Skip to main content
Glama
devx-agent

devx-address-poisoning-check

Address Poisoning Check

Is this the address you meant? Address poisoning plants a lookalike address (same first and last characters, different middle) in a wallet's history with a zero-value, dust or fake-token transfer, and waits for the owner (or their AI agent) to copy it. Bitquery counted about $76M stolen on Ethereum alone in the 12 months to July 2026.

This repo has three pieces, all read-only (we never ask for keys and never move funds):

What

Cost

CLI / stdio MCP devx-address-poisoning-check

Offline: is the recipient a lookalike of any address you trust? Is its EIP-55 checksum valid? Nothing leaves your machine.

free

Remote MCP https://address-poisoning-check.nextill-pos.workers.dev/mcp

Same offline check as a hosted MCP tool

free

HTTP API GET /v1/check?from=<sender>&to=<recipient>

On-chain: scans the sender's real transfer history (Ethereum + Base, optional Avalanche) and flags lookalikes of real counterparties, zero-value / dust / fake-token poisoning transfers (with tx hashes), recipients that only ever appeared through such transfers, and senders that were already poisoned. Returns ok | caution | danger and the address you probably meant.

0.005 USDC via x402 on Base

Live: https://address-poisoning-check.nextill-pos.workers.dev

CLI

npx devx-address-poisoning-check 0xd9A1C3788D81257612E2581A6ea0aDa244853a91 --known 0xd9A1b0B1e1aE382DbDc898Ea68012FfcB2853a91
# DANGER: Looks like 0xd9a1...3a91 (same first 4 / last 6 hex chars) but is a different address. Classic address-poisoning lookalike.

Exit code 2 on danger, so it can gate scripts and agent payment flows.

Related MCP server: Cybercentry MCP Server

MCP

Claude Desktop / Cursor (stdio):

{ "mcpServers": { "address-poisoning-check": { "command": "npx", "args": ["-y", "devx-address-poisoning-check", "mcp"] } } }

Or remote (streamable HTTP): https://address-poisoning-check.nextill-pos.workers.dev/mcp

Tools: check_recipient_lookalike (free), onchain_check_info (how to buy the on-chain check; does not pay).

Paid on-chain check (x402)

GET https://address-poisoning-check.nextill-pos.workers.dev/v1/check?from=0x...&to=0x...[&chains=ethereum,base,avalanche]
  • Answers 402 with an x402 v1 body (X-PAYMENT, network base) and a v2 PAYMENT-REQUIRED header (PAYMENT-SIGNATURE, eip155:8453). Both work.

  • 5000 atomic USDC (0.005 USDC) to 0xB3cDDccEe6B150c8efFD55B961afc0Ecefe7f247, settled through the Coinbase CDP facilitator, listed in the CDP x402 Bazaar.

  • Settled only after the report is produced; bad input or data-source errors are not charged.

  • Data: Ethereum/Avalanche via the Routescan explorer API (last 300 token transfers + 150 transactions of the sender); Base via the Coinbase CDP SQL API (last 14 days of all ERC-20 transfers, including unknown/fake tokens), falling back to public RPC logs for a shorter window. Typical paid response: about 1-2 s. Data collection has a 3.5 s budget; if a source is slow you still get a report with "partial": true and the scanned window stated per chain in chains[].window. It is a heuristic over a window of public data: always confirm the full address with the payee.

Example (the May 2024 $68M WBTC case): from=0x1E227979f0b5BC691a70DEAed2e0F39a6F538FD5&to=0xd9A1C3788D81257612E2581A6ea0aDa244853a91 returns danger / possibly_already_poisoned: the victim did send real value to that address, but it first appeared in their history through a zero-value transfer.

OpenAPI: /openapi.json · Terms: /terms

Layout

  • cli/: npm package devx-address-poisoning-check (CLI + stdio MCP), npm test

  • worker/: the Cloudflare Worker behind the hosted API (npm run build)

MIT. Made by DevX · madebydevx@gmail.com

Available Tools

2 tools
check_recipient_lookalikeAInspect

Free, offline: is the recipient a lookalike (same first/last hex chars, different middle) of any trusted address, and is its EIP-55 checksum valid? Call before every transfer to a pasted or copied address.

