Phantomoperator

io.github.normancomicsPublished by GitHub account normancomicsv1.1.0Updated Oct 29, 2026

Authorized privacy and exposure checks for people and agents; USDC on Base via x402.

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingFinanceSecurity & Monitoring

Overview

AI-generated overview

Paid privacy and exposure analysis service: audits URLs, identities, emails and wallets for leaks, breaches and OPSEC risk.

What you can do
  • Audit a web page's HTTP headers, meta tags, comments and third-party trackers for metadata leaks
  • Search the public web for PII tied to an authorized name and score overall OPSEC exposure with graded mitigations
  • Check an email against breach intelligence and optionally run a k-anonymity password-range check
  • Decode Monero addresses and review Base/EVM wallet hygiene and deanonymization signals
  • Draft reviewable data-broker removal requests and caller-ID unlisting or spam-label dispute steps
  • Bundle the checks into combined privacy sweeps, red-team dossiers and organization-level retainer packages
When to use it
Use it when you need a structured, repeatable privacy or exposure assessment of assets you own or are expressly authorized to assess, such as your own site, email, wallet or phone number, or when you want a single combined report across several of those vectors.
Requirements
A remote MCP endpoint over streamable HTTP; no local install. Every tool is paid per call in USDC on Base mainnet through x402, so an x402-compatible client with a funded Base wallet is needed; an unpaid request returns HTTP 402. The optional Monero payment rail is disabled by default.
Before you install
Each call costs real money, from $0.05 up to $25.00 USDC, and payments are signed by your client, so set spending limits. Only submit targets you own or are authorized to assess; the service explicitly forbids sending seed phrases, passwords, API keys or other secrets. Submitted URLs, identities, emails and wallets go to a third-party service. Removal and unlisting tools only draft requests and do not submit them.

Installation

In SourceWeft

  1. Open Phantomoperator in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.normancomics%2Fphantomoperator/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "phantomoperator": {
      "type": "http",
      "url": "https://freysaai.freysa.dev/mcp"
    }
  }
}

README

PhantomOperator

[Live service] [x402] [MCP] [A2A] [ERC--8004] [License]

PhantomOperator is a pay-per-call privacy and public-exposure analysis service for authorized users and AI agents. It provides structured checks for web metadata leakage, public-web exposure, breach indicators, privacy posture, and wallet hygiene.

Authorization required: Only assess URLs, identities, email addresses, wallets, and systems you own or are expressly authorized to assess. Do not submit seed phrases, passwords, API keys, or other secrets.

Live service

Service: https://freysaai.freysa.dev

Source: github.com/normancomics/PhantomOperator

Updates: @phntmop on X

ResourceURL
Human landing page/
Agent quickstart/quickstart
Free illustrative report/sample-report
Free Monero address-decoding previewPOST /demo/monero-decode
OpenAPI 3.1/openapi.json
MCP endpoint/mcp
x402 discovery/.well-known/x402
A2A agent card/.well-known/agent-card.json
ERC-8004 registration/.well-known/agent-registration.json
LLM guide/llms.txt
Aggregate service telemetry/usage
Service status/status
Terms and scope/terms

Payments

Working paid rail: Base USDC via x402

Paid routes at POST /skills/* use x402 v2 exact payments.

FieldValue
NetworkBase mainnet, eip155:8453
AssetUSDC on Base
USDC contract0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913
Payment receiver0xC5f20C3Ad7B730B34620ecF39c2C5681482A6Cd6
Production facilitatorCoinbase CDP x402
ERC-8004 agent821239
ERC-8004 identity registry0x8004A169FB4a3325136EB29fA0ceB6D2e539a432

An unpaid valid request receives HTTP 402 Payment Required. An x402-compatible client signs the stated payment requirement and retries the same request. Never send a plain ERC-20 transfer as a substitute for the x402 payment credential.

Optional privacy rail: Monero invoices

A production Monero flow is included but is disabled by default. It requires a privately reachable, view-only monero-wallet-rpc, a fixed XMR/USD quote configuration, and a local proof secret. Once configured, a client:

  1. requests POST /billing/monero-quote with { "skillId": "metadata-audit", "input": { ... } };
  2. receives a unique wallet subaddress, exact atomic-XMR amount, expiry, and status URL;
  3. pays the amount, then polls GET /billing/monero-invoice/:invoiceId until required confirmations are reached;
  4. retries the requested skill with X-Payment-Method: monero and the returned X-Payment proof.

The service uses the view-only wallet RPC only to allocate subaddresses and verify incoming confirmed amounts. It never needs a Monero spend key. Configuration names are documented in .env.example.

Available operations

The canonical schemas, payment requirements, and examples are generated at /openapi.json. Prices are denominated in USDC and may be read from that document before payment.

