anomaly-mcp

Purpose

anomaly-mcp (Anomaly Tracker MCP) is a multi-domain sequence anomaly detection MCP server for AI agents, used to detect anomalous event patterns in blockchain markets, real-time airspace, and GitHub repositories. Its detection method is based on sequence mining technology originating from NASA (SequenceMiner), and its output is not only numerical values, but also includes human-readable story labels (story) and anomaly scores.

Main capabilities

This MCP server provides AI agents with access to the ForgeMesh Anomaly Tracker API through 16 tools, covering the domains of blockchain, aviation, GitHub, and real-time market monitoring. It uses a thin-client architecture: Agent/MCP client → this MCP server → ForgeMesh Anomaly Tracker API. The hosted API address is https://anomaly.forgemesh.io。

Blockchain tools

• anomaly_scan: Scans sequence anomalies across all monitored addresses in the blockchain. Parameters chain (ethereum, base, or arbitrum, default ethereum), window (1h, 4h, 24h, or 168h, default 24h). Returns sequence_score (0-100), story (human label), novelty, peak_window, possible_failure_modes.
• token_scan: Performs a best-effort anomaly scan of a single token's recent transfer patterns. Paid output includes source status and coverage notes so that agents can distinguish between a "quiet token" and a source coverage issue. Parameter token (required, contract address 0x... or symbol: usdt, usdc, weth, wbtc, link, uni, aave, steth, pepe, dai, cbeth, arb).
• whale_alerts: Recent whale movements from 12+ monitored addresses: Binance, Coinbase, Kraken, OKX, Bybit, major cross-chain bridges, Tether, Circle. Parameter hours (1-168, default 4).
• address_scan: Scans any wallet address for anomalous transaction patterns. Parameters address (required, 0x...), chain (ethereum, base, or arbitrum), window (1h, 4h, 24h, or 168h).
• nft_scan: Performs a best-effort anomaly scan on an NFT collection—sweep accumulation, wash trading, mint spikes. Paid output includes source status and coverage notes. Parameter token (required, ERC-721/ERC-1155 contract address).
• defi_scan: Performs anomaly scanning on DeFi protocols—abnormal fund flows in Uniswap, Aave, Curve, Compound. Parameter protocol (required, protocol name or 0x address).

Aviation and creator tools

• squawk_alerts: Performs a best-effort real-time scan of aircraft worldwide transmitting squawk codes 7700 (emergency), 7600 (radio failure), or 7500 (hijacking). Paid output includes source status, monitoring scope, and coverage notes.
• flight_scan: Performs sequence anomaly analysis on a specified airspace region. Parameter region (north_atlantic, europe, north_america, asia_pacific, middle_east, africa, or global).
• trending_signal: Anomalous GitHub repository star growth rate—an early signal before mainstream discovery. Parameter days (3, 7, 14, or 30, default 7).
• repo_scan: Deep anomaly scan of a single repository—star growth rate, fork ratio, overnight burst signals. Parameter repo (required, owner/repo format).
• github_watch: Monitors anomalous development patterns in a repository's activity stream—commit bursts, force pushes, issue floods, merge rushes, bot takeovers.
• claude_feature_watch: Monitors recently merged features in Anthropic/Claude repositories. Scans anthropic-sdk-python, anthropic-sdk-typescript, claude-code, courses, and anthropic-cookbook. Parameter days (1-30, default 7).

Real-time tools

• mempool_anomaly: Real-time mempool anomaly scores for gas spikes, MEV signals, pending whale swaps, contract deployment bursts, and priority fee wars. Parameter chain (ethereum or base, default ethereum).
• depeg_monitor: Real-time stablecoin depeg detector for micro-deviations, stablecoin spreads, and volume surges in USDC, USDT, and DAI.

Symbol alphabet

The system uses a symbol alphabet to encode event sequences:

• Finance: WHALE_BUY, WHALE_SELL, CEX_INFLOW, CEX_OUTFLOW, BRIDGE_IN, BRIDGE_OUT, DEX_SWAP, DEX_LIQUIDITY_ADD, DEX_LIQUIDITY_REMOVE, STABLECOIN_MINT, STABLECOIN_REDEEM, STABLECOIN_BURN, TOKEN_MINT, TOKEN_BURN, FUNDING_SPIKE, LIQUIDATION
• NFT: NFT_MINT, NFT_BURN, NFT_SALE, NFT_SWEEP, NFT_WASH_TRADE
• Aviation: ENROUTE, SQUAWK_7700, SQUAWK_7600, SQUAWK_7500, RAPID_DESCENT, RAPID_CLIMB, HIGH_SPEED, NEAR_STALL
• Creator: VIRAL_REPO, HOT_REPO, EMERGING_REPO, STEADY_REPO, QUIET_REPO, FORK_SURGE, BOOKMARK_ONLY, ISSUE_FLOOD, OVERNIGHT_STAR, RAPID_GROWTH
• GitHub Watch: COMMIT_PUSH, COMMIT_BURST, FORCE_PUSH, ISSUE_OPEN, ISSUE_CLOSE, ISSUE_COMMENT, ISSUE_FLOOD, PR_OPEN, PR_MERGE, PR_CLOSE, PR_REVIEW, MERGE_RUSH, BRANCH_CREATE, BRANCH_DELETE, TAG_CREATE, RELEASE_PUBLISH, FORK_EVENT, STAR_EVENT, BOT_DOMINATED, SOLO_OPERATOR

Usage

Paid tools use the x402 protocol. Agents pay per call in USDC on Base mainnet, with no API key required. By default, paid endpoints return x402 challenge metadata (pricing, network, wallet) without settling. To complete settlement, configure a wallet private key in the agent's x402 client.

Related links:

• ForgeMesh:https://forgemesh.io
• npm：https://www.npmjs.com/package/@forgemeshlabs/anomaly-mcp
• GitHub：https://github.com/forgemeshlabs/anomaly-mcp

Use cases

Suitable for scenarios where AI agents need to connect to multi-domain event stream anomaly detection, such as monitoring anomalous blockchain market transactions and whale movements, stablecoin depegs, mempool anomalies, aviation emergency transponder signals, and anomalous GitHub repository growth or development behavior.

Limitations

The materials do not provide explanations regarding accuracy, latency, free quota, specific pricing figures, supported MCP client lists, or self-hosted deployment steps; some tools are "best-effort" scans, and paid outputs include source status and coverage notes, which should be used to judge the credibility of results.