Bunker is an offline scanner for crypto addresses. You paste your addresses. The tool shows which addresses show their public key to the world. Then it gives you a calm plan, step by step, to hide what you can.
The tool runs only on your device. It does not connect to a wallet. It does not send or store anything. It knows more than 100 networks. It works in English and Spanish, for people and for AI agents.
Safety first. Bunker needs only your public addresses. Do not paste a seed phrase or a private key into this tool or into any other website. The tool blocks secrets if you paste them by mistake.
Related MCP server: chain-signer
I see AI advancing at an alarming rate. AI models now solve math problems that stayed open for decades. The signatures that protect most crypto wallets depend on math problems that nobody has solved yet. Nobody has broken them today. But I do not want to wait for the day that someone does. Crypto needs extra security now.
The first step is simple: keep your funds on addresses whose public key the world has never seen. Most people do not know which of their addresses show the public key. Bunker gives that answer in about 30 seconds, with a plan to fix what you can.
Carlos A. Paredes Vargas, founder of NosisTech
Read docs/01-background.md for the full story.
You do not need to install anything.
Open https://bunker.nosistech.com, or use the file on your own computer:
Download the file from https://bunker.nosistech.com/nosis-bunker.html. On GitHub, open dist/nosis-bunker.html and select the download icon ("Download raw file").
Optional: examine the file hash (see below).
Double-click the file. It opens in your web browser. If Windows asks which app to use, pick your browser.
Paste your addresses, one on each line. You can put a label after a space.
Select Scan addresses.
For each address that asks, answer the question: "Has it ever sent a transaction or signed a message?"
Read the plan next to the results. Select Copy plan or Print to keep it.
The tool works with no internet connection. You can turn on airplane mode before you open the file.
The hash proves that your file is the same as the file in this repository.
Open your Downloads folder in File Explorer. Right-click an empty area and select Open in Terminal.
Type this command and press Enter:
Get-FileHash .\nosis-bunker.html -Algorithm SHA256Compare the result with the value in dist/SHA256SUMS.txt or at https://bunker.nosistech.com/SHA256SUMS.txt. The two values must be the same. Letter case does not matter.
On macOS or Linux, use shasum -a 256 nosis-bunker.html.
Use the EN / ES switch and the sun or moon button at the top. The page starts in the language and the color theme of your system. It saves nothing, so a new visit starts from your system settings again. To open the page in Spanish, use https://bunker.nosistech.com/#es.
The same engine is available to AI agents in two local forms. Both run offline, read only, and need Node.js 22.23.4, 24.22.1 or 26.12.1, or a newer release of the same line (24 is the tested one). Get the code with git clone https://github.com/nosistech/nosis-bunker.git. There is no install step.
Command line (JSON):
node cli/bunker.js --json addresses.txt
cat addresses.txt | node cli/bunker.js --json --lang es
node cli/bunker.js --networksMCP server (Claude Desktop, Claude Code, Cursor and other MCP clients):
{
"mcpServers": {
"bunker": { "command": "node", "args": ["C:\\path\\to\\nosis-bunker\\mcp\\server.js"] }
}
}Tools: scan_addresses and list_networks. The website also has /llms.txt and /networks.json. Read docs/10-agents.md for the details, the JSON shape and the security rules.
You paste these three lines:
bc1p5cyxnuxmeuwuvkwfem96lqzszd02n6xdcjrs20cac6yqjjwudpxqkedrcr Ordinals
bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4 Savings
0x5aAeb6053F3E94C9b9A09f33669435E7Ef1BeAed Daily walletThe tool shows:
Address | Result | Why |
| Lock visible | A Taproot address contains the public key. |
| Check needed | The key stays hidden until the address spends. You answer "No", so the result becomes Lock hidden. |
| Check needed | You answer "Yes" because you used it. The result becomes Lock visible. |
The plan then says: move the daily wallet funds to a new account that only receives. Keep the inscriptions on Taproot until Bitcoin activates BIP-360. Keep the savings address hidden.
Result | Meaning | What to do |
Lock visible | The public key is on chain or in the address. | Move to a hidden address type if the network has one. |
Check needed | The key is hidden until the address sends or signs. | Answer the question on the card. |
Lock hidden | The key has never been shown. | Use this address only to receive. |
Hash-protected | The address type has no curve key (for example BIP-360). | Nothing. |
Ask your provider, Check your pool | A permissioned network, such as Canton, or a Zcash unified address, whose pool decides the risk. | Ask the operator the questions in the plan, or check the pool. |
Shows every key | An extended public key (xpub). | Stop sharing it with apps and trackers. |
Not rated | A typo, a test network, a contract, or an unknown format. | Read the note on the card. |
You need Node.js 22.23.4, 24.22.1 or 26.12.1, or a newer release of the same line (24 is the tested one). Older versions and the odd-numbered lines (23, 25) have known security flaws or no security fixes, and the build tools stop on them. The CLI and the MCP server only warn. The project has no other dependencies.
Install Node.js LTS from https://nodejs.org. Use the default options.
Open the project folder in File Explorer.
Right-click an empty area and select Open in Terminal.
Type node --version and press Enter. The result must be v24.22.1 or a newer 24 release.
Type npm test and press Enter. All tests must pass.
Type npm run build and press Enter. The tool writes dist/nosis-bunker.html and the website folder site/.
