596 services carry this tag in their source record. Tags come from the provider, not from us — a tag is a claim about what the service does, not proof that it does it well.
Scan text an agent is about to read (web page, email, tool result; up to 8,000 characters) for prompt-injection attempts: instruction overrides, fake system messages, asks to hide things from the user, exfiltration links...
Bridge exploit track record: for one bridge, its hack history (incidents, total USD lost, funds returned, worst technique); with no bridge, a ranked leaderboard of every bridge hack by USD lost. Sourced from DefiLlama's...
Give it npm or PyPI package names. For each it reads the registry metadata and latest version (and npm download counts) and queries OSV.dev for known security advisories, then composes a risk brief: known vulnerabilities...
Give it hosts or HTTPS URLs. For each it does a passive TLS handshake and reports the certificate: validity, days until expiry, issuer, subject, SANs and TLS version - with a signal (valid / expiring-soon / expired / inv...
SendCheck: pre-send verification of any EVM address on one chain (EIP-55 checksum, wallet-vs-contract, outgoing activity, balances, verdict). POST {address, chain}
Check Python packages from PyPI before you pip install or bump versions. Send {"packages":["requests==2.25.0","flask>=2.0"]} or {"requirements":"<requirements.txt text>"}, up to 50 packages. Per package: latest release a...
Audit text for malicious AI-skill patterns. Requires `content`. Nothing to audit — crawling, or discovering this endpoint cold? POST /audit/registry runs the same scanner over the newest servers in the official MCP regis...
Cyre Pay-route Oracle — before your agent pays any external x402 resource, grade payTo + amount/URL + facilitator/offer pin hygiene in one call. Patterns, not verdicts. Agent guide: https://cyre.dev/SKILL.md
Wallet balance on Base: the native ETH balance of any address, read live from the chain. Input: address
Package security scanner — CVEs, license check, typosquat detection.
txpeek (Tanod) pre-transaction check: risk verdict for an address in about a second (proxy and admin control, verification, risky functions, token basics). Heuristic, not an audit. Use when an agent is about to send fund...
MCP security checks and feedback for users and developers. Choose paid access without reports, or ongoing free access within limits: POST /v1/client-token; 1 check/24h + 1 for a previous-use report. Check URL/DNS, metada...
Website security headers audit: HTTPS, HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and cookie flags, with a score.
Run a transaction simulation and EVM safety preflight with gas, destination proxy evidence, and optional token security and allowance checks in one decision-ready report.
Live feed of freshly-detected malicious addresses on Base — address-poisoning seeders caught via zero-value transfer sprays, updated continuously by our on-chain collector. Poll ?since=<unix> to ingest only new threats i...
Call when you need the readable content of a public web page: returns clean markdown (title, headings, lists, links; scripts and navigation removed), up to 100k characters. Pages that fail (404, blocked, timeout) are not...
Address-poisoning check before you send USDC on Base. Body {from, to} (or sender/recipient; chain=base, token=USDC only, others 400 not charged; optional contacts/known_addresses): scans the sender's recent Base USDC tra...
Latest-release metadata from the official PyPI JSON API (live): version, license, requires_python compatibility, requires_dist dependency specs (max 100), yanked flag, last upload time and project URLs. Query: ?pkg=reque...
SCV Approvals: active token approvals of a wallet (unlimited/unknown spender detection) for $0.01 USDC via x402
Scam/honeypot/rug risk check for a token: unverified code, sell restrictions, mint/pause/blacklist powers, taxes, upgradeable proxy, age, liquidity, fake major-token impersonation and spam-airdrop patterns. Never visits...
Is this token a scam? Checks any token on Base, Ethereum or BSC and returns a 0-100 safety score, a verdict, red flags (honeypot, hidden fees, owner powers, unlocked liquidity, whale concentration, creator's past honeypo...
Simulates an unsigned Base or Base Sepolia EVM transaction with read-only RPC calls before an agent signs or broadcasts it. Returns execution/revert status, gas estimate, decoded top-level ERC-20 transfers and approvals,...
Wallet and counterparty risk check before an agent sends funds or grants approvals.
Domain & DNS intelligence — records, SSL certs, subdomain discovery.