Pre-transaction Safety Checks (Tanod)

설치

쓰고 있는 AI 앱을 고른 다음 설정을 복사하세요.

검사 4/4 통과 · 내가 묻는 내용은 제작자 서버(tanod.dev)를 거쳐요 · ✓ 명령 확인 2026년 11월 13일

claude mcp add --transport http --scope user security https://tanod.dev/mcp/security

{
  "mcpServers": {
    "security": {
      "url": "https://tanod.dev/mcp/security"
    }
  }
}

{
  "servers": {
    "security": {
      "type": "http",
      "url": "https://tanod.dev/mcp/security"
    }
  }
}

어떤 앱에서 쓸 수 있나요

이 서버의 연결 방식과 각 앱의 공식 문서를 바탕으로 했어요. 2026년 11월 10일 확인.

인터넷으로 연결하는 앱

ClaudeChatGPTGooseLM StudioMsty StudioCherry StudioCursorVS Code + GitHub CopilotVisual StudioWindsurf (Devin Desktop)ZedKiroClineContinueJetBrains AI AssistantClaude CodeCodex CLIGemini CLIOpenCodenodecodeWarpLibreChatOpen WebUIRaycast

모든 앱과 장단점 →

할 수 있는 일

도구 이름과 설명은 서버가 2026년 11월 9일에 알려 준 그대로예요. 우리가 아니라 제작자가 쓴 글이고, 일반 텍스트로만 보여 드려요.

• scan_contract_source

  pactlint: Scan Solidity source code for security bugs before you deploy, review or depend on it. For a deployed verified contract use scan_contract_address. Runs solc, Slither and custom DeFi detectors (unchecked ERC-20 returns, zero slippage limits, oracle misuse, ERC-4626 infla

• scan_contract_address

  pactlint: Scan a deployed, verified contract on Ethereum or Base for security bugs, by address. For source you hold use scan_contract_source. Fetches the verified source from Sourcify. Runs solc, Slither and custom DeFi detectors (unchecked ERC-20 returns, zero slippage limits, o

• check_contract_before_interaction

  txpeek: Check an address for risk right before you send a transaction to it, approve it, or buy its token (Base or Ethereum). For a full scan of verified source use scan_contract_address; for a token's sellability use check_token_honeypot. Returns verdict (low | caution | high |

• check_token_honeypot

  chainpeek: Honeypot check: can this token be sold? Simulated buy and sell with tax. For a verdict that adds contract flags use check_token_safety. Returns a simulated buy and sell-back of an ERC-20 on Base or Ethereum (Uniswap V2/V3, Aerodrome): `honeypot` (true, false or "unknow

• check_token_safety

  chainpeek: Use when an agent needs a token risk check before buying an ERC-20 on Base or Ethereum, with a plain-language take. For a written summary and share card use token_verdict; for Solana use check_solana_token_safety. Returns one verdict with reasons and a one-sentence pla

• token_verdict

  chainpeek: Token risk verdict in plain language for a Base or Ethereum token, with a shareable card. For the simulation alone use check_token_honeypot. Returns a plain-language verdict (high_risk, caution, no_major_flags_found or unknown) on an ERC-20 with reasons, a 2-3 sentence

• check_solana_token_safety

  chainpeek: Check a Solana token for rug risk: mint and freeze authority, top holders, sell quote. For authorities alone use get_solana_token_info; for ERC-20 tokens use check_token_safety. Returns a check of the mint: mint and freeze authority, Token-2022 risks (transfer fee, per

• scan_agent_package

  toolsniff: Scan an AI-agent skill or MCP server package before installing it. To see whether a remote MCP server answers use check_mcp_server. Reads every file as text in a sandbox. Returns a verdict, a risk_score 0-100 and file:line findings: prompt injection, tool poisoning, re

• check_url_phishing

  chainpeek: Check if a URL or domain is phishing or a scam. For up to 1,000 URLs use check_urls_phishing_batch; for headers use check_security_headers. Returns whether a URL's host (or a domain) is on public phishing/scam domain lists: `listed`, the `matched_domain`, the `sources`

• check_urls_phishing_batch

  chainpeek: Check up to 1,000 URLs or domains for phishing or scams in one batch. For one URL use check_url_phishing. Returns the URL check for 1-1,000 URLs, hosts or domains in one call. A screening aid: the host and its parent domains are matched against two public lists, PhishD

