find_flow_path |
Find value paths from one address to another. |
find_funding_source |
Follow a wallet’s first funding transaction and sender, then each funder’s own funding. |
find_funding_sources |
Trace funding for many addresses together, cheaper than repeated find_funding_source calls. |
find_shared_multisig |
Given several addresses you already suspect are related, find any multisig wallet they jointly control, even one that never appeared in your trace. |
get_address_fanout |
Measure how many distinct addresses an address transacts with, in BOTH directions, over its most recent activity. |
get_upgrade_history |
Read upgrade governance across a package lineage: each version’s ID, transaction, time, publisher, signing scheme and UpgradeCap holder then. |
list_findings |
List recorded findings, or every case with its finding count. |
manage_labels |
Manage chain-qualified address labels for investigation and trace sinks. |
resolve_bridge_transfer |
Resolve bridge transfers from a Sui digest using cross-chain message identities rather than guesses from amounts and timing. |
resolve_protocol_packages |
Find which package IDs of a protocol are actually emitting events right now, so a query targets something live. |
sample_control_addresses |
Draw a random control group from the same population as a cohort you are testing: other addresses that used the same protocol over the same window. |
save_finding |
Record a conclusion against a named case, so an investigation survives the session it happened in. |
screen_address |
Screen direct and indirect exposure to labelled malicious, sanctioned, exchange, bridge and mixer accounts, by default two hops in both directions. |
summarize_address_flows |
Summarize an address’s coin and object inflows, outflows, counterparties, gas sponsorship and bridge exits over a window. |
summarize_incident_losses |
Total an attacker’s take across exploit digests or a sender’s window, grouped by drained pool or vault. |
trace_flow_graph |
Trace every branch of funds forward or backward from a transaction or a time-bounded address, rather than the single branch trace_funds follows. |
trace_funds |
Follow a fund-flow path from a transaction. |
trace_object_history |
Trace an object’s versions, producing transactions, times and ownership transitions, including transfers, sharing, freezing and party transfers. |
- Title: Aggregate events
- Profile:
forensics
- Annotations:
openWorldHint: true, readOnlyHint: true
(Incident investigation) Rank senders or event types by event count, or by a summed event field, across a window in one call instead of paging query_events. Call it first without value_field: it returns counts plus each event type’s sample and numeric fields, then re-run naming one. group_pnl also ranks the matched transactions’ senders by their own balance changes, per coin and in USD, and flags PTBs where the filtered package was one leg of several. Check truncated: a partial scan cannot establish the full-window ranking. max_events or max_reads stops a scan, scan.stop_reason says which, and scan.next_call continues it. Each continuation ranks a disjoint slice, and a resumed ranking stays truncated even at exhaustion. Per-key counts and value_sum add across slices only when scan.groups_complete, subject to rounding; rankings, distinct_keys, distribution and P&L do not add.
| Parameter |
Type |
Required |
Description |
event_type |
string |
no |
Event struct type, matched by the package that DEFINES it, often not the one called: 0x…, 0x…::module or 0x…::module::Name. Any version’s ID is rewritten to the defining one; event_type_resolution reports it. |
module |
string |
no |
Emitting module or package, e.g. 0x2::coin or 0x2. The window selects original or called-version ID across the network cutover. module_scope reports scope; other_version_ids lists versions a post-cutover ID misses. |
sender |
string |
no |
Only events sent by this address. |
from |
string |
no |
Window start: ISO 8601 timestamp (2026-08-07T00:00:00Z) or a checkpoint number. |
to |
string |
no |
Window end: ISO 8601 timestamp, ‘now’, or a checkpoint number. |
group_by |
sender | event_type |
no |
What to rank (default ‘sender’). |
value_field |
string |
no |
Dotted path into the event JSON to sum, e.g. ‘deposit_value’. Omit to get counts plus field suggestions. |
value_scale |
number (greater than 0) |
no |
Divisor for the summed value, e.g. 100 when a protocol reports USD cents. |
top |
integer (1 to 200) |
no |
Groups to return (default 20). |
sort_order |
desc | asc |
no |
‘desc’ (default) ranks the largest groups first. ‘asc’ ranks the smallest, where coordinated dust activity shows. |
max_events |
integer (50 to 50000) |
no |
Scan budget (default 10000). Raise for busy protocols, or narrow the window. |
max_reads |
integer (1 to 1000) |
no |
Read budget across all module segments (default 200), counting short and empty reads. A stop sets truncated; scan.next_call continues. |
cursor |
string |
no |
Opaque cursor from scan.next_call. Keep the same filters and network. |
group_pnl |
boolean |
no |
Rank senders by own balance-change P&L, gas included, at historical prices. A multi-leg PTB’s gains may come from other packages. |
pnl_max_transactions |
integer (1 to 2000) |
no |
Distinct transactions read for group_pnl, oldest first (default 500). Check pnl.truncated. |
detail |
summary | full |
no |
‘summary’ (default) caps P&L coin and missing-price lists and states omissions. ‘full’ returns every row. Totals cover all rows. |
network |
mainnet | testnet | devnet |
no |
Network: ‘mainnet’ (default) | ‘testnet’ | ‘devnet’ |
- Title: Analyze attack transaction
- Profile:
forensics
- Annotations:
openWorldHint: true, readOnlyHint: true
- Metadata:
anthropic/maxResultSizeChars: 500000
(Incident investigation) Investigate one exploit transaction: gains and losses per address and coin in USD at block time, attacker profit or a signing victim’s loss and gainers, paired flash-loan and flash-swap legs, swap amounts and prices where events supply them, pool/vault/market flows attributed by event object ID, oracle calls and updates, and shared-object state before and after. It reconciles object and mint outflows to addresses against decoded events and read objects; address-to-address transfers cancel, and capped-out objects are counted. It flags caller-fed state or accounting reused in the PTB, state jumps, drains, excess liquidity or share minting, key replacement, coin-specific oracle mispricing, rapid profitable redemptions and last-minute third-party state rewrites. It includes decode_ptb checks, effects-based payouts, superseded versions and packages unvouched by the registry or publishing key. The whole transaction is read, including large command and event sets. USD needs no key; unpriced coins are listed. Flash legs, oracle touches and anomalies are heuristic leads; checks_run with no matches clears nothing. Follow flagged_commands to decode_ptb for the commands named by medium and high flags.
