Appearance

Alerts ​

Reference for the 15 CryptoComply MCP tools in the Alerts family.

Tools in this group ​

alert_assign ​

Read-only: no.

Hand an alert that isn't closed to an active member, replacing whoever holds it; the person replaced isn't told. The new holder is notified with your rationale. The status doesn't change.

To take an alert yourself, use alert_claim: it needs no permission to direct others' work and moves an open alert to Under Review.

Previews first.

Parameters

  • organization_id (int, required) — Organization scope.
  • alert_id (int, required) — Alert id (from alert_list).
  • assigned_to_user_id (int, required) — User id (from member_list). The member to hand it to.
  • rationale (str | None, optional) — Why it is being handed to this member; delivered to them. Required, at least 10 characters.
  • confirm_token (str | None, optional) — From this tool's preview; omit to get one.

alert_audit_log ​

Read-only: yes.

List audit rows (create / update / delete / access) for an alert, most recent first. Each row carries the actor, its field_changes as display text and the analyst's rationale when one was captured. Use when the user asks 'who touched this alert, and why did they close it that way?' — the disposition on the alert says what was decided; this says who decided it and what they wrote down.

Name an entry by its actor_name, action_label and field_changes.

Parameters

  • organization_id (int, required) — Organization scope.
  • alert_id (int, required) — Alert id (from alert_list).
  • sort_by (Literal, optional) — '-' prefix = descending.
  • limit (int, optional) — Max results.
  • offset (int, optional) — Results to skip.

alert_bulk_assign ​

Read-only: no.

Hand several alerts that aren't closed to one active member, replacing whoever holds each; the people replaced aren't told. The new holder is notified with your rationale, which applies to every alert. Statuses don't change. To take alerts yourself, use alert_bulk_claim.

Previews first. Each id is processed individually; a row that fails does not stop the others. Answers with the per-row bulk envelope.

Parameters

  • organization_id (int, required) — Organization scope.
  • alert_ids (list, required) — Alert ids to assign.
  • assigned_to_user_id (int, required) — User id (from member_list). The member to hand it to.
  • rationale (str | None, optional) — Why it is being handed to this member; delivered to them. Required, at least 10 characters.
  • confirm_token (str | None, optional) — From this tool's preview; omit to get one.

alert_bulk_claim ​

Read-only: no.

Take several alerts that aren't closed and are unassigned or already yours; open ones move to Under Review. Nobody is notified. Needs only access to alerts. An alert someone else holds is that row's failure and the rest are still claimed.

Previews first. Each id is processed individually; a row that fails does not stop the others. Answers with the per-row bulk envelope.

Parameters

  • organization_id (int, required) — Organization scope.
  • alert_ids (list, required) — Alert ids to claim.
  • confirm_token (str | None, optional) — From this tool's preview; omit to get one.

alert_bulk_close ​

Read-only: no.

Close several alerts with the same disposition and rationale, e.g. a batch of false positives. Each close notifies everyone who can see alerts, and closed alerts can't be reopened; only a disposition can change later.

Only alerts you hold close, with every hit or finding on them resolved. Take unassigned ones first with alert_bulk_claim, then retry.

Previews first. Each id is processed individually; a row that fails does not stop the others. Answers with the per-row bulk envelope. The preview says how many will close and why the rest won't.

Parameters

  • organization_id (int, required) — Organization scope.
  • alert_ids (list, required) — Alert ids to close.
  • result (Literal, required) — Investigation disposition applied to every alert in the batch.
  • closing_rationale (str, required) — Closing rationale applied to every alert in the batch.
  • confirm_token (str | None, optional) — From this tool's preview; omit to get one.

alert_bulk_unassign ​

Read-only: no.

Return several alerts to the unassigned pool. Needs permission to unassign work; the people who held them aren't notified. rationale applies to every alert in the batch. An alert nobody holds is that row's failure and the rest are still cleared.

Previews first. Each id is processed individually; a row that fails does not stop the others. Answers with the per-row bulk envelope.

