Built by us

PayGuard: OFAC sanctions check for crypto addresses

Before your agent or app sends money, check whether the receiving address is on the US Treasury OFAC SDN list. One call, no API key: pay per call in USDC on Base, Polygon, Arbitrum One or Solana over x402, use prepaid credits, or use the free preview and MCP server.

Disclosure: these tools are built and operated by the youraitools.co team, and their payments go to our own wallet. They are listed here separately and are not part of the independent listings or rankings.

PayGuard is built by the youraitools.co team. It is not an independent listing.

What it does

  • Matches an address against every digital currency address published in the OFAC SDN list (official SDN.XML from sanctionslistservice.ofac.treas.gov). Our /v1/list check on 2026-10-23 showed 1,050 addresses across 106 SDN entries, list date 2026-10-21.
  • Returns sanctioned true or false. The paid tier adds the matching SDN entity, its sanctions programs, the list date, the listed currency and a checksum check.
  • Handles EVM, BTC, TRX, SOL, LTC, XMR and more. Matching is exact: EVM 0x and bech32 / cashaddr addresses are case-insensitive, base58 formats are case-sensitive.
  • Every response carries the list date, so you can see how fresh the data is. Invalid input gets HTTP 400 before any payment is asked for.

Try it free

The preview tier is free and needs no wallet. Paste an address:

Calls the free preview route https://api.youraitools.co/payguard/v1/preview from your browser (10 checks a minute per IP). Examples: ·

Or from a terminal:

# Lazarus Group address from the SDN list -> "sanctioned": true
curl -s "https://api.youraitools.co/payguard/v1/preview?address=0x098B716B8Aaf21512996dC57EB0615e2383E2f96"
# USDC contract on Base -> "sanctioned": false
curl -s "https://api.youraitools.co/payguard/v1/preview?address=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"

The paid call and its 402 response

Call the paid route without paying and you get HTTP 402 with the payment terms in a PAYMENT-REQUIRED header. Any x402 client pays and retries automatically.

curl -i "https://api.youraitools.co/payguard/v1/address?address=0x098B716B8Aaf21512996dC57EB0615e2383E2f96"

What our unpaid probe got back on 2026-10-23 (header decoded, trimmed with …):

HTTP/2 402
payment-required: <base64 JSON, decoded below>

{
  "x402Version": 2,
  "error": "Payment required",
  "resource": { "url": "https://api.youraitools.co/payguard/v1/address", ... },
  "accepts": [
    { "scheme": "exact", "network": "eip155:8453",
      "amount": "1000",
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "payTo": "0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F",
      "maxTimeoutSeconds": 120,
      "extra": { "name": "USD Coin", "version": "2" } },
    { "scheme": "exact", "network": "eip155:137", "amount": "1000", ... },
    { "scheme": "exact", "network": "eip155:42161", "amount": "1000", ... },
    { "scheme": "exact", "network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
      "amount": "1000",
      "payTo": "FH73WbbUe2UyNzfy72MJs5nT3NxyDf9GrqE7kzjL2Jte", ... }
  ]
}

Install as an MCP server

The hosted MCP server at https://api.youraitools.co/payguard/mcp exposes screen_address at the free preview tier. The npm package @agentgate-builder/payguard (MIT) runs a local stdio server with the list bundled, exposing screen_address and screen_addresses. It needs Node.js 18 or later and gives preview results by default, and full paid results only if you set a PAYGUARD_X402_PRIVATE_KEY of your own (it then pays $0.001 per address).

Claude Desktop

Add to claude_desktop_config.json. Remote (via mcp-remote):

{
  "mcpServers": {
    "payguard": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://api.youraitools.co/payguard/mcp"]
    }
  }
}

Or local:

{
  "mcpServers": {
    "payguard": {
      "command": "npx",
      "args": ["-y", "-p", "@agentgate-builder/payguard", "payguard-mcp"]
    }
  }
}

Claude Code

# remote (hosted, preview tier)
claude mcp add --transport http payguard https://api.youraitools.co/payguard/mcp

# or local stdio server (bundled list snapshot, runs offline)
claude mcp add payguard -- npx -y -p @agentgate-builder/payguard payguard-mcp

Cursor

Add to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global). Remote:

{
  "mcpServers": {
    "payguard": {
      "url": "https://api.youraitools.co/payguard/mcp"
    }
  }
}

Or local:

{
  "mcpServers": {
    "payguard": {
      "command": "npx",
      "args": ["-y", "-p", "@agentgate-builder/payguard", "payguard-mcp"]
    }
  }
}

These configs match the MIT agentgate-examples repo (folder mcp/). We ran the local server (npm 0.2.0) on 2026-10-23: tools/list returned both tools, and the Lazarus Group address came back SANCTIONED.

Pricing

RoutePriceReturns
GET /v1/address?address=<addr> (or POST {"address"})$0.001 USDCsanctioned, match count, matches (SDN entity, type, uid, programs, list date, listed currency), chain guess and checksum check, list date
POST /v1/batch with {"addresses": [...]} (1 to 50)$0.01 USDC per batchcount, sanctioned_count, any_sanctioned, results[]
GET or POST /v1/preview?address=<addr>Free, 10/min per IPsanctioned true/false, match count, chain guess (no entity, programs or checksum)
POST /mcp (Streamable HTTP, tool screen_address)Free, preview tierpreview-tier result as text
/v1/list, /openapi.json, /.well-known/x402, /healthFreelist date and counts, API specs

Checked via our 402 probe on 2026-10-23: /v1/address asks for 1000 (0.001 USDC) and /v1/batch for 10000 (0.01 USDC), x402 v2, scheme exact, on Base (eip155:8453), Polygon, Arbitrum One and Solana. payTo 0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F on the EVM networks and FH73WbbUe2UyNzfy72MJs5nT3NxyDf9GrqE7kzjL2Jte on Solana (our own wallets). x402 v1 terms (Base only) are also offered. No signup or API key. Prepaid credits work too.

API and links

Limits and compliance disclaimer

Informational screening, not legal advice. PayGuard is not a compliance program and doesn't replace one. Talk to a qualified professional about your own obligations.

  • Only addresses OFAC publishes are matched. A clear result does not mean the address or its owner is unsanctioned or low-risk: sanctions also cover people and property OFAC doesn't list by address, and funds can be one hop away.
  • No EU, UK or UN lists, and no on-chain exposure analysis.
  • The local npm server uses the list snapshot bundled with its release. Check list_updated_at in every response.
  • Per the service's published policy, screening is an in-memory lookup and inputs are not stored or logged.

More from us: all our tools · CounterpartyCheck for a wider pre-payment check · x402-enable your own API