KitScout

Categories › Security › Code & dependency scanning

Pre-transaction Safety Checks (Tanod)

MCP serverVerified domain · tanod.devRemote● LiveFree to try

Safety checks before you sign, pay or install: contract, token and package scans, phishing, OFAC.

Install

Remote server: your requests and data go to tanod.dev. Claude Code: claude mcp add --transport http pre-transaction-safety-checks-tanod https://tanod.dev/mcp/security · Claude app: Settings → Connectors → Add custom connector.

What it can do

The tools this server listed when we connected to it, in its own words.

  • scan_contract_source — pactlint: Scan Solidity source code for security bugs before you deploy, review or depend on it. For a deployed verified contract use scan_c
  • scan_contract_address — pactlint: Scan a deployed, verified contract on Ethereum or Base for security bugs, by address. For source you hold use scan_contract_source
  • check_contract_before_interaction — txpeek: Check an address for risk right before you send a transaction to it, approve it, or buy its token (Base or Ethereum). For a full sca
  • check_token_honeypot — chainpeek: Honeypot check: can this token be sold? Simulated buy and sell with tax. For a verdict that adds contract flags use check_token_s
  • check_token_safety — chainpeek: Use when an agent needs a token risk check before buying an ERC-20 on Base or Ethereum, with a plain-language take. For a written
  • token_verdict — chainpeek: Token risk verdict in plain language for a Base or Ethereum token, with a shareable card. For the simulation alone use check_toke
  • check_solana_token_safety — chainpeek: Check a Solana token for rug risk: mint and freeze authority, top holders, sell quote. For authorities alone use get_solana_token
  • scan_agent_package — toolsniff: Scan an AI-agent skill or MCP server package before installing it. To see whether a remote MCP server answers use check_mcp_serve
  • check_url_phishing — chainpeek: Check if a URL or domain is phishing or a scam. For up to 1,000 URLs use check_urls_phishing_batch; for headers use check_securit
  • check_urls_phishing_batch — chainpeek: Check up to 1,000 URLs or domains for phishing or scams in one batch. For one URL use check_url_phishing. Returns the URL check f
  • check_sanctions — chainpeek: screen one crypto address against the US OFAC SDN list's digital currency addresses. For up to 1,000 addresses use check_sanction
  • check_sanctions_batch — chainpeek: Screen up to 1,000 crypto addresses against OFAC sanctions in one batch. For one address use check_sanctions. Returns the OFAC sa
  • screen_sanctions_name — chainpeek: Screen a sanctions name. For crypto addresses use check_sanctions or check_sanctions_batch. Returns ranked name candidates from O
  • detect_proxy — chainpeek: detect whether a contract is a proxy, and of which kind. For code size and hash use get_contract_code. Reads the code, the EIP-19
  • decode_calldata — chainpeek: decode EVM transaction calldata. To run a read call use eth_call; to fetch a transaction use get_transaction. Input: `calldata` a
  • get_allowance — chainpeek: read an ERC-20 allowance on Ethereum, Base or Robinhood Chain. For every live approval of a wallet use audit_token_approvals. A t
  • inspect_domain — dnspeek: inspect a domain's DNS, email authentication and TLS cert in one call. For registration data use rdap_lookup; for availability use
  • check_security_headers — sitepeek: grade a public page's HTTP security headers. For a phishing-list check use check_url_phishing; for DNS and TLS use inspect_domain.
  • verify_email — dnspeek: verify an email address before you send to it or accept it at sign-up. For the domain's SPF, DMARC and DKIM use inspect_domain. Che
  • get_verification_code — dnspeek: Get the verification code or magic link from an email without the email body. To check an address before sending use verify_email.
  • rdap_lookup — dnspeek: RDAP (the successor of whois) registration lookup. For DNS and TLS use inspect_domain; for an IP's ASN and reverse DNS use ip_looku
  • text_unicode_inspect — utilpeek: Find invisible, bidi and homoglyph Unicode characters in text. For injected instructions use check_text_for_prompt_injection. Retu
  • check_address_poisoning — chainpeek: Check a transfer recipient for address poisoning: lookalikes in the sender's history. For balance, gas and blacklist checks too u
  • audit_token_approvals — chainpeek: List a wallet's live token approvals and get revoke transactions. For tokens already pulled out use check_wallet_drain; for one a
  • check_wallet_drain — chainpeek: Check a wallet for a drain: find tokens pulled out without its signature. For live approvals with revoke transactions use audit_t
  • get_wallet_counterparties — chainpeek: List a wallet's top counterparties: who an address sends to and receives from, by count and volume. For the raw transfer list use
  • check_text_for_secrets — utilpeek: Scan text for leaked secrets: API keys, tokens, private keys and seed phrases. For personal data use redact_pii; for injected inst
  • repo_info — utilpeek: Get health facts for a GitHub repository: activity, licence, dependents, Scorecard. Returns GitHub repository health facts: stars,

KitScout test notes

Not tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.

Similar tools