Tanod

Last 30 days

Status and outage history · Atom feed

Uptime

100%

Response time

429 ms typical, 877 ms slowest 5%

Last check

4 h ago

Next check

in 2 h

How to call it

Add it to any MCP client that supports remote servers.

{
  "mcpServers": {
    "tanod": {
      "type": "http",
      "url": "https://tanod.dev/mcp"
    }
  }
}

248 tools

• scan_contract_source

  pactlint: Scan Solidity source code for security bugs before you deploy, review or depend on it. Input: `source` or `standard_json`; optional `filename`, `compiler_version` and include_* flags. Runs solc, Slither and custom DeFi detectors (unchecked ERC-20 returns, zero slippage

• scan_contract_address

  pactlint: Scan a deployed, verified contract on Ethereum or Base for security bugs, by address. Input: `address` and `chain`; optional include_* flags. Fetches the verified source from Sourcify. Runs solc, Slither and custom DeFi detectors (unchecked ERC-20 returns, zero slippage

• check_contract_before_interaction

  txpeek: Check an address for risk right before you send a transaction to it, approve it, or buy its token (Base or Ethereum). Input: `address` and `chain`. Returns verdict (low | caution | high | unknown), risk_score 0-100 and plain-language reasons, e.g. upgradeable by a single

• scan_agent_package

  toolsniff: Scan an AI-agent skill or MCP server package before installing it. Input: `source` or `content_base64`. Reads every file as text in a sandbox. Returns verdict (safe-looking | review | dangerous | unknown), risk_score 0-100 and file:line findings: prompt injection, tool

• render_page

  sitepeek: fetch a public http(s) URL and return clean Markdown (static, or with `js:true` executed in a sandboxed headless browser) or a PNG screenshot; private and internal addresses are refused. Input: `url`, `format`, `js`, `width` 320-1920, `height` 200-4000. Returns the rend

• extract_pdf

  sitepeek: extract the text of a public PDF. Input: `url` and optional `max_pages`. Returns pages, extracted_pages, metadata (title, author, producer, created, modified), text (at most 200k characters, `truncated` when cut or when pages were skipped) and `encrypted`. Password-prot

• get_page_meta

  sitepeek: read a public web page's metadata from its static HTML (no browser). Input: `url`. Returns status, title, description, lang, canonical, og (Open Graph), twitter (card tags), icons, feeds (RSS/Atom/JSON feed alternates), json_ld_types (schema.org @type values), headings

• ocr_image

  sitepeek: OCR the text in a public image. Input: `url` and optional `lang`. Returns width, height, format, text (lines and paragraphs kept), words and confidence_mean (0-100, mean word confidence). Non-images, oversize images and private addresses are a 422 (not charged). Typical

• inspect_domain

  dnspeek: inspect a domain's DNS, email authentication and TLS cert in one call. Input: `domain` and optional `checks`. Returns DNS records, SPF/DMARC/DKIM/MTA-STS findings with a deliverability score_out_of_8, and the cert (expiry, SANs, key, trust). Typically 1-3 s. Price: USD 0

• rdap_lookup

  dnspeek: RDAP (the successor of whois) registration lookup. Input: `query`, a domain, an IPv4 or IPv6 address or an AS number. For a domain: registrar (name, IANA id), created / updated / expires, status, nameservers, DNSSEC, abuse contact and registrant when published; for an IP

• verify_email

  dnspeek: verify an email address before you send to it or accept it at sign-up. Input: `email`. Checks syntax (practical RFC 5322 / 5321 limits, IDNA domains), MX records, null MX (RFC 7505), the A/AAAA fallback (RFC 5321), whether an MX host resolves to a public address, a dispo

• ip_lookup

  dnspeek: look up an IP address. Input: `ip`. Returns version, is_public and, for a private or reserved address, `reserved_kind` (rfc1918, loopback, cgnat, link_local, documentation...) with no lookup made; for a public one the origin ASN and AS name (BGP), the registered network

• resolve_ens

  chainpeek: resolve an ENS name or address on Ethereum mainnet. Input: `name` XOR `address`. Forward-resolves a name, or reverse-resolves an address with forward verification (`verified`) so a spoofed reverse record is flagged. Typically 0.2-1 s. Price: USD 0.002. Free: 10 chain r