Command | What it does |
| Runs all tests ( |
| Checks the Node.js version, then builds |
| Version check, build, tests and the writing check together. |
| Opens every explorer link once. This command uses the internet. |
Read docs/08-testing.md to learn how to read the test results.
nosis-bunker/
dist/ the built page (one file) and its SHA-256 hash
site/ the website for bunker.nosistech.com (made by tools/site.js)
assets/ social preview source and PNGs (ADR-031)
src/
core/ hashes and encodings: SHA-256, SHA-512/256, Keccak, BLAKE2b, Base58, Bech32, ...
networks/ one small detector for each network family
index.js the detector pipeline and its order
model.js the exposure model and the card status rules
chains.js network names and verified explorer links
guard.js the secret guard (seed phrases and private keys)
classify.js one address in, one result out
parse.js the input box in, a list of results out
advice.js, plan.js the bunker plan
explorer.js safe explorer links
i18n/ English to Spanish
agent/ the JSON report for the CLI and the MCP server
ui/ the page: template.html, styles.css and the page modules
cli/ command-line tool for people and agents (JSON output)
mcp/ MCP server for AI agents (stdio)
audit/ accessibility audit script (manual release step)
tools/ build, website, files for agents, Node.js version gate, writing check, link check
test/ tests and real address fixtures
docs/ all documentation
deploy/ Caddy configuration for a VPSEvery core, network and pipeline module is less than 100 lines. Read docs/04-architecture.md for the data flow.
Document | Content |
Why the tool exists, the sealed-box idea, and examples. | |
The five steps from input to plan. | |
Every network, its format, its rule and its checksum. | |
Modules, data flow, and how to add a network. | |
The story of the build and the main choices. | |
Each problem, the options, and the fix. | |
Design choices for the page. | |
What the tests prove and how to run them. | |
The words in this project. | |
31 decisions, each with two or more options. | |
OWASP mapping, threat model, supply chain and hosting. | |
The CLI, the MCP server, llms.txt and the JSON report. | |
WCAG 2.2 AA target, test method and results. | |
The writing rules that the docs follow. |
The story of the build, in 13 articles on nosistech.com. Read them in this order.
Which of Your Crypto Addresses Show Their Public Key? Bunker Answers in 30 Seconds
Bitcoin, Ethereum, Solana and 100 More: How Each Network Shows the Public Key
From Pasted Text to a Plan: Inside the Five-Step Engine of Bunker
One Wrong Character: How Bunker Catches Typos in Crypto Addresses
Never Paste a Seed Phrase: How Bunker Blocks 19 Kinds of Secrets
A Web Page That Cannot Send Your Data: The Browser Security of Bunker
Zero Dependencies: How Bunker Keeps Outside Code Out of the Build
Taproot, Zcash, Canton and Shared Formats: The Hard Cases in Bunker
Bunker for AI Agents: A Local CLI and MCP Server With No Web API
Designing Bunker for Phones, Screen Readers and Two Languages
The Bunker Build Log: 46 Problems Fixed and 30 Decisions Recorded
Bunker Against the OWASP MCP Top 10: One Local Server, Checked Item by Item
Read SECURITY.md. In short:
The page has a strict Content Security Policy with script and style hashes. It blocks all network connections.
The code uses no innerHTML and no eval. Tests fail the build if this changes.
The project has zero dependencies. The CI uses no third-party actions.
The build tools run only on a patched Node.js, and the CLI and the MCP server warn on one. CI installs an exact Node.js build and checks its hash. See supply chain.
The website is a prebuilt folder. The host runs no build. See hosting.
Bunker is free so that as many people as possible can use it. If you use it, host it, build on it or show its results, please give credit:
Bunker by NosisTech (https://bunker.nosistech.com)This is a request, not a condition. When you redistribute the code, the license requires a copy of the license, the NOTICE text and a note in changed files, and nothing more. The CLI, the MCP server and the plan text include this credit, so it travels with the results.
Apache License 2.0. Copyright 2026 NosisTech LLC. Created by Carlos A. Paredes Vargas. See LICENSE and NOTICE.
You can use, copy, change and sell this tool. If you redistribute it or a work based on it, you must keep the text of the NOTICE file, which names the author. The license gives no right to use the names "Bunker by NosisTech" or "NosisTech", except to say where the code comes from (section 6). Do not present a changed copy as the official version.
Bunker is an educational tool. It is not financial, legal or security advice. It has no warranty. Examine each address on a block explorer and send a small test amount before you move funds.
List the networks that Bunker knows, with the meaning of each exposure model. Runs offline.
Inputs: no named parameters. Returns: note, models, networks, attribution, +1 more
Classify public crypto addresses (more than 100 networks, with checksum validation) and report whether each one exposes its public key. Returns a summary, one result for each address, and an ordered plan. Runs offline. Input: public addresses only, one per line, an optional label after a space. Never pass seed phrases or private keys: they are rejected.
Inputs: lang, text, answers, addresses. Returns: ok, plan, error, results, +5 more
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 2 tools
list_networks and scan_addresses serve clearly separate purposes: one enumerates supported networks and exposure-model semantics, the other classifies specific addresses. There is no plausible confusion between discovery/metadata and address scanning.
Both tools use a consistent snake_case verb_noun pattern (list_networks, scan_addresses). The convention is uniform and readable.
Two tools is slightly thin by general MCP standards, but it fits this narrow offline utility: one tool for network/exposure-model discovery and one for the core scanning operation. Nothing extraneous is present.
The pair covers the core workflow: listing networks with exposure-model meaning and scanning addresses with per-address results and an ordered plan. Minor gaps exist, such as no standalone single-address lookup or per-network detail tool, but users can accomplish the main task.
Before sending crypto, check the recipient for address poisoning: lookalikes and bad checksums
Crypto transaction safety tool — screens addresses and transactions for scam risk.
Search no-KYC exchanges, swaps, wallets and VPNs with privacy and safety grades.
Safety checks before you sign, pay or install: contract, token and package scans, phishing, OFAC.