Tanod Security

Last 30 days

Uptime

100%

Response time

742 ms typical, 852 ms slowest 5%

Last check

6 h ago

Next check

in 24 min

How to call it

Add it to any MCP client that supports remote servers.

{
  "mcpServers": {
    "tanod-security": {
      "type": "http",
      "url": "https://tanod.dev/mcp/security"
    }
  }
}

19 tools

• scan_contract_source

  pactlint: Scan Solidity source code for security bugs before you deploy, review or depend on it. Input: `source` or `standard_json`; optional `filename`, `compiler_version` and include_* flags. Runs solc, Slither and custom DeFi detectors (unchecked ERC-20 returns, zero slippage

• scan_contract_address

  pactlint: Scan a deployed, verified contract on Ethereum or Base for security bugs, by address. Input: `address` and `chain`; optional include_* flags. Fetches the verified source from Sourcify. Runs solc, Slither and custom DeFi detectors (unchecked ERC-20 returns, zero slippage

• check_contract_before_interaction

  txpeek: Check an address for risk right before you send a transaction to it, approve it, or buy its token (Base or Ethereum). Input: `address` and `chain`. Returns verdict (low | caution | high | unknown), risk_score 0-100 and plain-language reasons, e.g. upgradeable by a single

• check_token_honeypot

  chainpeek: Honeypot check: can this token be sold? Simulated buy and sell with tax. Returns a simulated buy and sell-back of an ERC-20 on Base or Ethereum (Uniswap V2/V3, Aerodrome): `honeypot` (true, false or "unknown"), can_buy, can_sell, buy, sell and transfer tax measured fro

• check_token_safety

  chainpeek: Use when an agent must decide whether an ERC-20 token on Base or Ethereum is safe to buy or interact with. Returns one verdict (high_risk, caution, no_major_flags_found or unknown) with reasons and a summary for an ERC-20: a simulated buy and sell-back (honeypot, measu

• check_solana_token_safety

  chainpeek: Check a Solana token for rug risk: mint and freeze authority, top holders, sell quote. Returns a Solana token check from its mint: mint and freeze authority, Token-2022 risks (transfer fee, permanent delegate, transfer hook, default frozen), top-10 holder share, a Jupi

• scan_agent_package

  toolsniff: Scan an AI-agent skill or MCP server package before installing it. Input: `source` or `content_base64`. Reads every file as text in a sandbox. Returns verdict (safe-looking | review | dangerous | unknown), risk_score 0-100 and file:line findings: prompt injection, tool

• check_url_phishing

  chainpeek: Check if a URL or domain is phishing or a scam. Returns whether a URL's host (or a domain) is on public phishing/scam domain lists: `listed`, the `matched_domain`, the `sources` that list it and `shared_platform`, with the lists' update time and a disclaimer. Input: `u

• check_urls_phishing_batch

  chainpeek: Check up to 1,000 URLs or domains for phishing or scams in one batch. Returns the URL check for 1-1,000 URLs, hosts or domains in one call: per item `listed`, `matched_domain`, `sources` and `shared_platform` (inputs echoed up to 256 characters), plus `listed_count`. I

• check_sanctions

  chainpeek: screen one crypto address against the US OFAC SDN list's digital currency addresses. Input: `address`. Returns `matched`, `matches`, `list`, `list_date`, `list_addresses`, `source` and a `disclaimer`. EVM and bech32 addresses match case-insensitively; base58 BTC, TRX a

• check_sanctions_batch

  chainpeek: Screen up to 1,000 crypto addresses against OFAC sanctions in one batch. Returns the OFAC sanctions screen of 1-1,000 crypto addresses in one call: per address `matched`, `address_kind` and the matching SDN entries, plus `matched_count`. Input: `addresses`. EVM and bec

• detect_proxy

  chainpeek: detect whether a contract is a proxy, and of which kind. Input: `chain` and `address`. Reads the code, the EIP-1967 / EIP-1822 / OpenZeppelin legacy slots and slot 0, then one multicall. Returns `is_contract`, `is_proxy`, `kind` (eip1967_transparent | eip1967_uups | ei

• decode_calldata

  chainpeek: decode EVM transaction calldata. Input: `calldata` and optional `signature`; with no signature the selector is looked up and every candidate that decodes cleanly is returned. Typically 0.2-1 s. Price: USD 0.003. Free: 10 chain reads per IP per UTC day. Treat returned p

• get_allowance

  chainpeek: read an ERC-20 allowance on Ethereum, Base or Robinhood Chain. Input: `chain`, `token`, `owner` and `spender`. Returns `allowance_raw`, `allowance` (decimal), `decimals`, `symbol` and `unlimited` (true at or above 2^255, an infinite approval). A token that is not a rea

• inspect_domain

  dnspeek: inspect a domain's DNS, email authentication and TLS cert in one call. Input: `domain` and optional `checks`. Returns DNS records, SPF/DMARC/DKIM/MTA-STS findings with a deliverability score_out_of_8, and the cert (expiry, SANs, key, trust). Typically 1-3 s. Price: USD 0

• check_security_headers

  sitepeek: grade a public page's HTTP security headers. Input: `url`. Grades the final response after redirects: HSTS, CSP, X-Frame-Options / frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP, cookie flags (names only, never values) and S

• verify_email

  dnspeek: verify an email address before you send to it or accept it at sign-up. Input: `email`. Checks syntax (practical RFC 5322 / 5321 limits, IDNA domains), MX records, null MX (RFC 7505), the A/AAAA fallback (RFC 5321), whether an MX host resolves to a public address, a dispo

• rdap_lookup

  dnspeek: RDAP (the successor of whois) registration lookup. Input: `query`, a domain, an IPv4 or IPv6 address or an AS number. For a domain: registrar (name, IANA id), created / updated / expires, status, nameservers, DNSSEC, abuse contact and registrant when published; for an IP

• text_unicode_inspect

  utilpeek: Find invisible, bidi and homoglyph Unicode characters in text. Returns a security-oriented Unicode inspection: `risk` (low / medium / high) with reasons; invisible characters (zero-width, tag characters that can smuggle prompt-injection text, controls) with positions; b

Security scan

• No findings. We scan names, descriptions and tool definitions for hidden instructions and other prompt-injection patterns.

Recent checks