| Parameter |
Type |
Required |
Description |
digest |
string |
yes |
Transaction digest (Base58) |
attacker |
string |
no |
Profit address; default sender. May switch to largest priced gainer (>= $1) if sender has only a SUI payment/no coin change and no priced object movement, or gives away valued objects without taking value. Unpriced gains outside sender/chosen gainer block it, excluding flagged coins and sender-paid coin types. Reports attacker_defaulted_from_sender; pass an address to override. |
detail |
summary | full |
no |
‘summary’ (default): ~40k chars across lists; keeps anomaly/flash-linked pools, holders and addresses, sender and profit address. Totals/anomalies cover all rows; omitted counts the rest. ‘full’: all rows. |
network |
mainnet | testnet | devnet |
no |
Network: ‘mainnet’ (default) | ‘testnet’ | ‘devnet’ |
- Title: Analyze multisig
- Profile:
forensics
- Annotations:
openWorldHint: true, readOnlyHint: true
(Multisig investigation) Read which of a multisig wallet’s committee keys sign and which never have, across its recent sent transactions rather than one. Answers whether a treasury is run by fewer keys than its committee, whether the active signer set shifted, and which keys are unused. A member whose public key was written by hand is marked unsignable, since nobody holds its private key, and effective_committee gives the threshold against the keys that can sign. Use identify_address to learn that a wallet is a multisig; use this to learn how it operates.
| Parameter |
Type |
Required |
Description |
address |
string |
yes |
The multisig wallet’s address (0x…) |
max_transactions |
integer (1 to 500) |
no |
Sent transactions to examine, newest first (default 200). A key that signed only before this window looks dormant, so more is better. |
network |
mainnet | testnet | devnet |
no |
Network: ‘mainnet’ (default) | ‘testnet’ | ‘devnet’ |
- Title: Build timeline
- Profile:
forensics
- Annotations:
openWorldHint: true, readOnlyHint: true
(Incident investigation) Reconstruct an incident across up to 10 wallets or objects as one decoded timeline, deduplicated and ordered by checkpoint. from/to accept ISO times or checkpoints and bound the chain query. With from, reads forward from the start; otherwise reads each address’s latest per_address transactions before to, if given. coverage reports per-address counts, truncation, reached checkpoint and continuation bounds. subject_flow gives each tracked address’s signed coin changes; token_flow gives the sender’s only when it is untracked. Summary keeps ~35k characters in order, preserving failed entries and entries involving two tracked addresses; omitted reports the rest and detail:‘full’ lists entries up to limit.
| Parameter |
Type |
Required |
Description |
addresses |
array of string (1 to 10 items) |
yes |
Addresses to merge into one timeline (1-10) |
from |
string |
no |
Window start: ISO date (e.g. 2024-11-11T00:00:00Z) or a checkpoint number |
to |
string |
no |
Window end: ISO date or a checkpoint number |
limit |
integer (at most 200, greater than 0) |
no |
Max timeline entries to return (default 60) |
per_address |
integer (at most 300, greater than 0) |
no |
Transactions read per address (default 30); coverage marks truncation. For activity_hours, use 50+ spanning at least a week; smaller samples carry a warning. |
activity_hours |
boolean |
no |
Report activity by UTC hour (default false). Timezone inference requires sufficient sample size, span and depth; a flat pattern may indicate automation. |
detail |
summary | full |
no |
‘summary’ (default) keeps ~35k chars in order, retaining failures and entries involving two tracked addresses; omitted reports the rest. ‘full’ lists every entry up to limit. |
network |
mainnet | testnet | devnet |
no |
Network: ‘mainnet’ (default) | ‘testnet’ | ‘devnet’ |
- Title: Build wallet edges
- Profile:
forensics
- Annotations:
openWorldHint: true, readOnlyHint: true
(Incident investigation) Find possible shared operators when a fund trace reaches fresh wallets. Six live signals are multisig co-signature, shared first funder, one wallet first-funding another, reciprocal value between non-services, shared gas sponsor and co-appearance in a transaction. Co-signature proves a key can spend the wallet through its committee’s address hash; the other signals are behavioral. Intermediaries are measured before linking: services are discarded unless most wallets a sponsor serves share the seeds’ narrow, unlabelled funder (role_split). Edges cite transaction digests, or the address hash for co_signer. Clusters are separately tiered inferences, never proof of ownership.
