Lumen Pre-Sign Check

io.github.Dansgit2bPublished by GitHub account Dansgit2bv1.4.0Updated Nov 7, 2026

Use before signing an EVM tx or EIP-712 message: risk flags + verdict. Informational, no simulation

The publisher's own server: check.tattoo: tattoo size and placement guide

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingFinanceSecurity & Monitoring

Overview

AI-generated overview

Remote MCP server that explains EVM transactions and EIP-712 messages before signing, plus paid public-data lookups.

What you can do
Exposes tools such as explain_before_sign, eip712_decode, calldata_decode, x402_lint, evm_address_lookup, domain_lookup, web_markdown, url_unfurl, pubmed_search, arxiv_search, sec_filings, weather_forecast and polymarket_markets. The pre-sign check returns a summary, risk flags and a verdict of looks_ok, review or do_not_sign_unless_intended. It is informational only, with no simulation, and looks_ok does not mean safe.
When to use it
Useful when an assistant is about to sign an EVM transaction or EIP-712 message and you want a quick risk read before approving. Also handy for decoding calldata, checking addresses or domains, and pulling public research, filing, weather or market data.
Requirements
Remote streamable HTTP endpoint; no signup or API keys declared. Free tier is 20 calls per hour per IP; beyond that, paid calls cost 0.001–0.002 USDC per call on Base mainnet via x402, with optional Celo support when X402_CELO_API_KEY is set. Network access required.
Before you install
Paid calls spend USDC on Base mainnet through x402; the free tier is limited to 20 calls per hour per IP. The pre-sign verdict is informational, not a security guarantee, and no simulation is performed. Payment-safety inputs that look like private keys are rejected. Stats are anonymous aggregates; the waitlist is stored in memory and may be lost on restart.

Installation

In SourceWeft

  1. Open Lumen Pre-Sign Check in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.Dansgit2b%2Flumen-presign-check/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "lumen-pre-sign-check": {
      "type": "http",
      "url": "https://lumenworks-x402-decoder.onrender.com/mcp/presign"
    }
  }
}

README

Lumen Works Agent API (x402)

Two listings on one origin:

  • Lumen Pre-Sign Check: POST /v1/tx/explain ($0.002). Use before signing any EVM transaction or EIP-712 message; returns {summary[], flags[], verdict} with looks_ok | review | do_not_sign_unless_intended. Agent policy: abort on do_not_sign_unless_intended, escalate review. Informational, not a security guarantee; looks_ok does not mean safe; no simulation. Accuracy set and known limits: ACCURACY.md. MCP: /mcp/presign.
  • Lumen Agent Utilities: every other route below. MCP: /mcp.

Trust terms: no signup; free tier 20 calls/hour/IP under /v1/free/...; GET/HEAD on any paid path returns the 402 quote (it never settles); not charged when a call errors, because the x402 middleware settles only after the handler returns a status below 400. Input schemas and real example outputs (examples.json, captured live by test/capture-examples.mjs) are in each route's Bazaar extension and in /openapi.json, validated with node test/validate-bazaar.mjs <base>.

Stats: /v1/stats has anonymous aggregates only (UA family, daily unique counts from salted daily-rotating IP hashes, 30-day retention). They persist across deploys when STATS_GIST_ID + STATS_GIST_TOKEN (a gist-only token) are set; otherwise they are kept in memory.

Pay-per-call agent utilities, 0.001–0.002 USDC per call on Base mainnet via x402 (exact scheme, PayAI public facilitator). Author: Dan (Dansgit2b). Early-stage, unaudited.

Endpoint (POST JSON)What
/v1/x402/lint {header}decode + lint x402 PAYMENT-REQUIRED/SIGNATURE/RESPONSE
/v1/eip712/decode {typedData}domain separator, digest, risk notes
/v1/calldata/decode {data, signature?}selector, openchain/4byte lookup, decoded args
/v1/web/markdown {url, fullPage?, maxChars?} — $0.001public page → clean Markdown (Readability) + metadata. No JS rendering.
/v1/web/unfurl {url} — $0.001final URL, status, title, description, OG image, canonical, favicon
/v1/evm/address {address} (0x or ENS) — $0.002Ethereum+Base: ENS + records, EOA/contract/7702, balances, USDC/USDT, ERC-20 info (public RPC)
/v1/domain/lookup {domain} — $0.002DNS (DoH) A/AAAA/MX/NS/TXT/CAA, SPF/DMARC, RDAP registrar/created/expiry, age

Free tier: same paths under /v1/free/... (20/hour/IP). Discovery: /, /.well-known/x402, /openapi.json, /llms.txt. payTo: 0xee9790cB3960952F585379F831a89b4e00B4029A.

