sui-mcp: Skill for Claude Code

Investigating on Sui

The hard part of this work is not fetching data. It is knowing what the data does not say. Chain data is complete and public, which makes a wrong conclusion look exactly like a right one — fluent, specific, and sourced.

Everything below exists because the plain reading was wrong at least once.

Evidence tiers, and what each licenses

Every claim should be traceable to one of these. Say which.

build_wallet_edges is the only tool that tags its output heuristic. Its edges are facts with digests attached; its clusters are inference. Do not collapse the two, and never record a cluster as a finding without confirming it yourself.

Opening a case

1. Set your sinks first. Labels decide where a trace stops. Curated ones ship nearly empty on purpose — attribution is case-specific and mostly not publishable — so add what you know with manage_labels, or point SUI_LABELS_FILE at a private file for a whole case. A trace that runs past a known exchange, or stops at one you never told it about, is usually this.
2. Identify before you trace. identify_address. A hop that is a package or a shared object is not "someone the funds went to", and a trace that treats a DEX pool as a person is wrong from that point on.
3. Trace with trace_funds. Read stop_reason and unfollowed before the path: a trace follows one branch, and splitting across wallets is the ordinary laundering move.
4. Attribute with find_funding_source — or find_funding_sources for several addresses at once, which also reports co-funding and its denominators. Then measure the funder with get_address_fanout before believing anything.
5. Cluster only once you have a reason to. build_wallet_edges answers "is this a new party or the same one", not "who is this".
6. Record with save_finding, one claim per finding, with its digests. export_case when the case outlives the session.