OperationWhat it doesBase x402 price
metadata-auditReviews public HTTP headers, HTML metadata/comments, and third-party trackers for exposure signals.$0.05
threat-scanSearches public-web results for potential PII exposure associated with an authorized identity.$0.10
breach-checkChecks an email against available breach intelligence and optionally performs a k-anonymity password-range check.$0.10
opsec-scoreProduces a structured public-exposure score and prioritized mitigations.$0.25
monero-opsec-auditDecodes a supplied Monero address and returns privacy-posture guidance.$0.25
data-removalIdentifies supported broker-removal paths and drafts a removal request; it does not submit requests without explicit authorization.$0.50
spam-caller-removalPrepares official caller-ID unlisting and spam-label dispute steps; it does not submit requests.$0.10
wallet-opsec-auditReviews public Base/EVM wallet hygiene signals.$0.50
full-privacy-sweepCombines relevant authorized checks into one report.$1.00
cypherpunk-redteam-dossierCombines multiple authorized assessment modules.$5.00
sovereign-opsec-retainerProduces an organization-level authorized assessment package.$25.00

Agent quickstart

  1. Fetch /openapi.json, /.well-known/x402, or /mcp.
  2. Validate that the target and submitted information are authorized and non-sensitive.
  3. Call the selected POST /skills/<operation> route with valid JSON.
  4. On 402, inspect the returned x402 requirement and retry using an x402-compatible Base-USDC client.
  5. Validate the returned JSON against the published operation schema.

For MCP clients, send JSON-RPC 2.0 initialize, tools/list, and tools/call requests to POST /mcp. The paid-tool handoff returns the exact HTTP route and payment guidance.

Local development

bash
npm installcp .env.example .envnpm testnpm start

The server defaults to port 3000. Set PUBLIC_BASE_URL to the deployed HTTPS origin and use a protected .env file. See .env.example for non-secret configuration names. Do not commit credentials, payment keys, private keys, or customer data.

Deployment and discovery

The public service publishes OpenAPI, x402, A2A, ERC-8004, MCP, llms.txt, robots, and sitemap discovery documents. Its current distribution work includes ERC-8004, MPPScan, Global A2A Registry, Agent Tools, 402 Index, Coinbase Bazaar, and a Bankr skills pull request. A directory is only described as listed after acceptance is verifiable; indexes may crawl asynchronously.

Privacy and telemetry

/usage displays aggregate settled-service telemetry. It intentionally excludes request bodies, raw IP addresses, customer wallets, and payment credentials. See TERMS.md for the service scope and limits.

License

MIT.

Source: README.md at commit 9f6b442

Tools

11

metadata-audit

Fetch any HTTP/HTTPS URL and extract metadata leaks (HTTP headers, meta tags, HTML comments, third-party trackers). Costs $0.05 USDC on Base via x402.

Parametersurlrequired

threat-scan

Search the public web for mentions of a person's name containing exposed PII (phone numbers, emails, SSNs, home addresses). Costs $0.10 USDC on Base via x402.

ParametersfullNamerequired

breach-check

Keyless email breach intelligence check (XposedOrNot + HIBP) and optional k-anonymity SHA-1 password check. Costs $0.10 USDC on Base via x402.

Parametersemailrequiredpassword

opsec-score

Multi-vector OPSEC exposure score (0–100, grade A–F) across public web search, data brokers, paste sites, and social profiles. Costs $0.25 USDC on Base via x402.

ParametersemailhandlefullName

monero-opsec-audit

Cryptonote Base58 + Keccak-256 Monero ($XMR) address/subaddress decoder (Spend Key, View Key, checksum), live Monero RingCT telemetry, EVM <-> $XMR swap correlation check, and MMR proof. Costs $0.25 USDC on Base via x402.

ParameterstxHashnodeModeevmAddressxmrAddressswapAmountXmr

data-removal

Matches an authorized data-broker listing with supported removal paths and drafts a reviewable CCPA/GDPR-style request. Does not submit a removal without explicit authorization. Costs $0.50 USDC on Base via x402.

ParameterslinkrequiredfullName

wallet-opsec-audit

On-chain Base/EVM wallet deanonymization & hygiene audit + deterministic $XMR settlement subaddress. Costs $0.50 USDC on Base via x402.

ParameterswalletAddressrequired

full-privacy-sweep

Combines authorized public-exposure, privacy scoring, and removal guidance into one structured report. Costs $1.00 USDC on Base via x402.

ParametersemailhandlefullNamerequiredwalletAddress

cypherpunk-redteam-dossier

Comprehensive 6-operator Cypherpunk Red-Team Dossier (Web Metadata + OSINT Threat Scan + Breach Check + OPSEC Score + EVM Wallet Hygiene + $XMR Monero Audit + MMR Attestation). Costs $5.00 USDC on Base via x402.

ParametersurlemailfullNamexmrAddresswalletAddress

sovereign-opsec-retainer

Enterprise & DAO Zero-Trace OPSEC Retainer Package with $XMR Atomic-Swap Treasury Isolation Blueprint and Statutory Takedown Binder. Costs $25.00 USDC on Base via x402.

ParametersurlemailxmrAddressorganizationwalletAddress

spam-caller-removal

Prepare official caller-ID unlisting and spam-label dispute steps for an authorized phone number. Does not submit requests. Costs $0.10 USDC on Base via x402.

ParametersproviderauthorizedrequiredphoneNumberrequired

Version history

1
  1. v1.1.0LatestOct 29, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.