NameRequiredDescriptionDefault
toYesrecipient you are about to pay
knownNotrusted addresses: address book, previous real payees

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description does real work: it discloses that the tool is free and offline (no network calls), explains the lookalike algorithm ('same first/last hex chars, different middle'), and mentions checksum validation. It does not describe the return shape (boolean vs. detailed result), which is a gap absent an output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence with the core check front-loaded and the call-to-action at the end. No filler; every clause adds meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter read-only check, the description covers purpose, safety profile (offline/free), and trigger condition well. The main missing piece is what the tool returns, which matters because there is no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the schema descriptions already explain 'to' as the recipient about to be paid and 'known' as trusted addresses. The description adds no parameter-specific detail beyond reinforcing the trusted-address concept already in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific check (lookalike comparison against trusted addresses) plus EIP-55 checksum validation. The 'free, offline' qualifier also helps distinguish it from the sibling onchain_check_info, though it doesn't name that alternative explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear trigger: 'Call before every transfer to a pasted or copied address.' It doesn't state exclusions or mention when to use the sibling instead, but the usage condition is concrete and actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

onchain_check_infoAInspect

How to buy the hosted on-chain check that scans the sender's real transfer history (Ethereum, Base, Avalanche) for poisoning transfers and lookalikes: x402, 0.005 USDC on Base. Does not pay.

NameRequiredDescriptionDefault

No parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose genuinely useful behavior: the price (0.005 USDC), the payment rail (x402 on Base), and the critical fact that it does not itself pay or transact. That is above-average for a financial tool. Missing is what the call actually returns (a 402 challenge, a quote, human-readable instructions) and whether calling it has any side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One dense sentence that front-loads the resource, then the purchase mechanics, then the key caveat. No filler. The compressed 'x402, 0.005 USDC on Base' fragment is terse but parseable, though slightly cryptic to an agent unfamiliar with the x402 payment scheme.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, no annotations, and no parameters, so the description is the sole source of truth. It covers cost, chain and scope but omits what the response payload looks like and how the agent should act on it, which matters for a purchase-flow tool whose entire value is the returned instructions.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters and the schema is an empty object, so there is nothing for the description to disambiguate. Baseline 4 applies; no parameter-level guidance is needed or missing.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear resource: it returns purchase information for the hosted on-chain check that scans a sender's transfer history on Ethereum, Base and Avalanche for poisoning transfers and lookalikes. It also disambiguates the action from the underlying scan by saying 'Does not pay', so an agent knows this is informational rather than transactional. It does not, however, name or differentiate itself from the sibling check_recipient_lookalike.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The clause 'Does not pay' implicitly tells the agent this endpoint provides instructions rather than executing a purchase, which is useful routing context. But there is no explicit statement of when to call this versus check_recipient_lookalike, and no indication of prerequisites or next steps after receiving the purchase instructions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 2 tool updatesv0.1.0
    • First observedcheck_recipient_lookalike
    • First observedonchain_check_info

TDQS

A3.5/5.0

Scored across 2 tools

Disambiguation4/5

The two tools do genuinely different things: one performs an offline lookalike/checksum check, the other only returns purchasing instructions. The name 'onchain_check_info' and the explicit 'Does not pay' note reduce, but do not fully eliminate, the risk that an agent calls it expecting an actual check to run.

Naming Consistency3/5

Both names are snake_case, so there is no style clash, but the patterns differ: 'check_recipient_lookalike' is verb_object while 'onchain_check_info' is a noun-phrase/prefix form. Readable, but not a predictable convention an agent can generalize from.

Tool Count3/5

Two tools is thin for a security-check server, and one of the two is purely informational rather than functional. The scope is narrow, so it is defensible, but the surface feels borderline under-built.

Completeness2/5

The free path covers only a single-address lookalike and EIP-55 check, with no batch checking, no trusted-address list management, and no offline screening against known poisoned addresses. The advertised on-chain scan is a dead end: the server exposes only purchase instructions, so an agent cannot actually execute it.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • F
    license
    Not graded
    quality
    B
    maintenance
    Enables MCP-compatible AI agents to scan crypto transactions for scam addresses, clipboard-hijack patterns, and typos, as well as report scam addresses and check usage, directly in conversation.
    -
  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables AI agents to perform pay-per-call security verification of wallets, tokens, contracts, dApps, agents, and more via a remote endpoint with no installation.
    2
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    Enables AI assistants to assess the risk of crypto wallets, tokens, and smart contracts by providing read-only on-chain analysis, 0-100 risk scoring with explanations, fund tracing, and contract inspection before interaction.
    6
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    Enables AI assistants to check whether a crypto token, link, or forwarded "gem" message is a scam by running contract rules, live test trades, creator history, and market data across 64 networks, returning plain-English or Pidgin verdicts. Also supports scanning messages, reviewing a token's past checks, and explaining individual findings.
    5
    MIT