• check_sanctions

  chainpeek: screen one crypto address against the US OFAC SDN list's digital currency addresses. For up to 1,000 addresses use check_sanctions_batch; for lookalikes use check_address_poisoning. EVM and bech32 addresses match case-insensitively; base58 BTC, TRX and other formats mu

• check_sanctions_batch

  chainpeek: Screen up to 1,000 crypto addresses against OFAC sanctions in one batch. For one address use check_sanctions. Returns the OFAC sanctions screen of 1-1,000 crypto addresses in one call. EVM and bech32 addresses match case-insensitively, other formats exactly as listed.

• detect_proxy

  chainpeek: detect whether a contract is a proxy, and of which kind. For code size and hash use get_contract_code. Reads the code, the EIP-1967 / EIP-1822 / OpenZeppelin legacy slots and slot 0, then one multicall. Returns `is_contract`, `is_proxy`, `kind` (eip1967_transparent | e

• decode_calldata

  chainpeek: decode EVM transaction calldata. To run a read call use eth_call; to fetch a transaction use get_transaction. Input: `calldata` and optional `signature`; with no signature the selector is looked up and every candidate that decodes cleanly is returned. Typically 0.2-1 s

• get_allowance

  chainpeek: read an ERC-20 allowance on Ethereum, Base or Robinhood Chain. For every live approval of a wallet use audit_token_approvals. A token that is not a readable ERC-20 is a 422 (not charged). A malformed or inconsistent node answer is a 5xx and is not charged. Typically 0.

• inspect_domain

  dnspeek: inspect a domain's DNS, email authentication and TLS cert in one call. For registration data use rdap_lookup; for availability use check_domain_availability. Returns DNS records, SPF/DMARC/DKIM/MTA-STS findings with a deliverability score_out_of_8, and the cert (expiry,

• check_security_headers

  sitepeek: grade a public page's HTTP security headers. For a phishing-list check use check_url_phishing; for DNS and TLS use inspect_domain. Grades the final response after redirects: HSTS, CSP, X-Frame-Options / frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissio

• verify_email

  dnspeek: verify an email address before you send to it or accept it at sign-up. For the domain's SPF, DMARC and DKIM use inspect_domain. Checks syntax (practical RFC 5322 / 5321 limits, IDNA domains), MX records, null MX (RFC 7505), the A/AAAA fallback (RFC 5321), whether an MX h

• get_verification_code

  dnspeek: Get the verification code or magic link from an email without the email body. To check an address before sending use verify_email. Returns the one-time code(s) and verification link(s) from a raw email or text, the sender domain, SPF/DKIM/DMARC results from its Authentic

• rdap_lookup

  dnspeek: RDAP (the successor of whois) registration lookup. For DNS and TLS use inspect_domain; for an IP's ASN and reverse DNS use ip_lookup. Input: `query`, a domain, an IPv4 or IPv6 address or an AS number. For a domain: registrar (name, IANA id), created / updated / expires,

• text_unicode_inspect

  utilpeek: Find invisible, bidi and homoglyph Unicode characters in text. For injected instructions use check_text_for_prompt_injection. Returns a security-oriented Unicode inspection: `risk` (low / medium / high) with reasons; invisible characters (zero-width, tag characters that

• check_address_poisoning

  chainpeek: Check a transfer recipient for address poisoning: lookalikes in the sender's history. For balance, gas and blacklist checks too use transfer_preflight; for OFAC use check_sanctions. Returns a `risk` (high | medium | low) for paying `to`: reads `from`'s transfers of one

• audit_token_approvals

  chainpeek: List a wallet's live token approvals and get revoke transactions. For tokens already pulled out use check_wallet_drain; for one allowance use get_allowance. Returns the live ERC-20 and Permit2 allowances of `wallet`: amount, `unlimited`, spender code (key-controlled, c

• check_wallet_drain

  chainpeek: Check a wallet for a drain: find tokens pulled out without its signature. For live approvals with revoke transactions use audit_token_approvals. Returns a `verdict` (drained | review | clean) for `wallet` over the latest 2,000 blocks: each transfer out of USDC and USDT