| Parameter |
Type |
Required |
Description |
addresses |
array of string (1 to 25 items) |
yes |
1–25 seed addresses suspected of shared control. Links among supplied seeds are exactly verified. |
expand |
boolean |
no |
Find unknown siblings too (default true); each candidate’s first funder is verified before admission. |
expand_budget |
integer (0 to 200) |
no |
Sibling candidates to verify while expanding (default 25). Unverified candidates are reported, never silently dropped. |
popularity_limit |
integer (5 to 500) |
no |
Discard funders/sponsors above this counterparty count (default 50). Funder recipients count at >=0.01 SUI or $0.10. Raise only with cause; service ancestry does not link users. |
min_signal_types |
integer (1 to 4) |
no |
Signal types needed to merge a pair (default 1). Set 2 for higher precision, but ordinary alt-wallets may share only one. |
max_cluster_size |
integer (2 to 1000) |
no |
Refuse merges beyond this size (default 100). A runaway cluster is worse than no answer. |
reciprocal_budget |
integer (0 to 100) |
no |
Reciprocal counterparties to check for service popularity before trusting the signal (default 15). |
query_budget |
integer (10 to 600) |
no |
Hard ceiling on GraphQL requests (default 150). Check truncated in the response. |
format |
json | mermaid | graph_json | csv |
no |
Default json. mermaid draws clusters and signal-labelled edges; graph_json gives nodes/edges; csv gives one row per edge. |
network |
mainnet | testnet | devnet |
no |
Network: ‘mainnet’ (default) | ‘testnet’ | ‘devnet’ |
- Title: Check coin restrictions
- Profile:
forensics
- Annotations:
openWorldHint: true, readOnlyHint: true
(Incident investigation) Read issuer freezes and whole-coin pauses from regulated coins’ on-chain deny lists. Give coin_type to list frozen addresses, address to check every regulated coin regardless of holdings, or both for one pair. Address-only checks read many lists. Freezes are issuer decisions, not protocol rules, and the DenyCap holder can reverse them. Off-chain validator freezes are invisible here. Use when a traced address cannot move a token or to check whether an issuer has frozen a counterparty.
| Parameter |
Type |
Required |
Description |
coin_type |
string |
no |
Full coin type (e.g. ‘0xabc::usdc::USDC’). Lists every address frozen for it. |
address |
string |
no |
Address to check against coin_type, or against every coin with a deny list if coin_type is omitted, regardless of holdings. |
max_addresses |
integer (1 to 1000) |
no |
Cap on denied addresses returned for a coin (default 200). |
network |
mainnet | testnet | devnet |
no |
Network: ‘mainnet’ (default) | ‘testnet’ | ‘devnet’ |
- Title: Classify deposit address
- Profile:
forensics
- Annotations:
openWorldHint: true, readOnlyHint: true
(Incident investigation) Classify exchange deposit behaviour over a chosen window. The heuristic verdict covers only transactions read; window states bounds, coverage and continuation. Historical sweep balances are reconstructed with a separate budget. No outflows means unknown, not clearance. Session verdicts are shared with identification, flows and label lookup without adding trace sinks.
| Parameter |
Type |
Required |
Description |
address |
string |
yes |
Candidate deposit address (0x…). |
from |
string |
no |
Window start: ISO 8601 time (inclusive) or checkpoint (exclusive). |
to |
string |
no |
Window end: ISO 8601 time (inclusive), ‘now’, or checkpoint (exclusive). |
max_transactions |
integer (5 to 5000) |
no |
Newest transactions to read within the window (default 50). |
max_balance_transactions |
integer (50 to 10000) |
no |
Later transactions to undo for historical sweep balances (default 1000). An incomplete reconstruction withholds that check. |
detail |
summary | full |
no |
Summary caps evidence lists with omissions; full returns every scanned sweep, deposit and other outflow. |
network |
mainnet | testnet | devnet |
no |
Network: ‘mainnet’ (default) | ‘testnet’ | ‘devnet’ |
- Title: Delete finding
- Profile:
forensics
- Annotations:
destructiveHint: true, idempotentHint: true, openWorldHint: false, readOnlyHint: false
(Incident investigation) Remove a finding by id, for retracting something that turned out to be wrong. Use list_findings to get ids. Requires SUI_STORE_PATH.
| Parameter |
Type |
Required |
Description |
finding_id |
integer (at least 1) |
yes |
Finding id from list_findings. |
- Title: Export case
- Profile:
forensics
- Annotations:
openWorldHint: false, readOnlyHint: true
(Incident investigation) Render a case’s findings as a Markdown report, ready to paste into a ticket, post-mortem or writeup. Findings are grouped by evidence tier (chain-derived, then indexer-attested, then heuristic) and highest confidence first within each, with an appendix of full addresses. Requires SUI_STORE_PATH.
| Parameter |
Type |
Required |
Description |
case_name |
string |
yes |
Case to render. |
include_appendix |
boolean |
no |
Append the full-address list (default true). |
format |
markdown | mermaid | graph_json | csv |
no |
markdown (default): the report. mermaid: the report plus a fund-flow diagram of transfers between the case’s addresses in the findings’ transactions, including flows with protocols’ shared objects; it reads those transactions from the chain. graph_json: that diagram as {nodes, edges}. csv: one row per finding. |
- Title: Find flow path
- Profile:
forensics
- Annotations:
openWorldHint: true, readOnlyHint: true
(Incident investigation) Find value paths from one address to another. Searches forward from from and backward from to on trace_flow_graph’s engine, heaviest branch first, and returns each path with every hop’s transaction digests and amounts in time order. to may be an account on another chain (EVM, Solana or CAIP-10); a path then ends at a Sui bridge exit whose chain-derived beneficiary is that account. When nothing is found, explored says what was searched, and explored.node_limited names, per side, the nodes the node limit left unexpanded and the share of value they carry. A missing path does not show that none exists: every search is bounded, and value can move off-chain or through a hub.
