Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@crypto-link-check check if https://phantorn.app is a fake Phantom wallet site"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Is that MetaMask / Phantom / Ledger / exchange link real? Check it before you (or your agent) connect a wallet or sign anything.
October 2026 alone brought fake Phantom, Jupiter and Bitget browser extensions, a hijacked NGRAVE push alert that sent users to a seed-phrase page, and exchange phishing mails. AI agents can now trade from exchange accounts and pay for things on their own, so they click links too. This tool gives them (and you) a quick, read-only second opinion.
Free, offline: CLI and MCP server that compare a link with the official domains of ~60 wallets, exchanges and dapps and flag lookalike characters (0/o, rn/m, Cyrillic), typosquats, punycode, free hosting and bait words like "claim" or "sync".
Free API + remote MCP: https://crypto-link-check.nextill-pos.workers.dev
Paid full check (optional, 0.005 USDC via x402 on Base): adds domain registration age (RDAP), DNS, redirect tracing and one fetch of the page scanned for seed-phrase prompts and token-approval drainer code. 1-10 URLs per call.
It never asks for keys or seed phrases. Verdicts are heuristics, not guarantees.
npx devx-link-check phantorn.app metamask.io
# verdict: dangerous phantorn.app
# [danger] phantorn.app spells the official phantom.app with lookalike characters ...
# verdict: official metamask.ioExit code: 0 official / no red flags, 2 caution / suspicious / dangerous, 1 error. --json for machine output.
Related MCP server: onchain-forensics
Local (stdio), runs offline:
{ "mcpServers": { "crypto-link-check": { "command": "npx", "args": ["-y", "devx-link-check", "mcp"] } } }Remote (streamable HTTP, no key): https://crypto-link-check.nextill-pos.workers.dev/mcp
Tools: check_crypto_link(url) and full_report_info().
Route | Price | What |
| free | lexical verdict + findings |
| 0.005 USDC (x402 v2 | full check, 1-10 URLs |
| free | the official-domain list we use |
| free | discovery |
The paid route answers 402 with a PAYMENT-REQUIRED header; any x402 client can pay. Settlement happens only after the report is produced. Humans can pay from a browser wallet on the web page. Terms: /terms.
Verdicts: official, no_red_flags, caution, suspicious, dangerous. Same-name-different-TLD domains are only caution because the brand may own them.
cli/src/brands.js. It is curated by hand and incomplete. PRs that add brands or official domains (with a source) are welcome.
cli/: npm package devx-link-check (CLI + stdio MCP)
worker/: the Cloudflare Worker behind the hosted API
MIT. Made by DevX. Contact madebydevx@gmail.com.
Related free tool: 7702 Sweeper Check — is a sweeper on your wallet?
This server cannot be deployed
Read-only crypto safety: token honeypot checks, EIP-712 signature decode, approval scans.
Free crypto scam checks: token and contract risk, scam or sanctioned addresses, phishing links.
Crypto transaction safety tool — screens addresses and transactions for scam risk.
Crypto scam checks (tokens, sites, wallets), chain reads, web page to Markdown, email checks.