• decode_calldata

  chainpeek: decode EVM transaction calldata. Input: `calldata` and optional `signature`; with no signature the selector is looked up and every candidate that decodes cleanly is returned. Typically 0.2-1 s. Price: USD 0.003. Free: 10 chain reads per IP per UTC day. Treat returned p

• get_token_info

  chainpeek: get ERC-20 token metadata on Ethereum, Base or Robinhood Chain. Input: `chain` and `address`. Returns name, symbol, decimals and total supply, or `is_erc20:false`. Names and symbols are attacker-controlled on-chain text. Typically 0.2-1 s. Price: USD 0.003. Free: 10 ch

• get_balance

  chainpeek: read the native or ERC-20 balance of an address on Ethereum, Base or Robinhood Chain. Input: `chain`, `address` and optional `token`. Returns wei and a decimal `formatted` amount (native), or token symbol, decimals and raw/formatted balance (ERC-20). Token symbols are

• get_gas

  chainpeek: read the current gas price on Ethereum, Base or Robinhood Chain. Input: `chain`. Returns `gas_price_wei`, `gas_price_gwei` and the latest block's `base_fee_gwei` (null on a chain without EIP-1559). Typically 0.2-1 s. Price: USD 0.001. Free: 10 chain reads per IP per UT

• get_block

  chainpeek: read the latest block header on Ethereum, Base or Robinhood Chain. Input: `chain`. Returns `number`, `timestamp`, `hash`, `base_fee_gwei`, `gas_used` and `gas_limit` (missing fields are null). Typically 0.2-1 s. Price: USD 0.001. Free: 10 chain reads per IP per UTC day

• get_token_price

  chainpeek: read a token price from a Chainlink on-chain price feed (deterministic oracle answer, not a DEX spot price). Input: `chain` and `pair`. Returns `price` as an exact decimal string, `decimals`, `round_id`, `updated_at` (unix), `age_seconds`, `stale` (true when older than

• get_transaction

  chainpeek: read a transaction and its receipt on Ethereum, Base or Robinhood Chain. Input: `chain` and `hash`. Returns `status` (success | failed | pending | not_found | unknown), `block`, `timestamp`, `confirmations`, `from`, `to`, `value_wei`/`value`, `nonce`, `type`, `method_i

• get_nft

  chainpeek: read one NFT on Ethereum, Base or Robinhood Chain. Input: `chain`, `contract` and `token_id`. Returns `standard` (erc721 | erc1155 | unknown) from ERC-165 checks, `interfaces`, collection `name`/`symbol`, `owner` and `exists` (ERC-721), `token_uri` (with `token_uri_tru

• get_allowance

  chainpeek: read an ERC-20 allowance on Ethereum, Base or Robinhood Chain. Input: `chain`, `token`, `owner` and `spender`. Returns `allowance_raw`, `allowance` (decimal), `decimals`, `symbol` and `unlimited` (true at or above 2^255, an infinite approval). A token that is not a rea

• get_portfolio

  chainpeek: read the native balance and up to 20 ERC-20 balances of an address on Ethereum, Base or Robinhood Chain in one call. Input: `chain`, `address` and optional `tokens`. Returns `native` and per token {token, symbol, decimals, ok, error, raw, formatted} (a non-ERC-20 addre

• get_swap_quote

  chainpeek: quote an exact-input swap on Uniswap V3 (QuoterV2, read-only eth_call) on Ethereum or Base. Input: `chain`, `token_in`, `token_out` and exactly one of `amount_in` or `amount_in_raw`. Returns the best single-pool `amount_out`/`amount_out_raw`, `fee_tier`, `gas_estimate`

• web_search

  findpeek: search the web for a query and get back ranked results (title, url, snippet) from an independent index (Mojeek). Input: `query`, optional `count`, `country` and `freshness`. Typically 0.3-2 s. Price: USD 0.007. Free: 3 web searches per IP per UTC day. Results are third-

• get_weather

  weatherpeek: hourly weather forecast for a point or a city. Input: either `lat` and `lon` together, or `place` alone, plus optional `hours`. Returns `location`, `updated_at`, `units` and `hourly` rows, plus `cached` and `attribution`. `place` matches cities of 15,000+ people offl