| Parameter |
Type |
Required |
Description |
from |
string |
yes |
Address the value starts at. |
to |
string |
yes |
Target: a Sui address, an EVM (0x + 40 hex) or Solana (base58) address a bridge exit pays, or a CAIP-10 account. |
max_hops |
integer (1 to 6) |
no |
Longest path to look for, in transfers (default 5, max 6). |
coin_type |
string |
no |
Start by following only this coin. Swaps are still followed. |
window_start |
string |
no |
Only transactions after this: ISO date or checkpoint. Set it to the incident time to skip the source’s older history. |
window_end |
string |
no |
Only transactions before this: ISO date or checkpoint. |
max_nodes |
integer (1 to 100) |
no |
Address nodes to expand on each side (default 30, max 100), the branches carrying the most value first. |
min_share |
number (0 to 1) |
no |
Skip branches below this fraction of each side’s value (default 0.001), except those to a lookalike of a reached address. |
format |
json | mermaid | graph_json | csv |
no |
Output format (default json). mermaid: a fenced flowchart for a markdown viewer. graph_json: {nodes, edges}, plus address_poisoning in trace_flow_graph. csv: one row per edge. |
network |
mainnet | testnet | devnet |
no |
Network: ‘mainnet’ (default) | ‘testnet’ | ‘devnet’ |
- Title: Find funding source
- Profile:
forensics
- Annotations:
openWorldHint: true, readOnlyHint: true
(Incident investigation) Follow a wallet’s first funding transaction and sender, then each funder’s own funding. Stops at labels (see manage_labels), cycles, dead ends, funders paying over 50 addresses at least 0.01 SUI or $0.10 each, or a funder whose payment came after its own first 12 transactions. Service ancestry and an established wallet’s earlier funding do not attribute the payment being traced; dust-only recipients do not count toward the service threshold. Each hop reports funder popularity. dust_skipped lists ignored inflows; sponsored_by lists gas payers even when no funding was found. A wallet can pay gas from an address balance without SUI inflows, and a lookalike operator may appear only as its sponsor.
| Parameter |
Type |
Required |
Description |
address |
string |
yes |
Address to attribute (0x…) |
max_hops |
integer (at most 12, greater than 0) |
no |
Max funding hops to walk back (default 5, max 12) |
measure_fanout |
boolean |
no |
Measure origin fan-out (default true), using get_address_fanout’s default window and matching counts/truncation. |
network |
mainnet | testnet | devnet |
no |
Network: ‘mainnet’ (default) | ‘testnet’ | ‘devnet’ |
- Title: Find funding sources
- Profile:
forensics
- Annotations:
openWorldHint: true, readOnlyHint: true
- Metadata:
anthropic/maxResultSizeChars: 500000
(Incident investigation) Trace funding for many addresses together, cheaper than repeated find_funding_source calls. Walks stop at funders that paid over 50 addresses; shared-funder counts stop at the first funder that is itself a subject. Reports common funders with fan-out and flow shape, co-funding compared with each transaction’s total recipients, direct subject-to-subject funding, and later signed payments between subjects (subject_paid_subject, checked pairwise for up to 20 subjects). It also groups fundings within one minute as possible scripted setup. A common exchange or shared batch need not imply common control. Compare a sample_control_addresses control group before interpreting any rate.
| Parameter |
Type |
Required |
Description |
addresses |
array of string (1 to 100 items) |
yes |
Addresses to attribute (1-100). |
max_hops |
integer (at most 12, greater than 0) |
no |
Max hops per address (default 5, max 12). |
depth |
first_hop | full |
no |
‘first_hop’ reads one funding hop per address; ‘full’ (default) walks to max_hops. |
measure_fanout |
boolean |
no |
Measure fan-out for funders shared by 2+ addresses (default true). |
detail |
summary | full |
no |
‘summary’ (default) keeps origin, first funder/hop and dust counts; results and subject_paid_subject fit ~20k chars, prioritizing all shared-funder, subject-link, co-funding, burst and payment results. ‘full’ lists every chain hop, dust row and list row. |
network |
mainnet | testnet | devnet |
no |
Network: ‘mainnet’ (default) | ‘testnet’ | ‘devnet’ |
- Title: Find shared multisig
- Profile:
forensics
- Annotations:
openWorldHint: true, readOnlyHint: true
(Multisig investigation) Given several addresses you already suspect are related, find any multisig wallet they jointly control, even one that never appeared in your trace. Works by deriving every committee those keys could form and checking which of those addresses exist on chain, so a hit is proof (the address IS the hash of its committee), not a guess. Use it when a trace links wallets and you want to know whether they also share a treasury. Each address must have SENT a transaction, since that is where its public key becomes visible.
| Parameter |
Type |
Required |
Description |
addresses |
array of string (2 to 5 items) |
yes |
2-5 addresses to test. Member order is part of a multisig’s address, so candidates grow factorially and 6 addresses are refused. |
network |
mainnet | testnet | devnet |
no |
Network: ‘mainnet’ (default) | ‘testnet’ | ‘devnet’ |
- Title: Get address fanout
- Profile:
forensics
- Annotations:
openWorldHint: true, readOnlyHint: true
(Incident investigation) Measure how many distinct addresses an address transacts with, in BOTH directions, over its most recent activity. Use this before concluding anything from shared funding: several wallets tracing back to one funder is only meaningful if that funder is narrow. An exchange hot wallet pays tens of thousands of addresses, so common ancestry through it means nothing. Returns recipient_count, sender_count and counterparty_count, plus out_in_ratio and flow_shape. The shape separates cases size cannot, since a custodial exchange and a sybil funder can have near-identical counterparty counts while one runs balanced and the other pays many and is paid by few.
