DEV Community

Petter_Strale
Petter_Strale

Posted on

Your DeFi Due Diligence Takes 20 API Calls. It Should Take One.

#web3 #defi #security #api

Last week I watched someone investigate a DeFi project using my API platform. They made 23 calls over two days across three different tools. The pattern was always the same:

  1. DNS lookup on the project domain. Does it even exist?
  2. Check domain variants (.com, .io, .finance, .xyz). Squatting or legitimate?
  3. Validate team email addresses. Do the domains resolve?
  4. Scrape the website. Does the content match the whitepaper claims?

They were checking whether a project called OceanSwap was real. Four domain variants, all non-existent. Strong signal. But they had to make four separate calls to learn that.

This is how most DeFi due diligence works today: manual, slow, and fragmented. You piece together free tools, cross-reference results in your head, and hope you didn't miss something.

What the manual approach misses

The DNS + email + website scrape pattern catches the obvious fakes. It won't catch sanctions exposure. Is the team or any associated wallet on OFAC, EU, or UN sanctions lists? You're not checking this manually because the data sources are behind paywalls and the APIs are painful to integrate.

It also won't tell you whether there's an actual registered entity behind the project. A UK company check takes one call if you know the company number, but most DeFi projects don't advertise their Companies House registration. And even if you find the company, you still don't know who actually controls it. Beneficial ownership registries exist in most EU countries. Querying them programmatically is a different kind of painful.

Then there's adverse media. Has the project or its founders appeared in negative news coverage? That requires searching multiple news sources and filtering for relevance. Not something you do with a DNS lookup.

The single-call alternative

The same investigation as a structured verification:

curl -X POST https://api.strale.io/v1/execute/kyb-essentials-uk \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"company_name": "OceanSwap Ltd"}'
Enter fullscreen mode Exit fullscreen mode

One call. You get back company registration status (active, dissolved, or not found), registered address, officer names, beneficial ownership chain, sanctions screening against OFAC/EU/UN lists, adverse media mentions, and a quality score telling you how reliable each data point is.

Cost: €1.50 to €2.50 depending on jurisdiction. Time: under 3 seconds.

For OceanSwap, the response would come back with "company not found" across all registries. Same conclusion the manual researcher reached, but in one call instead of 23.

A limitation worth mentioning: beneficial ownership data is currently UK-only (Companies House PSC register). Nordic registries are next, but if you're investigating a Cayman Islands shell company, you'll hit the same wall everyone else does.

When the manual approach still makes sense

Free tools are fine for a quick sniff test. If you just want to know "does this domain exist?" then dns-lookup is free and instant. If you want to read a project's website without opening a browser, url-to-markdown handles that.

The structured verification becomes worth it when you're evaluating multiple projects and need consistency, when you need sanctions or beneficial ownership data that free tools can't provide, when you're building an agent that does this automatically, or when you need an audit trail of what you checked and when.

For agent builders

If you're building a DeFi research agent, the MCP integration is a few lines of config:

{
  "mcpServers": {
    "strale": {
      "type": "streamableHttp",
      "url": "https://api.strale.io/mcp"
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

Your agent gets access to 271 capabilities. The free ones (DNS, email validation, IBAN, URL scraping) work without signup. Compliance capabilities (sanctions, KYB, beneficial ownership) need an API key and cost €0.02 to €2.50 per call.

Every response includes provenance metadata (where the data came from, when it was fetched) and a quality score so your agent can assess confidence before acting on the result.

I built Strale as a solo founder in Sweden. 271 capabilities, 27 countries, 1,500+ automated test suites. If you're doing DeFi due diligence manually or building agents that need to verify counterparties, I'd like to hear what's missing from your workflow.

strale.dev. Free capabilities available, €2 trial credit on signup, no card required.

Top comments (0)