🕵️ Investigation Tools
One-click entity investigation plus twelve domain-specific operators (financial crime, maritime, telecom, geospatial). The SDK methods wrap governed SQL operators; the MCP tools wrap the same operators for agents.
Investigate entity (composite profile)
mcp = McpClient.from_client(client)
mcp.investigate_entity("Person", "alice")
# {"profile": {...}, "timeline": [...], "connections": [...],
# "risk": {"score": 0.92, "factors": ["sanctions_proximity", ...]}}Sanctions screening
client.sanctions_screen("Alice Chen")
# {"data": []} — no hits yet
mcp.screen_sanctions("Alice Chen", threshold=0.85)
# {"rows": 0}Beneficial ownership chain
client.beneficial_ownership_chain("Pacific Trust 7742", max_depth=6)
# {"chain": [{"account": "Pacific Trust 7742", "holder": "David Kim"},
# {"holder": "David Kim", "nominee_for": "Bob Smith"}, ...]}Crypto trace, wire reconstruction, hawala
client.crypto_trace("0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb")
# {"hops": [{"from": "0x742d...", "to": "0x9ab1...", "amount": 12.5}, ...]}
client.wire_reconstruction("Pacific Trust 7742", tolerance_pct=5.0)
# {"chain": [{"account": "...", "in": 2800000, "out": 850000}, ...]}
client.hawala_trace("alice", max_hops=5)
# {"network": [{"node": "alice", "linked_to": ["hawaladar_1", ...]}, ...]}Geospatial
client.geofence("POINT(-97.74 30.27)", target_type="MovementEvent")
# {"data": [{"id": "m1", "lat": 30.27, "lon": -97.74}, ...]}
client.crime_pattern_cluster("downtown_austin")
# {"clusters": [{"centroid": [...], "events": 23}, ...]}Telecom: burner & convoy detection
client.burner_detect(max_age_days=30, max_calls=3)
# {"burners": [{"phone": "+14155550199", "age_days": 12, "calls": 2}, ...]}
client.convoy_detect(radius_m=200, time_tol_secs=300, min_points=3)
# {"convoys": [{"members": ["veh_1", "veh_2", "veh_3"], "window": [...]}]}Maritime
client.vessel_track(538005644, window_secs=86400) # MMSI → AIS track
client.dark_fleet_detect(max_gap_hours=24) # AIS gaps ("going dark")
client.vessel_to_vessel_transfer(proximity_nm=0.5,
time_window_minutes=120)
# {"transfers": [{"vessel_a": 538..., "vessel_b": 636..., ...}]}Full investigation operator table
| Method | Domain | What it finds |
|---|---|---|
sanctions_screen(name) | compliance | sanctions-list hits (fuzzy threshold) |
beneficial_ownership_chain(party) | compliance | ultimate beneficial owner |
crypto_trace(entity) | financial | cryptocurrency fund flow |
wire_reconstruction(account) | financial | wire-transfer chain |
hawala_trace(seed) | financial | informal value-transfer network |
geofence(area) | geospatial | entities within a geographic fence |
crime_pattern_cluster(area) | geospatial | spatial crime clusters |
burner_detect(...) | telecom | burner phone numbers |
convoy_detect(...) | telecom/transport | entities traveling together |
dark_fleet_detect(...) | maritime | vessels with AIS gaps |
vessel_track(mmsi) | maritime | AIS position reports |
vessel_to_vessel_transfer(...) | maritime | ship-to-ship transfers |
Next: Agent Memory — give the investigating agent governed, provenance-tracked beliefs.