| Parameter |
Type |
Required |
Description |
address |
string |
yes |
Address to measure (0x…) |
max_transactions |
integer (50 to 3000) |
no |
Transactions to scan, newest first (default 1000). More is slower but tighter; check truncated. |
network |
mainnet | testnet | devnet |
no |
Network: ‘mainnet’ (default) | ‘testnet’ | ‘devnet’ |
- Title: Get upgrade history
- Profile:
forensics
- Annotations:
openWorldHint: true, readOnlyHint: true
(Incident investigation) Read upgrade governance across a package lineage: each version’s ID, transaction, time, publisher, signing scheme and UpgradeCap holder then. Schemes include single key, zkLogin, passkey and multisig with threshold and actual signers. Flags cap round trips around upgrades, single-key upgrades of usually multisig-held caps, policy changes, and caps destroyed, wrapped, frozen, shared or sent to unspendable addresses. as_of gives the cap holder and newest version at that moment. It lists non-framework dependency relinks and the dependencies run by the latest and as_of versions; use linked_id with disassemble_module, not the original ID named in bytecode. Older versions stay callable, but this tool does not compare their guards: use analyze_package on any version for ungated-older-version leads.
| Parameter |
Type |
Required |
Description |
package |
string |
yes |
Any version’s package ID (0x…) or an MVR name (@org/app) |
as_of |
string |
no |
ISO 8601 timestamp, ‘now’, or checkpoint number: report the cap holder and newest version at that moment |
round_trip_hours |
number (at most 720, greater than 0) |
no |
A cap that leaves its usual holder and returns within this many hours around an upgrade is flagged (default 24) |
find_redeploys |
boolean |
no |
Find redeployed code in other lineages (default false). Searches up to 250 caps still held by the root publisher and current cap holder each; candidates must share at least half the module names. Compares every version, ignoring addresses, nearest-published first within 120 package reads. Returns module origins, function origins and related lineages. |
detail |
summary | full |
no |
‘summary’ (default) caps function_origins at ~6k chars, prioritizing code that most predates its module; omitted counts excluded groups and functions. ‘full’ lists all groups. Only find_redeploys output is capped. |
network |
mainnet | testnet | devnet |
no |
Network: ‘mainnet’ (default) | ‘testnet’ | ‘devnet’ |
- Title: List findings
- Profile:
forensics
- Annotations:
openWorldHint: false, readOnlyHint: true
(Incident investigation) List recorded findings, or every case with its finding count. Call with no arguments to see what cases exist. Requires SUI_STORE_PATH.
| Parameter |
Type |
Required |
Description |
case_name |
string |
no |
Case to list. Omit to list all cases with their counts instead. |
- Title: Manage address labels
- Profile:
forensics
- Annotations:
destructiveHint: true, idempotentHint: true, openWorldHint: false, readOnlyHint: false
- Metadata:
anthropic/maxResultSizeChars: 500000
Manage chain-qualified address labels for investigation and trace sinks. Actions list, lookup, add, remove, import a batch, or export in importable form. Added/imported labels persist with SUI_STORE_PATH; otherwise they last this session. Remove deletes their stored copy, but cannot remove the read-only SUI_LABELS_FILE or shipped labels. Precedence is local additions > override file > shipped disclosed labels > shipped inferred exchange deposits; export excludes inferred deposits. A label on one chain does not apply on another. List counts all categories/sources and shows local additions first within ~30k characters; omitted reports the rest and detail:‘full’ lists all.
| Parameter |
Type |
Required |
Description |
action |
list | lookup | add | remove | import | export |
yes |
What to do. |
address |
string |
no |
Required for lookup/add/remove. Bare addresses use this call’s network; CAIP-10 IDs label accounts on other chains. |
label |
string |
no |
Human-readable label (required for ‘add’). |
category |
cex | bridge | mixer | malicious | protocol | validator | defi | burn | other |
no |
Required for add. cex, bridge, mixer and burn stop tracing; malicious labels alert but keep following the wallet. |
confidence |
high | medium | low |
no |
Attribution confidence for ‘add’ (default: medium). |
notes |
string |
no |
Optional context for ‘add’. |
labels |
array of object |
no |
Labels to bulk-import (for ‘import’). Malformed entries are skipped and reported rather than failing the batch. |
detail |
summary | full |
no |
For list: summary caps labels; full lists all. For lookup: full also lists all cached deposit-window observations. |
network |
mainnet | testnet | devnet |
no |
Network: ‘mainnet’ (default) | ‘testnet’ | ‘devnet’ |
- Title: Resolve bridge transfer
- Profile:
forensics
- Annotations:
openWorldHint: true, readOnlyHint: true
(Incident investigation) Resolve bridge transfers from a Sui digest using cross-chain message identities rather than guesses from amounts and timing. Covers Wormhole, native Sui Bridge, CCTP, LayerZero V2, Axelar ITS, Allbridge Core and Celer cBridge; beneficiary decoding also covers Wormhole Token Bridge and Relayer, NTT, Mayan MCTP/Swift and LayerZero OFT. Beneficiaries are distinct from redemption contracts and destination OApps. It reports inbound native claims and Wormhole Token Bridge/NTT redemptions with origin identity; also any package’s fulfilment quoting a consumed CCTP domain and nonce or VAA while crediting an address, with a beneficiary only for an exact event-amount match. balance_changes_incomplete means unread balances: fulfilment_inbound is withheld, not a negative inbound finding. carriers names out-of-lineage adapters whose PTB calls emitted bridge events, with their functions and events. Meson is recognized but its destination is absent from Sui data. cross_chain_leads are heuristic events from uncovered packages carrying a chain field and foreign address, never proof of an exit. Sui-derived values and indexer delivery have separate evidence tiers. Optional Wormholescan redemption and LayerZero Scan delivery transactions require destination-chain confirmation before reliance.