Parameters

  • organization_id (int, required) — Organization scope.
  • alert_ids (list, required) — Alert ids to unassign.
  • rationale (str | None, optional) — Why the current assignee is being removed; kept in the history. Required, at least 10 characters.
  • confirm_token (str | None, optional) — From this tool's preview; omit to get one.

alert_claim ​

Read-only: no.

Take an alert that isn't closed and is either unassigned or already yours; an open one moves to Under Review. Claiming one that landed on you automatically is how you start working it. Nobody is notified. Needs only access to alerts. An alert someone else holds can't be claimed: it moves only when someone who can reassign work hands it on with alert_assign.

Previews first.

Parameters

  • organization_id (int, required) — Organization scope.
  • alert_id (int, required) — Alert id (from alert_list).
  • confirm_token (str | None, optional) — From this tool's preview; omit to get one.

alert_close ​

Read-only: no.

Close an alert with a disposition and your rationale. Everyone who can see alerts is notified. A closed alert can't be reopened; only its decision can change later. Change the decision with alert_revise_decision.

Previews first.

result codes: CL (Cleared), RA (Risk Accepted), ED (EDD Required), OB (Offboarding Required). closing_rationale: at least 10 characters.

Every hit or finding on it must be resolved first; the refusal says which. You must hold the alert: if you don't, take it with alert_claim when nobody else has it, or ask someone who can reassign it to hand it to you, then retry with the same arguments.

Parameters

  • organization_id (int, required) — Organization scope.
  • alert_id (int, required) — Alert id (from alert_list).
  • result (Literal, required) — Investigation disposition (AlertResult code).
  • closing_rationale (str, required) — Analyst's reasoning for the chosen result.
  • confirm_token (str | None, optional) — From this tool's preview; omit to get one.

alert_escalate ​

Read-only: no.

Hand an alert you hold up to another active member with a reason. It moves to Escalated and becomes theirs, so you can no longer act on it; they are notified with your reason.

Previews first.

escalation_reason: at least 10 characters. The member can't be you. If you don't hold the alert, take it with alert_claim when nobody else has it, then retry with the same arguments.

Parameters

  • organization_id (int, required) — Organization scope.
  • alert_id (int, required) — Alert id (from alert_list).
  • escalated_to_user_id (int, required) — User id (from member_list). The recipient; must differ from the caller.
  • escalation_reason (str, required) — Why the alert is being escalated. Visible to the recipient.
  • confirm_token (str | None, optional) — From this tool's preview; omit to get one.

alert_evidence_retrieve ​

Read-only: yes.

Get the evidence that raised an alert, by type:

  • watchlist: its screening hits (screened name, matched name, record type, resolution, when found).
  • blockchain_address: the previous and current screening of the address (risk, total exposure in USD, whether the provider call failed, when run).
  • any other alert raised on a profile: how many findings it has, with next_step saying where each one is read.
  • transaction: the per-exposure trace behind the decision (category, type, USD, %, severity and any de minimis or sanctions-regime adjustment, the policy rule and action), its flags, and the wallets with their screening ids.

Use after alert_retrieve to drill into what caused the alert.

Parameters

  • organization_id (int, required) — Organization scope.
  • alert_id (int, required) — Alert id (from alert_list).

alert_list ​

Read-only: yes.

List the organization's alerts of every type. Use when the user asks about alerts, items needing review, or what's on their plate today. For the caller's queue pass assigned_to_me=true with status=not_closed: open alone misses the ones already under review or escalated.

Exactly one of a row's profile_id / blockchain_address_id is populated per the alert's type; an alert closes only once its pending_items (unresolved hits or findings) is 0.