End-to-end proof (local run, 2026-10-10): paid call settled on Base, tx 0xff4af45df7caeef958b77700e96ba94e5ed37d3bac6e8cf40d6528a9497d77d4.

Deploy: Render (render.yaml, free plan) or any Docker host (Dockerfile). Set PUBLIC_BASE to the public origin. No secrets needed (server only receives payments). License MIT.

MCP server

Remote MCP (streamable HTTP, stateless JSON): https://lumenworks-x402-decoder.onrender.com/mcp, with tools x402_lint, eip712_decode, calldata_decode, web_markdown, url_unfurl, evm_address_lookup and domain_lookup. Free tier: 20 tool calls/hour/IP. After that the tool returns the x402 payment requirements for the matching paid HTTP endpoint (0.001–0.002 USD).

Celo

When X402_CELO_API_KEY (from the x402.celo.org dashboard) is set, every paid route also accepts USA₮ and USDC on Celo (eip155:42220), settled through Celo's hosted facilitator at api.x402.celo.org.

Free x402 payment safety check

POST /v1/x402/safety-check (MCP tool x402_payment_safety_check) — deterministic pre-payment check. Body: {url?, method?, payment_required?, expected_pay_to?, expected_network?, max_price_usdc?, listed_price_usdc?, facilitator_url?, client_config?}. We fetch the unpaid 402 (SSRF-guarded) and return ok | review | do_not_pay with checks: HTTPS/health/latency, payTo validity/checksum/mismatch, unknown asset/network, price vs your cap and the listed price, timeout/replay window, multiple payTo, unknown facilitator, missing spend caps / idempotency in your client config. Nothing is stored; inputs that look like private keys are rejected. 30/hour/IP.

Planned (not built): continuous monitoring with alerts on price/payTo/asset changes. Free waitlist: POST /v1/monitoring/waitlist {endpoint_url, contact?} (5/hour/IP). No date promised; stored in memory/logs only on a free host, so it may be lost on restart.

Stats

GET /v1/stats — anonymous in-memory counters since last restart: calls per endpoint, unpaid 402s vs paid settlements (conversion), coarse user-agent buckets. No IPs or bodies stored.

v1.3: explain-before-you-sign + public-data tools

Endpoint (POST)PriceMCP toolUpstream (free, no key)
/v1/tx/explain0.002explain_before_signcalldata (openchain/4byte) + EIP-712, risk flags
/v1/pubmed/search0.001pubmed_searchNCBI E-utilities
/v1/arxiv/search0.001arxiv_searcharXiv API
/v1/sec/filings0.001sec_filingsSEC EDGAR (set SEC_USER_AGENT with a contact email per SEC policy)
/v1/weather/forecast0.001weather_forecastOpen-Meteo (CC BY 4.0)
/v1/polymarket/markets0.001polymarket_marketsPolymarket Gamma (read-only data)

Free tier: /v1/free/<path> or MCP, 20 calls/hour/IP.

Facilitators

If CDP_API_KEY_ID and CDP_API_KEY_SECRET are set, Coinbase's CDP facilitator is used first. Settlements through it are what get the service indexed in the x402 Bazaar. The PayAI facilitator stays registered as the fallback. Without CDP keys, PayAI handles everything, as before.

Source: README.md at commit ca7a52f

Tools

0
SourceWeft has not read this server's tools yet.

Version history

1
  1. v1.4.0LatestOct 10, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Check integrations

check.tattoo: tattoo size and placement guide

tattoo.checkOfficial publisher

check.tattoo: tattoo size and placement guide's hosted MCP server, published by check.tattoo; no sign-in required; Streamable HTTP; 5 tools.

Streamable HTTPWeb executable
5 toolsOct 24, 2026

iva.pt — EU VAT check (VIES) and Portuguese VAT law

pt.ivaOfficial publisher

Validates EU VAT numbers against VIES and returns Portuguese VAT Code (CIVA) and RITI articles, in Portuguese or English.

Streamable HTTPWeb executable
Business & Commerce4 toolsOct 30, 2026

Dirtsmith Evidence Quote Check

Published by GitHub account throttler300

A local MCP server that binds an assistant's citations to admitted source text with spans and can reject stale-hash references.

STDIODesktop only
Knowledge & Memory1 toolNov 7, 2026

HTTP Header Policy Check — HSTS, CSP & Frame Declarations

Published by GitHub account kriton-dev

Remote Apify-hosted MCP server that lets an assistant check seven declared HTTP security header families on a site, without returning raw header values.

Streamable HTTPWeb executableAuth
Security & MonitoringCredential requiredNov 7, 2026

VOOPA Render Check

Published by GitHub account Voopa-Corp

Reviews a completed AI-generated video against its brief and recommends whether to edit, retry once, or change approach before paying for another render.

Streamable HTTPWeb executable
AI & ML2 toolsNov 7, 2026