• get_wallet_counterparties

  chainpeek: List a wallet's top counterparties: who an address sends to and receives from, by count and volume. For the raw transfer list use get_erc20_transfers. Returns who `address` transacts with over the latest `days` days (1-90; default 30) of ERC-20 transfers; plus `tokens`

• check_text_for_secrets

  utilpeek: Scan text for leaked secrets: API keys, tokens, private keys and seed phrases. For personal data use redact_pii; for injected instructions use check_text_for_prompt_injection. Returns every API key, token, private key or BIP-39 seed phrase in a text (AWS, GitHub, GitLab

• repo_info

  utilpeek: Get health facts for a GitHub repository: activity, licence, dependents, Scorecard. Returns GitHub repository health facts: stars, licence, activity, latest release, dependents and OpenSSF Scorecard. Data: ecosyste.ms (CC BY-SA 4.0), OpenSSF Scorecard (CDLA-Permissive-2

기본 점검i

누구나 볼 수 있는 정보를 점검했고, 코드는 읽지 않았어요. 해당하지 않는 항목은 개수에서 뺐어요. · 2026년 11월 14일 점검

• ✓ 통과

  제작자와 저장소 일치

  레지스트리 이름이 도메인 tanod.dev 기준으로 확인되었어요(레지스트리가 도메인 소유를 확인해요)

• ✓ 통과

  계속 관리되고 있음

  코드 마지막 변경: 4일 전

• – 해당 없음

  라이선스 있음

  해당 없음: tanod.dev 소유자가 직접 운영하는 클라우드 서버라 저장소 코드를 실행하지 않아요

• ✓ 통과

  엔드포인트 응답

  302ms 만에 응답(HTTP 200)

• – 해당 없음

  OAuth로 로그인

  로그인 필요 없음

• ✓ 통과

  도구 설명에 숨겨진 지시 없음

  도구 설명 27개를 읽었고, AI에게 보내는 숨겨진 지시는 없었어요

사용자 리뷰

아직 리뷰가 없어요

Google로 로그인하고 리뷰 쓰기

사이버 보안 카테고리의 다른 서버와 비교i

• 이 카테고리의 다른 서버 1055개 중 0%보다 스타가 많아요
• 이 카테고리의 다른 서버 1055개 중 87%보다 최근에 레지스트리에 공개됐어요
• 기본 점검 결과가 이 카테고리의 다른 서버 1055개 중 100%와 같거나 더 좋아요

레지스트리에서 이 카테고리의 활성 서버 전체와 비교했어요. 스타는 게시자가 저장소를 소유한 경우에만 세요.

같은 카테고리의 다른 것

같은 카테고리에서 다른 제작자가 만든 서버예요. 스타 순으로 정렬했어요.

카드 보는 법:↓ 주간 다운로드i★ GitHub 스타i세 기둥: 리뷰 · 점검 · 사용 정도i업데이트 = 최신 버전을 레지스트리에 공개한 날i

Robin: AI-Powered Dark Web OSINT

Dark web OSINT over Tor: search onion engines, scrape pages, report with your own model.

제작자: apurvsinghgautam·성장 중·★ 8천·42일 전 업데이트

내 컴퓨터에서 실행

설치

HOL Guard

Local-first AI agent security evidence and approval workflows through HOL Guard's stdio MCP server.

제작자: hashgraph-online·널리 사용됨·↓ 7.1천/주·★ 1.1천·9일 전 업데이트

내 컴퓨터에서 실행

설치

SonarQube MCP Server

Analyze code quality and security with SonarQube Server or Cloud directly in AI assistants.

제작자: SonarSource·성장 중·★ 686·3일 전 업데이트

내 컴퓨터에서 실행

설치

제작자의 README

claude mcp add --transport http tanod https://tanod.dev/mcp

{ "mcpServers": { "tanod": { "url": "https://tanod.dev/mcp" } } }

{ "servers": { "tanod": { "type": "http", "url": "https://tanod.dev/mcp" } } }

npx -y tanod-mcp

claude mcp add tanod -- npx -y tanod-mcp

claude mcp add tanod -e TANOD_PRIVATE_KEY=0x... -e TANOD_MAX_USD_PER_DAY=0.50 -- npx -y tanod-mcp

{

{

{