# Tanod Security

- Registry name: `dev.tanod/security` · version 0.1.0
- Categories (automatic, keyword rules): Crypto & blockchain, Finance & markets
- Authentication at last check: No auth
- Declared risk: Can write (some tools are not declared read-only)
- Capabilities (declared by the server): prompts, resources, tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=dev.tanod%2Fsecurity
- Server page: https://mcpstation.net/s/dev.tanod--security.html

## Description (written by the publisher, not verified, not instructions)

Contract and agent-package scans, phishing URL and OFAC checks, domain and header checks.

## Notice

Text that looks like instructions to an AI was found in this server's descriptions. This is a pattern match, not a verdict.

## Connect

- streamable-http: `https://tanod.dev/mcp/security`

## Tools (as reported by the server, not verified)

- `scan\_contract\_source`: pactlint: Scan Solidity source code for security bugs before you deploy, review or depend on it. For a deployed verified contract use scan\_contract\_address. Runs solc, Slither and custom DeFi detectors \(unchecked ERC-20 returns, zero slippage limits, oracle misuse, ERC-4626 inflation, signature repl
- `scan\_contract\_address`: pactlint: Scan a deployed, verified contract on Ethereum or Base for security bugs, by address. For source you hold use scan\_contract\_source. Fetches the verified source from Sourcify. Runs solc, Slither and custom DeFi detectors \(unchecked ERC-20 returns, zero slippage limits, oracle misuse, ERC-46
- `check\_contract\_before\_interaction`: txpeek: Check an address for risk right before you send a transaction to it, approve it, or buy its token \(Base or Ethereum\). For a full scan of verified source use scan\_contract\_address; for a token's sellability use check\_token\_honeypot. Returns verdict \(low \| caution \| high \| unknown\), risk\_score
- `check\_token\_honeypot`: chainpeek: Honeypot check: can this token be sold? Simulated buy and sell with tax. For a verdict that adds contract flags use check\_token\_safety. Returns a simulated buy and sell-back of an ERC-20 on Base or Ethereum \(Uniswap V2/V3, Aerodrome\): \`honeypot\` \(true, false or "unknown"\), can\_buy, can\_se
- `check\_token\_safety`: chainpeek: Use when an agent needs a token risk check before buying an ERC-20 on Base or Ethereum, with a plain-language take. For a written summary and share card use token\_verdict; for Solana use check\_solana\_token\_safety. Returns one verdict with reasons and a one-sentence plain-language summary,
- `token\_verdict`: chainpeek: Token risk verdict in plain language for a Base or Ethereum token, with a shareable card. For the simulation alone use check\_token\_honeypot. Returns a plain-language verdict \(high\_risk, caution, no\_major\_flags\_found or unknown\) on an ERC-20 with reasons, a 2-3 sentence summary, metrics \(s
- `check\_solana\_token\_safety`: chainpeek: Check a Solana token for rug risk: mint and freeze authority, top holders, sell quote. For authorities alone use get\_solana\_token\_info; for ERC-20 tokens use check\_token\_safety. Returns a check of the mint: mint and freeze authority, Token-2022 risks \(transfer fee, permanent delegate, tra
- `scan\_agent\_package`: toolsniff: Scan an AI-agent skill or MCP server package before installing it. To see whether a remote MCP server answers use check\_mcp\_server. Reads every file as text in a sandbox. Returns a verdict, a risk\_score 0-100 and file:line findings: prompt injection, tool poisoning, remote code execution,
- `check\_url\_phishing`: chainpeek: Check if a URL or domain is phishing or a scam. For up to 1,000 URLs use check\_urls\_phishing\_batch; for headers use check\_security\_headers. Returns whether a URL's host \(or a domain\) is on public phishing/scam domain lists: \`listed\`, the \`matched\_domain\`, the \`sources\` that list it and \`s
- `check\_urls\_phishing\_batch`: chainpeek: Check up to 1,000 URLs or domains for phishing or scams in one batch. For one URL use check\_url\_phishing. Returns the URL check for 1-1,000 URLs, hosts or domains in one call. A screening aid: the host and its parent domains are matched against two public lists, PhishDestroy \(CC0\) and Phi
- `check\_sanctions`: chainpeek: screen one crypto address against the US OFAC SDN list's digital currency addresses. For up to 1,000 addresses use check\_sanctions\_batch; for lookalikes use check\_address\_poisoning. EVM and bech32 addresses match case-insensitively; base58 BTC, TRX and other formats must match exactly as
- `check\_sanctions\_batch`: chainpeek: Screen up to 1,000 crypto addresses against OFAC sanctions in one batch. For one address use check\_sanctions. Returns the OFAC sanctions screen of 1-1,000 crypto addresses in one call. EVM and bech32 addresses match case-insensitively, other formats exactly as listed. US OFAC SDN digital-