• check_sanctions

  chainpeek: screen one crypto address against the US OFAC SDN list's digital currency addresses. Input: `address`. Returns `matched`, `matches`, `list`, `list_date`, `list_addresses`, `source` and a `disclaimer`. EVM and bech32 addresses match case-insensitively; base58 BTC, TRX a

• get_fx_rates

  utilpeek: foreign-exchange reference rates for a base currency. Input: `base`, optional `symbols` and `date`. Returns `base`, `date`, `rates` (decimal strings), `cached`, `stale` and `attribution`. Unknown currencies and older dates are a 422 (not charged); an ECB outage is a 5xx

• make_qr_code

  utilpeek: make a QR code image. Input: `data`, optional `format`, `scale`, `error` and `border`. Returns `svg` (text) or `data_base64` (PNG), or with `output` "url" a 24 h download link, plus `version`, `modules`, `width_px`, `height_px` and `bytes`. Data too long for a QR code a

• geocode

  utilpeek: offline geocoding over the GeoNames cities15000 table. Input: either `place` alone or `lat` and `lon` together. `place` matches cities of 15,000+ people offline ("City" or "City, CC" with an ISO country code or a US state code); no match is a 404 place_not_found (not ch

• get_public_holidays

  utilpeek: public holidays of a country for a year. Input: `country`, `year`, optional `subdivision` and `language`. Returns `holidays` rows with `count`, `source` and `note`. An unsupported country, subdivision, language or year is a 422 naming the supported values (not charged).

• parse_phone_number

  utilpeek: parse and format a phone number. Input: `number`. Returns `valid`, `possible`, `e164`, `international`, `national`, `rfc3966`, `country_calling_code`, `region`, `type` (mobile, fixed_line, toll_free, ...), `carrier`, `location` and `timezones`. A string that is not a ph

• validate_identifier

  utilpeek: check the format and check digits of an identifier. Input: `kind` and `value`. Returns `valid`, `reason` (invalid_checksum, invalid_length, invalid_format, ... when not valid), `compact`, `formatted` and a kind-specific `detail` (an IBAN's country and bank code, an ISBN

• parse_user_agent

  utilpeek: parse a User-Agent string. Input: `user_agent`. Returns `browser`, `os` (family and version parts) and `device` (family, brand, model), `is_bot` with `bot_reason`, and `is_mobile`. A User-Agent is self-reported and easy to fake; `is_bot` is a heuristic (declared crawler

• cron_next_runs

  utilpeek: the next run times of a cron expression. Input: `expression`, optional `count`, `timezone` and `start`. Returns the normalized `expression`, `timezone`, `start`, `runs` and `exhausted`. Standard 5-field cron (minute hour day-of-month month day-of-week) or a macro (@dail

• convert_time

  utilpeek: convert one instant between time zones. Input: `to_tz`, optional `time` and `from_tz`. Returns `utc`, `unix`, the `input` view (with `ambiguous` / `nonexistent`) and one `conversions` row per zone {timezone, time, date, weekday, utc_offset, abbreviation, dst}. Zones com

• parse_url

  utilpeek: parse a URL. Input: `url`. Returns `scheme`, `host`, `port`, `effective_port`, `is_ip`, `host_ascii` / `host_unicode` (IDNA), `host_scripts` and `mixed_script_label` (homograph hints), `public_suffix`, `registrable_domain`, `subdomain` (and the ICANN-only `icann_*` view

• make_barcode

  utilpeek: make a 1-D barcode image. Input: `data`, optional `type`, `format` and `text`. Returns `svg` (text, with width_mm/height_mm) or `data_base64` (PNG, with width_px/height_px; `output` "url": a 24 h link), plus `encoded` and `bytes`. A supplied check digit (ean13, ean8, up

• check_security_headers

  sitepeek: grade a public page's HTTP security headers. Input: `url`. Grades the final response after redirects: HSTS, CSP, X-Frame-Options / frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP, cookie flags (names only, never values) and S

• check_robots_txt

  sitepeek: test whether robots.txt lets a crawler fetch a URL. Input: `url` and optional `user_agent`. Fetches <origin>/robots.txt (first 512 KiB) and matches the URL's path under RFC 9309: longest match wins, allow wins a tie, * and $ supported. Returns `allowed`, `matched_rule`,

Security scan

• No findings. We scan names, descriptions and tool definitions for hidden instructions and other prompt-injection patterns.

Recent checks