# Madhouse Wallet EVM Address Risk Scanner

> Madhouse Wallet EVM Address Risk Scanner is a paid API for AI agents from scan.madhousewallet.com, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-11).

Scans an EVM wallet address or ENS name for on-chain risk signals and returns a toxic score, risk level, and flagged risk categories for off-ramp compliance decisions.

## Facts

- Endpoint: GET https://scan.madhousewallet.com/api/public/scan?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/scan-madhousewallet-com-dec50a92
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_NO2usG0wfoqqt0w7293WY

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability scan-madhousewallet-com-dec50a92
```

Example prompt: Before I process this withdrawal, can you run a Web3 Antivirus risk scan on the wallet 0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045 and tell me its toxic score, risk level, and whether it should be flagged?

## When to prefer this

Use this endpoint when you need on-chain wallet risk assessment specifically for EVM-compatible addresses and ENS names, especially for off-ramp compliance where any non-zero toxic score must trigger a block or escalation. Prefer this over generic sanctions screening (like OpenSanctions) when the subject is a crypto wallet address rather than a named person or entity, and when you need Web3-specific signals like mixer usage, rug pull involvement, phishing, or scam transaction initiation.

## Known failure modes

- Invalid or malformed address returns an error — address must be 0x-prefixed checksummed EVM address or valid ENS name
- Unknown or brand-new address with no on-chain history may return addressExists: false with a zero toxic score
- API may return raw integer scores 0–100 for confirmed bad actors instead of normalized 0–1 — caller must normalize
- Payment failure or insufficient USDC balance results in x402 payment required error
- ENS resolution failure if ENS name is unregistered or resolution service is unavailable

## How this service works

Scan any EVM wallet address or ENS name for on-chain risk signals using Web3 Antivirus. Returns a toxic score, risk level, and the specific risk categories that triggered a flag. Designed for off-ramp compliance: use shouldFlag to block or escalate — any non-zero toxic score means the wallet has been flagged for at least one risk category such as sanctions, scams, mixers, or phishing.

## Output

Returns a normalized toxic score (0–1), a risk level enum (PASS/LOW/MIDDLE/CRITICAL), a boolean shouldFlag indicating whether the wallet should be blocked, a list of flagged risk categories (e.g. known_scammer, sanction_address, mixer, rug_pull), whether the address is a smart contract, whether it has on-chain history, and the resolved ENS name if available.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {
   "address": "0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045"
  }
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "address"
     ],
     "properties": {
      "address": {
       "type": "string",
       "description": "EVM wallet address (0x-prefixed, checksummed) or ENS name to scan."
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "required": [
      "address",
      "toxicScore",
      "riskLevel",
      "shouldFlag",
      "flaggedMetrics"
     ],
     "properties": {
      "ens": {
       "type": [
        "string",
        "null"
       ],
       "description": "Resolved ENS name if the address has one, otherwise null."
      },
      "address": {
       "type": "string",
       "description": "The queried wallet address (checksummed or ENS-resolved)."
      },
      "riskLevel": {
       "enum": [
        "PASS",
        "LOW",
        "MIDDLE",
        "CRITICAL"
       ],
       "type": "string",
       "description": "PASS = score 0; LOW = 0-0.40; MIDDLE = 0.41-0.80; CRITICAL >= 0.81."
      },
      "isContract": {
       "type": "boolean",
       "description": "True if the address is a smart contract, not an EOA."
      },
      "shouldFlag": {
       "type": "boolean",
       "description": "True if toxicScore > 0. Off-ramp compliance rule: only exact score 0 passes; any non-zero score must be flagged."
      },
      "toxicScore": {
       "type": "number",
       "description": "Normalized risk score from 0 (clean) to 1 (critical). NOTE: the API may return scores as integers 0-100 for confirmed bad actors; always normalize with score > 1 ? score / 100 : score."
      },
      "addressExists": {
       "type": "boolean",
       "description": "True if the address has any on-chain transaction history."
      },
      "flaggedMetrics": {
       "type": "array",
       "items": {
        "type": "object",
        "properties": {
         "name": {
          "type": "string",
          "description": "Ri
… (truncated)
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ens": "vitalik.eth",
  "address": "0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045",
  "riskLevel": "LOW",
  "isContract": false,
  "shouldFlag": true,
  "toxicScore": 0.04,
  "addressExists": true,
  "flaggedMetrics": [
   {
    "name": "non_kyc_transfers",
    "risk": 0.03,
    "type": "volume",
    "txsCount": 344,
    "description": "Transacted with non-KYC exchanges",
    "incomingMoneyUSD": 15722.47,
    "outgoingMoneyUSD": 2484.15
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/scan-madhousewallet-com-dec50a92/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from scan.madhousewallet.com](https://www.zero.xyz/host/scan.madhousewallet.com/llms.txt)