| Parameter |
Type |
Required |
Description |
digest |
string |
yes |
Sui transaction digest (Base58) to inspect for a bridge transfer. |
include_destination |
boolean |
no |
Query Wormholescan and LayerZero Scan for the delivery side (default true). Set false to stay strictly on-chain. |
network |
mainnet | testnet | devnet |
no |
Network: ‘mainnet’ (default) | ‘testnet’ | ‘devnet’ |
- Title: Resolve protocol packages
- Profile:
forensics
- Annotations:
openWorldHint: true, readOnlyHint: true
(Incident investigation) Find which package IDs of a protocol are actually emitting events right now, so a query targets something live. Start here before aggregate_events or query_events when you know a protocol by name or hold a package ID of unknown vintage. The bundled protocol registry maps IDs to names for DECODING and is full of historical versions on purpose, so using one as a query target silently returns zero events and looks like the protocol is dead. Note the answer is usually plural: an event carries the ID of the package version that defined it, so a protocol upgraded piecemeal emits from several versions at once, and querying only the newest drops the rest.
| Parameter |
Type |
Required |
Description |
protocol |
string |
no |
Protocol name as it appears in the bundled registry, e.g. ‘Cetus’, ‘Suilend’. |
package_id |
string |
no |
Any package ID in the lineage, of any age. Its whole upgrade history is walked. |
since |
string |
no |
How far back to probe for activity: ISO 8601 timestamp or checkpoint. Defaults to roughly the last day. |
max_versions |
integer (1 to 20) |
no |
Most recent versions to probe (default 8). Older ones are rarely still live. |
network |
mainnet | testnet | devnet |
no |
Network: ‘mainnet’ (default) | ‘testnet’ | ‘devnet’ |
- Title: Sample control addresses
- Profile:
forensics
- Annotations:
openWorldHint: true, readOnlyHint: true
(Incident investigation) Draw a random control group from the same population as a cohort you are testing: other addresses that used the same protocol over the same window. Shared funding, common ancestry and timing overlap all look damning until you measure how often they occur by chance; this is what you compare against. Excludes the cohort automatically, samples randomly rather than by size (top-N would compare against whales, which collide more than ordinary wallets), and accepts a seed so the draw can be reproduced by whoever checks the report.
| Parameter |
Type |
Required |
Description |
module |
string |
no |
Population: addresses that called this package or module, 0x… or 0x…::module. The window selects original or called-version ID across the network cutover. module_scope reports scope; other_version_ids lists versions a post-cutover ID misses. |
event_type |
string |
no |
Population: addresses that emitted this event struct type. Any version’s ID of the defining package works. |
size |
integer (1 to 100) |
no |
Control group size (default 25). Match it to the cohort; an unequal comparison is hard to read. |
exclude |
array of string |
no |
The cohort under test. Excluded from the draw; leaving them in contaminates the comparison. |
from |
string |
no |
Window start: ISO 8601 timestamp or a checkpoint number. |
to |
string |
no |
Window end: ISO 8601 timestamp, ‘now’, or a checkpoint. |
seed |
integer |
no |
Integer seed. Makes the draw reproducible. Record it alongside the result; without it nobody can redraw your control. |
max_events |
integer (50 to 50000) |
no |
Events to scan when building the population (default 5000). |
network |
mainnet | testnet | devnet |
no |
Network: ‘mainnet’ (default) | ‘testnet’ | ‘devnet’ |
- Title: Save finding
- Profile:
forensics
- Annotations:
destructiveHint: false, idempotentHint: false, openWorldHint: false, readOnlyHint: false
(Incident investigation) Record a conclusion against a named case, so an investigation survives the session it happened in. Save findings as you establish them: what you concluded, how it is known (evidence_tier), which addresses and transactions it concerns, and the evidence that supports it. Then use export_case to render the whole case as a report. Requires SUI_STORE_PATH.
| Parameter |
Type |
Required |
Description |
case_name |
string |
yes |
Case this belongs to, e.g. ‘alphalend-sybil-2026-08’. Reused across findings. |
title |
string |
yes |
One-line statement of the finding. |
detail |
string |
no |
Fuller explanation, including caveats. |
confidence |
high | medium | low |
no |
How firmly this is established. Reports sort high confidence first. |
evidence_tier |
chain-derived | indexer-attested | heuristic |
no |
How it is known: ‘chain-derived’ (read from Sui), ‘indexer-attested’ (asserted by a third party) or ‘heuristic’ (inferred from patterns; the default, and the weakest). export_case groups findings by it. |
addresses |
array of string |
no |
Addresses it concerns. A bare address is recorded on this call’s network; use a CAIP-10 id (‘eip155:1:0x…’) for another chain. |
digests |
array of string |
no |
Sui transaction digests the finding rests on. Each is checked to be a real digest before saving. |
evidence |
array of string |
no |
What establishes it, so it can be checked: tool calls, counts, digests, sample sizes. |
network |
mainnet | testnet | devnet |
no |
Network: ‘mainnet’ (default) | ‘testnet’ | ‘devnet’ |
- Title: Screen address
- Profile:
forensics
- Annotations:
openWorldHint: true, readOnlyHint: true
- Metadata:
anthropic/maxResultSizeChars: 500000
(Incident investigation) Screen direct and indirect exposure to labelled malicious, sanctioned, exchange, bridge and mixer accounts, by default two hops in both directions. Exposures include paths, per-leg digests and amounts, and label provenance. Screens chain-derived bridge beneficiaries against labels and OFAC’s SDN list for CCTP, Sui Bridge, Wormhole, Mayan, LayerZero OFT, Axelar, Allbridge and Celer. Each exit counts once under its carrying protocol, with settlement bridges and other exits listed separately. Coverage names label sources and history read, and notes that OFAC lists no Sui addresses. windows[].incomplete_transactions names unread balances; their paths are withheld and affected bridge sent amounts are null. Reads up to 300 recent subject transactions each way by default, typically costing 15–60 requests. A non-Sui CAIP-10 account receives only direct label and sanctions lookups.
