FabTally Safe

io.github.zvmzaretsky由 GitHub 账号 zvmzaretsky 发布v1.0.0更新于 Oct 24, 2026

Read-only crypto safety: token honeypot checks, EIP-712 signature decode, approval scans.

发布方自己的服务：Tally

已验证Streamable HTTP可网页运行金融安全与监控

服务详情

标识符: io.github.zvmzaretsky/crypto-safety
传输: Streamable HTTP
运行时: Web executable
信任: Verified
发布于: Sep 16, 2026

安全提示

MCP 服务会接收对话中的工具调用请求，并可能执行外部操作。启用前请先了解该服务能做什么，并只授予它所需的权限。

注册中心已验证此条目所属的 GitHub 账号 zvmzaretsky。这并不表明该账号就是产品方。

SourceWeft 的检查只涵盖条目是否完整、端点是否响应；不审查服务器的代码，也不审查其工具的行为。

在 README 中添加徽章

向读者展示该 MCP 服务已收录于 SourceWeft，徽章链接到本页。

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.zvmzaretsky%2Fcrypto-safety.svg)](https://sourceweft.com/mcp/io.github.zvmzaretsky%2Fcrypto-safety?utm_source=readme&utm_medium=badge)

概览

AI 生成的概览

只读的加密资产安全服务器，可检查代币蜜罐风险、解析 EIP-712 签名并扫描钱包授权，帮助助手在签名前判断风险。

可以做什么: 检查代币的蜜罐、税费与权限风险，给出 0-100 评分及原因
将 EIP-712 类型化数据（Permit、Permit2、Seaport）解析为通俗说明并标注风险
按暴露程度扫描钱包的 ERC-20/721 授权，并返回撤销所需的 calldata
对交易做无需密钥的签名前分析，包括 revert 检查与预期影响
四项检查均提供免费简版，付费版给出完整明细
适用场景: 适合助手协助用户评估某个代币、审阅待签名请求或审查钱包授权时使用，覆盖以太坊、Base、BSC、Polygon、Arbitrum 与 Optimism，提供描述性风险事实而非代为执行。
运行要求: 可通过 safe.fabtally.com 的 streamable HTTP 远程端点使用，或在本地以 Node.js 运行 stdio 进程。无需钱包或私钥。付费工具需通过 x_payment 令牌以 Base 上的 USDC 走 x402 支付，或在 HTTP API 上使用预付的 X-FabTally-Key 额度头。可选 FABTALLY_SAFE_BASE 覆盖 API 地址。

安装前请注意

四个工具按次收费（Base 上 USDC 0.01-0.02 美元），需提供 x402 支付授权或预付额度密钥；免费版仅返回部分结果。地址与交易数据会发送至 FabTally Safe API，该服务会汇总 GoPlus、honeypot.is 等第三方来源。输出为描述性事实，不构成投资建议，撤销 calldata 需由用户自行执行。

安装

在 SourceWeft 中

打开控制台中的 FabTally Safe，将其添加到工作区。
为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/io.github.zvmzaretsky%2Fcrypto-safety/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "fabtally-safe": {
      "type": "http",
      "url": "https://safe.fabtally.com/mcp"
    }
  }
}

README

FabTally Safe — MCP server

Read-only crypto safety + "what am I signing" verification for AI agents and wallets. Fronts the FabTally Safe HTTP API (https://safe.fabtally.com).

Read-only. Never holds, moves, signs for, or broadcasts funds. No private key. Outputs are descriptive facts from public sources — not financial advice.
8 tools: 4 free teasers + 4 paid (x402, USDC on Base).

Tools

Tool	Tier	What it does
`token_safety`	paid $0.02	Multi-chain token honeypot/rug check — aggregates GoPlus + honeypot.is into a 0-100 risk score with explainable reasons.
`decode_signature`	paid $0.01	"What am I signing" — decode EIP-712 / Permit / Permit2 / Seaport typed-data into plain English + risk flags (unlimited approval, malicious spender, expiry, NFT-drain).
`approvals`	paid $0.01	Wallet approval-risk scan ranked by exposure + address-poisoning "revoke bait" detection + the revoke calldata you execute yourself.
`simulate`	paid $0.02	Keyless pre-sign transaction analysis: eth_call revert check + static delta prediction + risk flags.
`token_safety_free` · `decode_signature_free` · `approvals_free` · `simulate_free`	free	Real teaser results, no wallet.

