io.github.devx-agentPublished by GitHub account devx-agentv1.1.0Updated Nov 6, 2026
Before sending crypto, check the recipient for address poisoning: lookalikes and bad checksums
The publisher's own server: check.tattoo: tattoo size and placement guide
Read-only MCP server that checks a crypto recipient address for address-poisoning lookalikes and bad EIP-55 checksums before you send funds.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/io.github.devx-agent%2Faddress-poisoning-check/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Add this to your client's mcpServers config.
{
"mcpServers": {
"address-poisoning-check": {
"type": "http",
"url": "https://address-poisoning-check.nextill-pos.workers.dev/mcp"
}
}
}Is this the address you meant? Address poisoning plants a lookalike address (same first and last characters, different middle) in a wallet's history with a zero-value, dust or fake-token transfer, and waits for the owner (or their AI agent) to copy it. Bitquery counted about $76M stolen on Ethereum alone in the 12 months to July 2026.
This repo has three pieces, all read-only (we never ask for keys and never move funds):
Live: https://address-poisoning-check.nextill-pos.workers.dev
Exit code 2 on danger, so it can gate scripts and agent payment flows.
Claude Desktop / Cursor (stdio):
Or remote (streamable HTTP): https://address-poisoning-check.nextill-pos.workers.dev/mcp
Tools: check_recipient_lookalike (free), onchain_check_info (how to buy the on-chain check; does not pay).
402 with an x402 v1 body (X-PAYMENT, network base) and a v2 PAYMENT-REQUIRED header (PAYMENT-SIGNATURE, eip155:8453). Both work.0xB3cDDccEe6B150c8efFD55B961afc0Ecefe7f247, settled through the Coinbase CDP facilitator, listed in the CDP x402 Bazaar."partial": true and the scanned window stated per chain in chains[].window. It is a heuristic over a window of public data: always confirm the full address with the payee.Example (the May 2024 $68M WBTC case): from=0x1E227979f0b5BC691a70DEAed2e0F39a6F538FD5&to=0xd9A1C3788D81257612E2581A6ea0aDa244853a91 returns danger / possibly_already_poisoned: the victim did send real value to that address, but it first appeared in their history through a zero-value transfer.
OpenAPI: /openapi.json · Terms: /terms
cli/: npm package devx-address-poisoning-check (CLI + stdio MCP), npm testworker/: the Cloudflare Worker behind the hosted API (npm run build)MIT. Made by DevX · [email protected]
Source: README.md at commit 2141d56
Free, offline, read-only: before sending crypto, check whether the recipient address is a lookalike (same first/last hex characters, different middle) of any address you trust, and whether its EIP-55 checksum is valid. Address poisoning stole $76M+ in 12 months by planting such lookalikes in wallet histories.
torequiredknownHow to buy the on-chain check (scans the sender's real transfer history on Ethereum/Base/Avalanche for poisoning transfers and lookalikes) via x402 for 0.005 USDC. Does not pay.
Takes no parameters.
100% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
tattoo.checkOfficial publisher
check.tattoo: tattoo size and placement guide's hosted MCP server, published by check.tattoo; no sign-in required; Streamable HTTP; 5 tools.
pt.ivaOfficial publisher
Validates EU VAT numbers against VIES and returns Portuguese VAT Code (CIVA) and RITI articles, in Portuguese or English.
Published by GitHub account throttler300
A local MCP server that binds an assistant's citations to admitted source text with spans and can reject stale-hash references.
Published by GitHub account kriton-dev
Remote Apify-hosted MCP server that lets an assistant check seven declared HTTP security header families on a site, without returning raw header values.
Published by GitHub account Voopa-Corp
Reviews a completed AI-generated video against its brief and recommends whether to edit, retry once, or change approach before paying for another render.
npx devx-address-poisoning-check 0xd9A1C3788D81257612E2581A6ea0aDa244853a91 --known 0xd9A1b0B1e1aE382DbDc898Ea68012FfcB2853a91# DANGER: Looks like 0xd9a1...3a91 (same first 4 / last 6 hex chars) but is a different address. Classic address-poisoning lookalike.{ "mcpServers": { "address-poisoning-check": { "command": "npx", "args": ["-y", "devx-address-poisoning-check", "mcp"] } } }GET https://address-poisoning-check.nextill-pos.workers.dev/v1/check?from=0x...&to=0x...[&chains=ethereum,base,avalanche]