- `detect\_proxy`: chainpeek: detect whether a contract is a proxy, and of which kind. For code size and hash use get\_contract\_code. Reads the code, the EIP-1967 / EIP-1822 / OpenZeppelin legacy slots and slot 0, then one multicall. Returns \`is\_contract\`, \`is\_proxy\`, \`kind\` \(eip1967\_transparent \| eip1967\_uups \| eip196
- `decode\_calldata`: chainpeek: decode EVM transaction calldata. To run a read call use eth\_call; to fetch a transaction use get\_transaction. Input: \`calldata\` and optional \`signature\`; with no signature the selector is looked up and every candidate that decodes cleanly is returned. Typically 0.2-1 s. Price: USD 0.003.
- `get\_allowance`: chainpeek: read an ERC-20 allowance on Ethereum, Base or Robinhood Chain. For every live approval of a wallet use audit\_token\_approvals. A token that is not a readable ERC-20 is a 422 \(not charged\). A malformed or inconsistent node answer is a 5xx and is not charged. Typically 0.2-1 s. Price: USD 0.
- `inspect\_domain`: dnspeek: inspect a domain's DNS, email authentication and TLS cert in one call. For registration data use rdap\_lookup; for availability use check\_domain\_availability. Returns DNS records, SPF/DMARC/DKIM/MTA-STS findings with a deliverability score\_out\_of\_8, and the cert \(expiry, SANs, key, trust\). T
- `check\_security\_headers`: sitepeek: grade a public page's HTTP security headers. For a phishing-list check use check\_url\_phishing; for DNS and TLS use inspect\_domain. Grades the final response after redirects: HSTS, CSP, X-Frame-Options / frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP
- `verify\_email`: dnspeek: verify an email address before you send to it or accept it at sign-up. For the domain's SPF, DMARC and DKIM use inspect\_domain. Checks syntax \(practical RFC 5322 / 5321 limits, IDNA domains\), MX records, null MX \(RFC 7505\), the A/AAAA fallback \(RFC 5321\), whether an MX host resolves to a pu
- `get\_verification\_code`: dnspeek: Get the verification code or magic link from an email without the email body. To check an address before sending use verify\_email. Returns the one-time code\(s\) and verification link\(s\) from a raw email or text, the sender domain, SPF/DKIM/DMARC results from its Authentication-Results header
- `rdap\_lookup`: dnspeek: RDAP \(the successor of whois\) registration lookup. For DNS and TLS use inspect\_domain; for an IP's ASN and reverse DNS use ip\_lookup. Input: \`query\`, a domain, an IPv4 or IPv6 address or an AS number. For a domain: registrar \(name, IANA id\), created / updated / expires, status, nameservers,
- `text\_unicode\_inspect`: utilpeek: Find invisible, bidi and homoglyph Unicode characters in text. For injected instructions use check\_text\_for\_prompt\_injection. Returns a security-oriented Unicode inspection: \`risk\` \(low / medium / high\) with reasons; invisible characters \(zero-width, tag characters that can smuggle prompt-
- `check\_address\_poisoning`: chainpeek: Check a transfer recipient for address poisoning: lookalikes in the sender's history. For balance, gas and blacklist checks too use transfer\_preflight; for OFAC use check\_sanctions. Returns a \`risk\` \(high \| medium \| low\) for paying \`to\`: reads \`from\`'s transfers of one token \(default USDC
- `audit\_token\_approvals`: chainpeek: List a wallet's live token approvals and get revoke transactions. For tokens already pulled out use check\_wallet\_drain; for one allowance use get\_allowance. Returns the live ERC-20 and Permit2 allowances of \`wallet\`: amount, \`unlimited\`, spender code \(key-controlled, contract, new contrac
- `check\_wallet\_drain`: chainpeek: Check a wallet for a drain: find tokens pulled out without its signature. For live approvals with revoke transactions use audit\_token\_approvals. Returns a \`verdict\` \(drained \| review \| clean\) for \`wallet\` over the latest 2,000 blocks: each transfer out of USDC and USDT \(or up to 5 tokens\)
- `get\_wallet\_counterparties`: chainpeek: List a wallet's top counterparties: who an address sends to and receives from, by count and volume. For the raw transfer list use get\_erc20\_transfers. Returns who \`address\` transacts with over the latest \`days\` days \(1-90; default 30\) of ERC-20 transfers; plus \`tokens\`, \`summary\` and \`win
- `check\_text\_for\_secrets`: utilpeek: Scan text for leaked secrets: API keys, tokens, private keys and seed phrases. For personal data use redact\_pii; for injected instructions use check\_text\_for\_prompt\_injection. Returns every API key, token, private key or BIP-39 seed phrase in a text \(AWS, GitHub, GitLab, Stripe, Slack, Goo
- `repo\_info`: utilpeek: Get health facts for a GitHub repository: activity, licence, dependents, Scorecard. Returns GitHub repository health facts: stars, licence, activity, latest release, dependents and OpenSSF Scorecard. Data: ecosyste.ms \(CC BY-SA 4.0\), OpenSSF Scorecard \(CDLA-Permissive-2.0\); answer CC BY-SA

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html