# io.github.philpof102-svg/biii

- Registry name: `io.github.philpof102-svg/biii` · version 0.2.1
- Categories (automatic, keyword rules): Crypto & blockchain, Finance & markets, Payments & accounting
- Authentication at last check: No auth
- Declared risk: Not declared (tools carry no read/destructive hints)
- Capabilities (declared by the server): tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=io.github.philpof102-svg%2Fbiii
- Server page: https://mcpstation.net/s/io.github.philpof102-svg--biii.html

## Description (written by the publisher, not verified, not instructions)

Fail-closed safe-to-pay verdicts on Base: known-bad wallets, look-alike tokens, repeat rug funders.

## Notice

Text that looks like instructions to an AI was found in this server's descriptions. This is a pattern match, not a verdict.

## Connect

- streamable-http: `https://biii-production.up.railway.app/mcp`

## Tools (as reported by the server, not verified)

- `till\_vet\_merchant`: MainStreet safe-to-pay preflight on a merchant address. Returns the hosted oracle read \(advisory\) AND a LOCAL CLASSIFIER verdict computed on this node via trust-core \(pure, zero-oracle\) — so a verdict holds even if the oracle is down. Vet the RECIPIENT before paying.
- `till\_create\_charge`: Create a USDC-on-Base charge for a real-world merchant. Returns the charge + the EIP-681 payment URI your OWN wallet must execute \(basetill holds no key, moves no funds\).
- `till\_check\_payment`: Watch Base for the USDC transfer paying a charge and verify it FIELD-FOR-FIELD \(wrong chain/token/recipient/underpay/unconfirmed = NOT paid\). Only the chain says paid — verification is chain-only and never depends on any trust signal. Pass withTrust:true to ALSO get the payee's advisory MainStreet t
- `till\_trust`: The TRUST TRIANGLE in one call: composes reputation, standing \(LAWBOR proven history, if BIII\_LAWBOR\_URL set\) and settlement \(on-chain, if amountMicro given\) into ONE verdict \(unsafe/unknown/trusted/settled\). Reputation is shown as TWO LENSES kept SEPARATE, never merged: \`local\` = this node's known-
- `till\_create\_invoice`: Create a Web2-style INVOICE \(number, line items, due date, bill-to\) on the SAME non-custodial registry: paid by the same EIP-681 intent, verified by the same chain discipline, recorded in the same provable till roll. Returns the invoice + a human-readable bill \(EN/FR\) + the payment URI.
- `till\_check\_invoice`: Check an invoice against the chain: settled \(paid on-chain, field-for-field\) / overdue / issued / not\_observable \(settles on a rail BIII cannot read — ask the merchant's books, never assume unpaid\). If settled, returns the receipt for the registry.
- `till\_vet\_asset`: Is a TOKENIZED ASSET \(stock/treasury/RWA\) contract the GENUINE issuer's, or an impersonator? genuine / impersonation / unsafe / unknown — fail-closed \(unknown is never genuine\). Catches the FBI-flagged lookalike-token fraud. Registry is authoritative: seed only; source real addresses from issuer off
- `till\_vet\_meme`: Which contract is the REAL memecoin among 10+ look-alikes? Fail-closed verdict from live market data \(DexScreener\). Returns: genuine \(one contract dominates liquidity\), ambiguous \(top-2 tied — never certified\), impersonation \(the address you passed is NOT the dominant one\), thin \(no credible liquidi
- `till\_receipt`: Produce the chain-anchored receipt for a VERIFIED payment \(txHash + basescan link\). Refuses without verification.
- `till\_roll`: PROVABLE BOOKS: render an agent/merchant's till roll — a shareable statement where EVERY line carries its own txHash + basescan link, so the reader re-verifies each payment on Base themselves \(trust no one, not even BIII\). This is the substitute for the settlement statement an excluded merchant/agen
- `till\_export`: ACCOUNTING EXPORT: turn the verified receipts into an accountant-ready CSV that QuickBooks / Xero / Excel import \(the export finance teams need to adopt\). Every row carries its own txHash + Basescan link, so the accountant re-verifies each amount on Base themselves — the export is a POINTER to the c
- `till\_meter`: USAGE → BILL for a white-label pilot, split by trust. The settled receipts are ON-CHAIN \(each txHash re-verifiable on Base — the PROVABLE basis for receipt charges\); the verdict count is SELF-REPORTED \(verdicts are advisory reads, not chain artifacts\) and labeled as such. The pricing plan is INJECTE
- `till\_floor`: DECENTRALIZATION PROOF: the provenance + content-FINGERPRINT of this node's known-bad floor. Two nodes with the SAME fingerprint judge on the SAME floor — sameness is a checkable fact, not an operator's word. The floor is re-derivable from named public open-licensed lists \(run scripts/biii-known-bad
- `till\_resolve`: IDENTITY BRIDGE: resolve an AGENT identity — a buzz/Nostr npub \(64-hex secp256k1\) AND/OR a gitlawb did:key \(Ed25519\) — to a payable, trust-assessable BASE address, trustlessly. The binding is a BIDIRECTIONAL attestation: each identity key AND the Base key sign the same canonical message, so anyone r
