Skip to content

XRPL Token Guard

by Riehnbean · remote · no sign-in to list tools · v0.1.0 · published by GitHub user Riehnbean

Read-only XRP Ledger token-risk, issuer-authenticity and wallet-security checks.

Changes · 3
CompareRegistry entry

3 tools: 3 change things.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http xrpl-token-guard https://cocoeatsai.com/area4/guard/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

3 tools

Changes things 3Claude Code: ask
  • check_token_safetyLive safety check of an XRP Ledger token (issued currency).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Live safety check of an XRP Ledger token (issued currency). Detects fake look-alikes of famous tokens (e.g. a fake RLUSD), issuers that can still mint, freeze or claw back, global freezes, transfer fees, unverified domains, whale concentration, thin AMM liquidity and brand-new issuers. Returns a verdict (High risk / Caution / No red flags found / Not enough data), the reasons behind it with the exact ledger facts, and a one-sentence spoken summary.

    Annotations the server declares

    • title: Check XRPL token safety
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • check_wallet_securityChecks whether anyone besides the owner can sign for an XRPL wallet: an unexpected regular key or multisig signer list (the classic drainer setup), and flags changes made in the la…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Checks whether anyone besides the owner can sign for an XRPL wallet: an unexpected regular key or multisig signer list (the classic drainer setup), and flags changes made in the last 7 days as urgent. Read-only.

    Annotations the server declares

    • title: Check XRPL wallet security
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • is_it_the_real_tokenAnswers "is this the real RLUSD / USDC / SOLO?" using the verified official issuers (RLUSD: rMxCKbEDwqr76QuheSUMdEGf4B9xJ8m5De; USDC: rGm7WCVp9gb4jZHWTEtGUr4dd74z2XuWhE; SOLO: rsoL…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Answers "is this the real RLUSD / USDC / SOLO?" using the verified official issuers (RLUSD: rMxCKbEDwqr76QuheSUMdEGf4B9xJ8m5De; USDC: rGm7WCVp9gb4jZHWTEtGUr4dd74z2XuWhE; SOLO: rsoLo2S1kiGeCcn6hCUXVrCpGMWLrRrLZz). Give the ticker alone to learn the official issuer, or ticker + issuer to confirm or expose an imitation. Instant, no ledger call.

    Annotations the server declares

    • title: Verify an official XRPL token
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http xrpl-token-guard https://cocoeatsai.com/area4/guard/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [],
    "ask": [
      "mcp__xrpl-token-guard__check_token_safety",
      "mcp__xrpl-token-guard__is_it_the_real_token",
      "mcp__xrpl-token-guard__check_wallet_security"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as xrpl-token-guard. Review it before you use it.