# approval-guardian 🛡️

**Find the token approvals draining your wallet — and get the revoke calldata.**

`approval-guardian` is an [MCP](https://modelcontextprotocol.io) server **and** a pay-per-call [x402](https://x402.org) HTTP API. Give it a wallet `address + chain` and it returns a **CLEAN / REVIEW / AT_RISK** verdict listing every active ERC-20 approval, worst first, with the exact `approve(spender, 0)` calldata to revoke each one.

Unlimited token approvals are the **#1 way DeFi wallets get drained** — a single bad `approve()` lets a spender move your entire balance of that token, forever, in one transaction.

> ⚠️ **Read-only risk screen, not financial advice.** approval-guardian never holds a key and never moves funds. Revoking is a transaction **you** sign. Absence of findings is not proof of safety.

## Why it exists (the moat)

To know what a wallet has *approved*, an agent that "just reads the chain" must:

1. Pull **every** ERC-20 `Approval` log the wallet ever emitted (paginated `eth_getLogs` with the right `topic0` + owner topic, respecting per-RPC block-range caps).
2. For each `(token, spender)` pair, read the **LIVE** `allowance()` — because a later `approve(0)` or a spend may have changed it. Stale logs lie.
3. Read each token's `decimals`/`symbol` to turn a raw allowance into a human amount.
4. **Classify the spender**: is it a contract at all? a plain wallet (EOA)? an **EIP-1967 upgradeable proxy** whose code can be swapped behind your approval? a recognised router/permit/locker?
5. Score the blast radius and order the revokes.

`approval-guardian` batches all of that over public RPCs and returns one prioritized report. That live aggregation — not a static answer — is what an agent pays for.

## What it catches

| | |
|---|---|
| ♻️ **Live allowances** | only approvals with `allowance > 0` *right now* count — stale Approval logs are filtered out |
| 👻 **EOA spenders** | approving a token to a plain wallet (not a contract) is the signature of a drainer phishing scam — flagged **critical** |
| ♾️ **Unlimited** | infinite (`2^256-1` / `2^96-1`) allowances stay exploitable forever, in one call |
| 🔗 **Upgradeable** | spender is an EIP-1967 proxy whose implementation can be replaced |
| ✅ **Known routers** | recognises Uniswap / Permit2 / 1inch / 0x / PancakeSwap so you aren't scared off safe infra |
| 🧾 **Revoke calldata** | every finding ships the exact `approve(spender, 0)` calldata to sign |

## Use as an MCP server (free)

```json
{
  "mcpServers": {
    "approval-guardian": { "command": "npx", "args": ["-y", "approval-sentinel-mcp"] }
  }
}
```

Tools:
- **`check_approvals`** — full approval-risk report. Params: `chain`, `wallet`, `deep` (optional, full history).
- **`revoke_plan`** — just the ordered list of risky approvals + revoke calldata. Params: `chain`, `wallet`, `minRisk`.

Or connect over HTTP at `POST /mcp`.

## Free HTTP API

```
GET /check?chain=base&wallet=0xYourWallet
GET /check?chain=ethereum&wallet=0x...
```

Returns the active approvals worst-first, each with `revokeCalldata`.

## Pay-per-call (x402)

The `/pro/*` routes are gated by [x402](https://x402.org). Your agent pays **$0.20 USDC** per call automatically — no sign-up, no API key. The pro scan covers **full on-chain history**; settles on-chain (Base) to the operator wallet.

```
GET /pro/check?chain=base&wallet=0x...        # 402 → pay → deep report
GET /pro/revoke_plan?chain=base&wallet=0x...
```

## Chains

Ethereum · Base · BSC · Polygon · Arbitrum — all via public, key-free RPCs.

## Part of the guardian set

[npm-guardian](https://github.com/Baneado98/npm-guardian) · [contract-auditor](https://github.com/Baneado98/contract-auditor) · [rug-check](https://github.com/Baneado98/rug-check) · **approval-guardian**

---

Source & docs: github.com/Baneado98/approval-guardian · MIT