Chains: ethereum, base, bsc, polygon, arbitrum, optimism (honeypot.is signals on ethereum/base/bsc).

Payment

Paid tools use x402 (USDC on Base, eip155:8453). Call a paid tool with no x_payment to receive the decoded 402 challenge (price, network, asset, payTo); build an x402 authorization and call again with the token in x_payment. Humans can instead prepay by card and use an X-FabTally-Key credit header on the HTTP API.

Transports

stdio (default): node index.js — for Claude Desktop and local MCP clients.
streamable-http: MCP_HTTP_PORT=8113 node http.js — hosted at https://safe.fabtally.com/mcp.

Config

FABTALLY_SAFE_BASE — API base (default https://safe.fabtally.com).

Operator: Sunstone Soft · https://fabtally.com · Not financial advice · read-only.

来源：README.md，提交 b9b1d77

工具

token_safety

Token honeypot / rug safety check (paid $0.02)

PAID $0.02 (x402, USDC on Base). Multi-chain token honeypot/rug check aggregating GoPlus token-security + honeypot.is buy/sell-tax simulation into a normalized 0-100 risk score with explainable reasons: honeypot/can't-sell, buy/sell tax, mint/blacklist/pausable/ownership privileges, top-holder concentration, LP-lock, contract verified/bytecode. Descriptive facts only — NOT a buy/sell signal. Without payment returns the x402 challenge; pass x_payment to settle. Free teaser: token_safety_free.

输入参数chain必填address必填x_payment

token_safety_free

Token safety — score band + top-line flags (FREE)

FREE. Score band + top-line honeypot/tax/privilege flags for a token {address, chain}. Real result, no wallet. Upgrade to token_safety for the full numeric breakdown.

输入参数chain必填address必填

decode_signature

Decode 'what am I signing' EIP-712 signature (paid $0.01)

PAID $0.01 (x402, USDC on Base). Decode an off-chain EIP-712 typed-data signature (Permit / Permit2 / Seaport / generic) into plain English with risk flags: unlimited approval, unknown/known-malicious spender, never-expiring or already-expired deadlines, zero-consideration NFT-drain orders. Off-chain signatures are the top wallet-drainer vector. Pure offline decode — never signs/broadcasts. Without payment returns the x402 challenge; pass x_payment. Free teaser: decode_signature_free.

输入参数chainx_paymenttyped_data必填

decode_signature_free

Signature decode — type + summary + risk level (FREE)

FREE. Type + plain-English summary + risk level for an EIP-712 `typed_data`. Real result, no wallet. Upgrade to decode_signature for the full field-by-field decode + all risk flags + malicious-spender screening.

输入参数chaintyped_data必填

approvals

Wallet approval-risk scan + revoke calldata (paid $0.01)

PAID $0.01 (x402, USDC on Base). Scan a wallet's ERC-20/721 approvals ranked by exposure; flags unlimited amounts, unverified/known-malicious spenders, and address-poisoning 'fake-approval revoke bait'; returns the exact revoke calldata you execute YOURSELF (never executed/broadcast by us). Without payment returns the x402 challenge; pass x_payment. Free teaser: approvals_free.

输入参数chain必填address必填x_payment

approvals_free

Approvals — counts + top-3 risks (FREE)

FREE. Approval counts + top-3 riskiest spenders for {address, chain}. Real result, no wallet. Upgrade to approvals for EVERY approval ranked + revoke calldata.

输入参数chain必填address必填

simulate

Keyless pre-sign transaction simulation (paid $0.02)

PAID $0.02 (x402, USDC on Base). Keyless pre-sign analysis of {chain, from?, to, data, value?}: public-RPC eth_call revert check + static calldata decode predicting approval/transfer deltas + risk flags (unlimited approval, approval-for-all, reverts). Honest keyless limitation stated in the response (no full fork trace). Without payment returns the x402 challenge; pass x_payment. Free teaser: simulate_free.

输入参数to必填datafromchain必填valuex_payment

simulate_free

Simulate — method + revert + risk level (FREE)

FREE. Method + revert flag + risk level + predicted effect types for a transaction. Real result, no wallet. Upgrade to simulate for the full predicted deltas + all risk flags.

输入参数to必填datafromchain必填value