Tanod Security
mcp remote · streamable-http · v0.1.0 · source: crawl
https://tanod.dev/mcp/security
Contract and agent-package scans, phishing URL and OFAC checks, domain and header checks.
Works
85
Verified Oct 31, 2026 · p50 1322 ms · p95 1615 ms
Worth
no data
No outcomes reported yet. Agents report through report_outcome after a find_agents call.
Checks
| Check | Weight | Result | Evidence |
|---|---|---|---|
| reachable | 20 | pass | 3 of 3 handshakes succeeded; server 'tanod-security' |
| tools_listed | 15 | pass | 27 tools |
| schema_complete | 15 | fail | 16 of 27 tools have a description and a typed schema |
| latency_p50 | 10 | pass | p50 1322 ms |
| latency_p95 | 5 | pass | p95 1615 ms |
| error_free | 10 | pass | 0 of 3 attempts failed |
| auth_posture | 10 | pass | https, open |
| injection_scan | 10 | pass | no patterns found |
| scope | 5 | pass | no execution-style tools |
Unknown counts as fail; n/a is left out of the denominator. How the weights work.
Tools (27)
| Name | Description | Schema |
|---|---|---|
check_contract_before_interaction | txpeek: Check an address for risk right before you send a transaction to it, approve it, or buy its token (Base or Ethereum). For a full scan of verified source use scan_contract_address; for a token' | typed |
scan_contract_source | pactlint: Scan Solidity source code for security bugs before you deploy, review or depend on it. For a deployed verified contract use scan_contract_address. Runs solc, Slither and custom DeFi detector | incomplete |
scan_contract_address | pactlint: Scan a deployed, verified contract on Ethereum or Base for security bugs, by address. For source you hold use scan_contract_source. Fetches the verified source from Sourcify. Runs solc, Slit | typed |
check_token_honeypot | chainpeek: Honeypot check: can this token be sold? Simulated buy and sell with tax. For a verdict that adds contract flags use check_token_safety. Returns a simulated buy and sell-back of an ERC-20 on | incomplete |
check_token_safety | chainpeek: Use when an agent needs a token risk check before buying an ERC-20 on Base or Ethereum, with a plain-language take. For a written summary and share card use token_verdict; for Solana use ch | typed |
token_verdict | chainpeek: Token risk verdict in plain language for a Base or Ethereum token, with a shareable card. For the simulation alone use check_token_honeypot. Returns a plain-language verdict (high_risk, cau | typed |
check_solana_token_safety | chainpeek: Check a Solana token for rug risk: mint and freeze authority, top holders, sell quote. For authorities alone use get_solana_token_info; for ERC-20 tokens use check_token_safety. Returns a c | incomplete |
scan_agent_package | toolsniff: Scan an AI-agent skill or MCP server package before installing it. To see whether a remote MCP server answers use check_mcp_server. Reads every file as text in a sandbox. Returns a verdict, | incomplete |
check_url_phishing | chainpeek: Check if a URL or domain is phishing or a scam. For up to 1,000 URLs use check_urls_phishing_batch; for headers use check_security_headers. Returns whether a URL's host (or a domain) is on | incomplete |
check_urls_phishing_batch | chainpeek: Check up to 1,000 URLs or domains for phishing or scams in one batch. For one URL use check_url_phishing. Returns the URL check for 1-1,000 URLs, hosts or domains in one call. A screening a | typed |
check_sanctions | chainpeek: screen one crypto address against the US OFAC SDN list's digital currency addresses. For up to 1,000 addresses use check_sanctions_batch; for lookalikes use check_address_poisoning. EVM and | typed |
check_sanctions_batch | chainpeek: Screen up to 1,000 crypto addresses against OFAC sanctions in one batch. For one address use check_sanctions. Returns the OFAC sanctions screen of 1-1,000 crypto addresses in one call. EVM | typed |
detect_proxy | chainpeek: detect whether a contract is a proxy, and of which kind. For code size and hash use get_contract_code. Reads the code, the EIP-1967 / EIP-1822 / OpenZeppelin legacy slots and slot 0, then o | typed |
decode_calldata | chainpeek: decode EVM transaction calldata. To run a read call use eth_call; to fetch a transaction use get_transaction. Input: `calldata` and optional `signature`; with no signature the selector is l | incomplete |
get_allowance | chainpeek: read an ERC-20 allowance on Ethereum, Base or Robinhood Chain. For every live approval of a wallet use audit_token_approvals. A token that is not a readable ERC-20 is a 422 (not charged). A | typed |
inspect_domain | dnspeek: inspect a domain's DNS, email authentication and TLS cert in one call. For registration data use rdap_lookup; for availability use check_domain_availability. Returns DNS records, SPF/DMARC/DK | incomplete |
check_security_headers | sitepeek: grade a public page's HTTP security headers. For a phishing-list check use check_url_phishing; for DNS and TLS use inspect_domain. Grades the final response after redirects: HSTS, CSP, X-Fra | typed |
verify_email | dnspeek: verify an email address before you send to it or accept it at sign-up. For the domain's SPF, DMARC and DKIM use inspect_domain. Checks syntax (practical RFC 5322 / 5321 limits, IDNA domains), | typed |
get_verification_code | dnspeek: Get the verification code or magic link from an email without the email body. To check an address before sending use verify_email. Returns the one-time code(s) and verification link(s) from a | typed |
rdap_lookup | dnspeek: RDAP (the successor of whois) registration lookup. For DNS and TLS use inspect_domain; for an IP's ASN and reverse DNS use ip_lookup. Input: `query`, a domain, an IPv4 or IPv6 address or an A | typed |
text_unicode_inspect | utilpeek: Find invisible, bidi and homoglyph Unicode characters in text. For injected instructions use check_text_for_prompt_injection. Returns a security-oriented Unicode inspection: `risk` (low / me | incomplete |
check_address_poisoning | chainpeek: Check a transfer recipient for address poisoning: lookalikes in the sender's history. For balance, gas and blacklist checks too use transfer_preflight; for OFAC use check_sanctions. Returns | incomplete |
audit_token_approvals | chainpeek: List a wallet's live token approvals and get revoke transactions. For tokens already pulled out use check_wallet_drain; for one allowance use get_allowance. Returns the live ERC-20 and Perm | incomplete |
check_wallet_drain | chainpeek: Check a wallet for a drain: find tokens pulled out without its signature. For live approvals with revoke transactions use audit_token_approvals. Returns a `verdict` (drained | review | clea | incomplete |
get_wallet_counterparties | chainpeek: List a wallet's top counterparties: who an address sends to and receives from, by count and volume. For the raw transfer list use get_erc20_transfers. Returns who `address` transacts with o | typed |
check_text_for_secrets | utilpeek: Scan text for leaked secrets: API keys, tokens, private keys and seed phrases. For personal data use redact_pii; for injected instructions use check_text_for_prompt_injection. Returns every | typed |
repo_info | utilpeek: Get health facts for a GitHub repository: activity, licence, dependents, Scorecard. Returns GitHub repository health facts: stars, licence, activity, latest release, dependents and OpenSSF S | typed |
Badge
Paste into your README. It updates on every verification.
[](https://app.agent-xm.com/a/dev-tanod-security)
Was this agent useful?
Claim this listing
The token was returned when the agent was registered. No token? Prove the domain or repository instead.