| Parameter |
Type |
Required |
Description |
address |
string |
yes |
Sui address (0x…) or CAIP-10 account (e.g. ‘eip155:1:0x…’). |
hops |
integer (1 to 3) |
no |
How far to follow counterparties (default 2). |
direction |
both | in | out |
no |
‘out’ = where this address’s funds went, ‘in’ = where they came from (default both). |
max_transactions |
integer (10 to 300) |
no |
Recent subject transactions per direction (default/max 300); expanded counterparties get 50. |
max_expand |
integer (1 to 20) |
no |
Counterparties expanded per hop, highest value first (default 8). |
network |
mainnet | testnet | devnet |
no |
Network: ‘mainnet’ (default) | ‘testnet’ | ‘devnet’ |
- Title: Summarize address flows
- Profile:
forensics
- Annotations:
openWorldHint: true, readOnlyHint: true
- Metadata:
anthropic/maxResultSizeChars: 500000
(Incident investigation) Summarize an address’s coin and object inflows, outflows, counterparties, gas sponsorship and bridge exits over a window. Coin USD uses hourly historical quotes; check usd_basis for coarsening and coverage. Scans newest first: check coverage.complete and follow coverage.continue_with when capped. address_poisoning and cross_chain_leads cover only scanned activity, not clearance.
| Parameter |
Type |
Required |
Description |
address |
string |
yes |
Address to summarise (0x… or a SuiNS name). |
from |
string |
no |
Window start as ISO 8601 time or checkpoint. Omit to scan the whole history, subject to the scan budget. |
to |
string |
no |
Window end: ISO 8601 time, ‘now’, or a checkpoint number. |
coin_type |
string |
no |
Only this coin in the totals and counterparties (e.g. 0x2::sui::SUI). Bridge exits and gas are always reported in full. |
max_transactions |
integer (50 to 5000) |
no |
Transactions to scan, newest first (default 1000). |
top |
integer (1 to 50) |
no |
Recipients to list, and counterparties to identify in each direction (default 10). |
detail |
summary | full |
no |
‘summary’ (default) keeps ~20k chars of counterparties, coins and unattributed rows by value, retaining all labelled, non-wallet and lookalike addresses. Totals/counts cover all rows; omitted reports the rest. ‘full’: every row. |
network |
mainnet | testnet | devnet |
no |
Network: ‘mainnet’ (default) | ‘testnet’ | ‘devnet’ |
- Title: Summarize incident losses
- Profile:
forensics
- Annotations:
openWorldHint: true, readOnlyHint: true
- Metadata:
anthropic/maxResultSizeChars: 500000
(Incident investigation) Total an attacker’s take across exploit digests or a sender’s window, grouped by drained pool or vault. Reports attacker net per coin and pool reserve changes, with USD. Reserves use decoded events or, if none yields amounts, drained-object Balance<T> holdings at input/output versions. Address-only onward coin transfers are transfers_out, not take. Unpriced legs make USD totals partial, not a lower bound. Summary keeps the largest rows fitting about 40k characters. Oversized full views page groups through omitted.next_call, without requiring a store; stored-result pages are optional extras. No API key; transaction reads use archive fallback.
| Parameter |
Type |
Required |
Description |
digests |
array of string (1 to 1000 items) |
no |
Exploit transaction digests (Base58). Duplicates are collapsed. |
sender |
string |
no |
Read every transaction this address sent inside the window instead of a digest list. |
start |
number | string |
no |
Window start with sender: a checkpoint number or ISO 8601 time. Inclusive. |
end |
number | string |
no |
Window end with sender: a checkpoint number or ISO 8601 time. Inclusive. |
max_transactions |
integer (1 to 1000) |
no |
Cap on transactions read in sender mode (default 1000, the most). Hitting it is reported. |
attacker |
string |
no |
Gain address; defaults to sender or each transaction’s sender. If every successful sender only paid gas, uses the largest priced gainer above the gas-only threshold across those transactions, reported in attacker_defaulted_from_sender. An unpriced gain by another non-sender blocks that default. Pass attacker to override. |
price_at |
number | string |
no |
Fixed-time valuation for every coin and object (Unix seconds or ISO 8601). Default: hourly coin quotes; objects at their transaction times. Check usd_basis for coarsening. |
max_groups |
integer (at least 1) |
no |
List only the largest N groups; the totals still cover all of them and the omission is reported. |
group_offset |
integer (at least 0) |
no |
First group to return with detail: ‘full’ when an oversized view is paged. |
coverage_offset |
integer (at least 0) |
no |
First historical pricing coverage row for an oversized detail: ‘full’ view; follow omitted.next_call to page. |
detail |
summary | full |
no |
‘summary’ (default): largest rows fitting about 40k characters. ‘full’: consecutive group and historical pricing coverage pages under 500k characters; follow omitted.next_call to read the rest. Totals always cover every group. |
network |
mainnet | testnet | devnet |
no |
Network: ‘mainnet’ (default) | ‘testnet’ | ‘devnet’ |
- Title: Trace flow graph
- Profile:
forensics
- Annotations:
openWorldHint: true, readOnlyHint: true
- Metadata:
anthropic/maxResultSizeChars: 500000
(Incident investigation) Trace every branch of funds forward or backward from a transaction or a time-bounded address, rather than the single branch trace_funds follows. Each recipient gets a proportional share of traced value. The walk follows the coin through swaps, self-credits and value released from objects; it stops at sinks, hubs, protocols, bridge exits with decoded beneficiaries, and transactions signed by someone other than the sender. An address’s swap counts once: later spending carries its proceeds forward, earlier inflows carry its input backward. The rest ends as unspent or source, or budget if the move limit stopped the search. coverage.partial marks a start-address move limit; coverage.truncated marks other limits. Terminals report where each share ended. address_poisoning covers only reached addresses: empty pairs clear nothing beyond them, lookalike branches are never pruned, and every format’s summary names the pairs. Consumed or retained terminals may carry heuristic cross_chain_leads from messages no bridge reader covers. Formats include Mermaid, graph JSON and CSV. A 40-node graph typically costs 100–300 requests.