- `till\_kya`: IDENTITY STANDARD \(interop\): read a Skyfire KYA \("Know Your Agent"\) JWT — the signed token binding a real human/business to an agent \(Experian's identity layer\). The IDENTITY counterpart to till\_trust's ERC-8004 reputation lens. Parses the JWT + validates fail-closed \(iss/sub present, not expired, a
- `till\_authorize`: SPEND AUTHORIZATION \(Skyfire Programmable Payment\): create a charge AND check it against what the agent's OWNER signed off — token, recipient allow-list, per-charge max, AND the cumulative cap. Fail-closed and drain-safe: an EIP-681 payment intent is issued ONLY if the charge is authorized \(ten smal
- `till\_rug\_powers`: WHO CAN STILL RUG THIS TOKEN? till\_vet\_meme says which contract is the real one; this says whether the real one is itself a trap. A dangerous capability only counts if someone can still FIRE it — mintable with ownership renounced is inert, the same flag with a live owner is an armed rug, and scoring
- `till\_launch\_funder`: WHO PAID FOR THIS LAUNCH, AND WHAT ELSE DID THEY PAY FOR? Follows the money backwards: a token names its creator, a creator minted minutes ago names the wallet that funded it, and that funder usually funded others. Three free explorer queries surface a cluster no buyer can see from a chart. Proven l
- `till\_b20\_authentic`: IS THIS A REAL BASE-NATIVE B20, OR AN ERC-20 WEARING ITS ADDRESS PREFIX? B20 is Base's native standard for compliant asset issuance \(stablecoins, RWA\); its tokens sit at addresses starting 0xb200 and run as a precompile, so a genuine one carries almost no EVM bytecode. As people learn to read 0xb200
- `till\_trace\_theft`: FOLLOW STOLEN FUNDS from the victim's transaction to where the trail dies. Three modes. moved: what actually left a wallet in one transaction, marking which transfers are AUTHENTIC — ERC-20 Transfer logs are attacker-controlled text, so only the transaction signer is authoritative and forged events
- `till\_recovery\_offer`: THE SECOND THEFT: judge an approach offering to recover already-stolen funds. Every other tool here tries to stop the first loss; this exists because the first loss is what makes a person findable, and a drained wallet is a lead with a market for it. Answerable with certainty rather than a score, be
- `till\_vet\_approach`: JUDGE AN INBOUND OPPORTUNITY BY ITS ASK, NOT BY HOW GOOD IT LOOKS \(podcast, interview, partnership, job, AMA\). Built from a lure that worked on someone who verifies counterparties professionally: a 35-question production dossier citing his real scoring model, his settlement rails, his own catchphras
- `till\_open\_approvals`: WHICH DOORS INTO THIS WALLET ARE STILL OPEN? An ERC-20 approval is a standing permission to move your tokens without asking again, and it is the most common drain vector that does NOT require the private key: you approved a contract once for an unlimited amount and forgot. Wallets do not surface the
- `till\_watch\_wallet`: WHAT CHANGED AROUND THIS WALLET SINCE WE LAST LOOKED? The other tools answer at a point in time; this is what turns them into a guard, because it REMEMBERS and therefore distinguishes a new door from an old one. Three unlimited approvals granted last year are a standing condition; a fourth appearing
- `till\_vet\_agent`: IS THIS AGENT SAFE TO CONNECT TO, AND SAFE TO PAY? The gap this closes: everything else here judges tokens, launches, thefts and wallets, but never the AGENT — which is the thing that actually holds the tools. Four checkable dangers, none of which require trusting a word of the description. It does
- `till\_seed\_exposure`: IS A RECOVERY PHRASE SITTING IN CLEARTEXT ON THIS MACHINE? Everything else here answers whether an ADDRESS is safe to pay; this answers whether the MACHINE is safe to hold a wallet, and a safe address on a compromised machine is worth nothing. "Self custody if you know how to keep your seedphrase sa
- `till\_key\_exposure`: WHAT KEY MATERIAL IS ON THIS DISK, AND WHAT STILL HOLDS AN OLD COPY OF IT? The companion to till\_seed\_exposure, and it exists because a real theft happened without the phrase ever being written down: the key was exfiltrated. The trap is that a secp256k1 private key is 64 hex characters and so is eve
- `till\_verify\_delivery`: I CAN PROVE I PAID. CAN I PROVE I WAS SERVED? Every other check here runs before money moves; this is the question after, and it is the one nothing in this market answers. A payment is a fact on Base that anyone can re-check forever; the deliverable was a sentence in a message. So a buyer can prove
- `till\_funder\_history`: HAS THE WALLET THAT PAID FOR THIS LAUNCH ALREADY KILLED ONE? till\_launch\_funder reads the graph and tells you a cluster exists; this reads our OWN observation record and tells you what happened to the rest of it. The distinction matters because every other check here asks the token a question it can

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html