Parameters

  • organization_id (int, required) — Organization scope.
  • status (Optional, optional) — Filter by alert status: open (nobody has started on it), under_review, escalated, closed, or not_closed (open, under review and escalated together — everything still being worked).
  • alert_type (Optional, optional) — Filter by alert subtype.
  • profile_id (int | None, optional) — Profile id (from profile_list). Only its alerts.
  • assigned_to_user_id (int | None, optional) — Filter by the user the alert is assigned to.
  • assigned_to_me (bool | None, optional) — True = restrict to alerts assigned to the caller.
  • unassigned (bool | None, optional) — True = only unassigned alerts. False = only assigned ones. Omit for both.
  • opened_more_than_days_ago (int | None, optional) — Restrict to alerts created strictly more than N days ago. Used for SLA hygiene queries like 'show me alerts open more than 7 days'.
  • name_contains (str | None, optional) — Case-insensitive substring match on the alert name.
  • updated_after (datetime.datetime | None, optional) — Only include alerts modified at or after this UTC timestamp.
  • updated_before (datetime.datetime | None, optional) — Only include alerts modified before this UTC timestamp.
  • created_after (datetime.datetime | None, optional) — Only include alerts created at or after this UTC timestamp.
  • created_before (datetime.datetime | None, optional) — Only include alerts created before this UTC timestamp.
  • closed_by_user_id (int | None, optional) — Filter by the user who closed the alert.
  • closed_after (datetime.datetime | None, optional) — Only include alerts closed at or after this UTC timestamp.
  • closed_before (datetime.datetime | None, optional) — Only include alerts closed before this UTC timestamp.
  • sort_by (Literal, optional) — '-' prefix = descending.
  • limit (int, optional) — Max results.
  • offset (int, optional) — Results to skip.

Read-only: yes.

List other open or closed alerts that share this alert's subject — same profile for watchlist, negative-news and duplicate submission alerts, same blockchain address for blockchain-address alerts. The alert itself is always excluded. Use before closing or escalating to check whether the subject already has history elsewhere on the same workflow.

Parameters

  • organization_id (int, required) — Organization scope.
  • alert_id (int, required) — Alert id (from alert_list).
  • limit (int, optional) — Max results.
  • offset (int, optional) — Results to skip.

alert_retrieve ​

Read-only: yes.

Get one alert with the evidence for its type in payload: for a watchlist alert the profile and its hit counts by resolution, for a blockchain address alert the previous and current risk and the two screenings behind it, for any other alert its subject and what was found. type says which one you got, and next_step where to read more when it applies.

For the hits themselves use profile_screening_hit_list; for what changed in a blockchain address alert's exposure, blockchain_address_alert_retrieve.

Parameters

  • organization_id (int, required) — Organization scope.
  • alert_id (int, required) — Alert id (from alert_list).

alert_revise_decision ​

Read-only: no.

Change the disposition or the rationale recorded on a closed alert; pass the recorded result again to rewrite only the rationale. Everyone who can see alerts is notified.

Previews first.

Use this after profile_screening_hit_resolve changes a hit under a closed alert: the disposition was written against the verdict that just changed. The alert stays closed and keeps who closed it and when; revision_rationale (at least 10 characters) replaces the closing rationale and the change is kept in the alert's history.

For an alert that isn't closed use alert_close. You must hold the alert.

Parameters

  • organization_id (int, required) — Organization scope.
  • alert_id (int, required) — Alert id (from alert_list).
  • result (Literal, required) — The disposition that now stands (AlertResult code).
  • revision_rationale (str, required) — Why the recorded decision is being changed.
  • confirm_token (str | None, optional) — From this tool's preview; omit to get one.

alert_unassign ​

Read-only: no.

Return an assigned alert that isn't closed to the unassigned pool, so anyone can pick it up again. Needs permission to unassign work; the person who held it isn't notified. rationale is kept in the alert's history. The status doesn't change.

Previews first.

Parameters

  • organization_id (int, required) — Organization scope.
  • alert_id (int, required) — Alert id (from alert_list).
  • rationale (str | None, optional) — Why the current assignee is being removed; kept in the history. Required, at least 10 characters.
  • confirm_token (str | None, optional) — From this tool's preview; omit to get one.