| Parameter |
Type |
Required |
Description |
digest |
string |
no |
Starting transaction (Base58). Give this or address. |
address |
string |
no |
Start from this address’s payouts after from (forward), or receipts before to (backward), instead of a digest. |
direction |
forward | backward |
no |
forward (default) follows where the value went; backward follows who paid it in. |
coin_type |
string |
no |
Starting coin filter; omitted follows every coin moved. Value is still followed across swaps. |
from |
string |
no |
Window start: ISO date or checkpoint. With address and forward, where the walk starts. Bounds every search. |
to |
string |
no |
Window end: ISO date or checkpoint. With address and backward, where the walk starts. Bounds every search. |
max_depth |
integer (1 to 8) |
no |
Hops to follow from the start (default 4, max 8). |
max_nodes |
integer (1 to 150) |
no |
Address nodes to expand (default 40, max 150). The branch carrying the most value is expanded next, at any depth. |
min_share |
number (0 to 1) |
no |
Prune below this fraction of traced value (default 0.01 = 1%); never prune lookalikes. coverage.pruned counts them. |
min_usd |
number (at least 0) |
no |
Prune below this USD value at transaction time, except lookalikes. Unpriced branches use min_share. |
format |
json | mermaid | graph_json | csv |
no |
Output format (default json). mermaid: a fenced flowchart for a markdown viewer. graph_json: {nodes, edges}, plus address_poisoning in trace_flow_graph. csv: one row per edge. |
detail |
summary | full |
no |
‘summary’ (default): ~20k chars, largest shares first; keeps all bridge exits, sinks, hubs, protocols, consumed and retained nodes, labelled addresses, lookalikes and their incoming edges. Terminals, coverage and shares cover the whole graph; omitted reports missing rows. ‘full’: every node and edge. |
network |
mainnet | testnet | devnet |
no |
Network: ‘mainnet’ (default) | ‘testnet’ | ‘devnet’ |
- Title: Trace funds
- Profile:
forensics
- Annotations:
openWorldHint: true, readOnlyHint: true
(Incident investigation) Follow a fund-flow path from a transaction. Forward traces a recipient’s next move of the tracked coin; backward traces its payer’s most recent earlier inflow. It follows value through swaps, self-crediting exploits or withdrawals, and objects. Stops at labelled exchanges, bridges, mixers or burns (manage_labels), bridge exits and high-fanout hubs; forward hub stops require 100+ distinct incoming senders, so smaller pass-through funders are followed. Malicious labels do not stop the trace. stop_reason always explains the end. Returns decoded actions, a readable summary and per-hop USD at block time with its source. Calls run sequentially for up to 10 hops; use trace_flow_graph to follow every branch.
| Parameter |
Type |
Required |
Description |
digest |
string |
yes |
Starting transaction digest (Base58) |
direction |
forward | backward |
yes |
Direction to trace: ‘forward’ follows recipients, ‘backward’ follows sender |
hops |
integer (1 to 10) |
no |
Max hops to follow (default 3, max 10) |
coin_type |
string |
no |
Starting coin and displayed balance-change filter; short/padded types match. Swaps still follow value. Omit to show all changes and start with the largest flow. |
format |
json | mermaid | graph_json | csv |
no |
Default json. Mermaid shows the path, dashed unfollowed branches, bridge exits and stop reason; graph_json gives nodes/edges; CSV lists every followed or unfollowed transfer. Prose comes first except in graph_json. |
network |
mainnet | testnet | devnet |
no |
Network: ‘mainnet’ (default) | ‘testnet’ | ‘devnet’ |
- Title: Trace object history
- Profile:
forensics
- Annotations:
openWorldHint: true, readOnlyHint: true
(Incident investigation) Trace an object’s versions, producing transactions, times and ownership transitions, including transfers, sharing, freezing and party transfers. Use this for a pool, vault or capability’s creator and past holders. Deleted or wrapped objects have current:null and an end transaction. Party ownership names its single owner; kiosk ownership and kiosk_cap_holder describe today’s custody only, never a historical controller. Beyond the shown page, owner_change_count is always a lower bound: checkpoint search can miss an ownership round trip within a probed span. owner_change_note and more_versions_note explain the limit; owner_change_unpinned lists budget-stopped checkpoint ranges and their endpoint owners, each containing an unpinned change. Versions default to oldest first from the earliest retained version; newest starts at the current version and pages back. Pass next_cursor as cursor with the same order, or follow next_call. Changes compare each listed version to its predecessor regardless of page order.
| Parameter |
Type |
Required |
Description |
object_id |
string |
yes |
Object ID (0x…) |
limit |
integer (at most 50, greater than 0) |
no |
Versions per page (default 25). Newest-first pages and pages after a cursor list at most 49. |
order |
oldest | newest |
no |
‘oldest’ (default) pages forward from the first retained version; ‘newest’ pages back from the current version. |
cursor |
string |
no |
next_cursor from the previous page. Continues in the same direction; pass the same order. |
network |
mainnet | testnet | devnet |
no |
Network: ‘mainnet’ (default) | ‘testnet’ | ‘devnet’ |