Lumen Pre-Sign Check

io.github.Dansgit2b由 GitHub 帳號 Dansgit2b 發布v1.4.0更新於 Oct 24, 2026

Use before signing an EVM tx or EIP-712 message: risk flags + verdict. Informational, no simulation

發布方自己的服務：check.tattoo: tattoo size and placement guide

已驗證Streamable HTTP可網頁執行網頁搜尋與抓取金融開發者工具

概覽

AI 產生的概覽

遠端 MCP 伺服器，可在簽署前解釋 EVM 交易與 EIP-712 訊息，並提供 calldata 解碼、網頁擷取等付費公開資料工具。

可以做什麼
  • 在簽署前解釋交易或 EIP-712 訊息，回傳摘要、風險標記與結論
  • 解碼 x402 付款標頭、EIP-712 型別化資料以及 calldata 選擇器與參數
  • 查詢 EVM 位址（ENS、餘額、代幣資訊）以及網域的 DNS、SPF/DMARC 與註冊資訊
  • 把公開網頁轉成 Markdown，或解析 URL 取得標題、描述與中繼資料
  • 查詢 PubMed、arXiv、SEC 文件、天氣預報與 Polymarket 市場資料
  • 對 x402 端點執行免費的付款前安全檢查
適用情境
適合在助理即將簽署或核准 EVM 交易、型別化訊息時，先取得一份說明其實際作用的資料。也適合解碼 calldata 與 x402 標頭，或快速查詢位址、網域和公開研究資料。
執行需求
遠端 streamable HTTP 端點；免費額度為每個 IP 每小時 20 次呼叫，不需註冊或 API 金鑰。超過後按次付費，透過 x402 在 Base 上以 USDC 結算（每次 0.001–0.002），需要支援 x402 且已儲值的用戶端，並需能連線到該託管位址。
安裝前請注意
付費呼叫會花費 Base 主網上的真實 USDC，伺服器公開了收款位址，授權前請確認付款要求。簽署前檢查僅供參考、不做模擬，looks_ok 並不代表安全。服務處於早期階段且未經稽核。送出的 URL 會由伺服器抓取，疑似私鑰的輸入會被拒絕而非儲存。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Lumen Pre-Sign Check，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/io.github.Dansgit2b%2Flumen-presign-check/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "lumen-pre-sign-check": {
      "type": "http",
      "url": "https://lumenworks-x402-decoder.onrender.com/mcp/presign"
    }
  }
}

README

Lumen Works Agent API (x402)

Two listings on one origin:

  • Lumen Pre-Sign Check: POST /v1/tx/explain ($0.002). Use before signing any EVM transaction or EIP-712 message; returns {summary[], flags[], verdict} with looks_ok | review | do_not_sign_unless_intended. Agent policy: abort on do_not_sign_unless_intended, escalate review. Informational, not a security guarantee; looks_ok does not mean safe; no simulation. Accuracy set and known limits: ACCURACY.md. MCP: /mcp/presign.
  • Lumen Agent Utilities: every other route below. MCP: /mcp.

Trust terms: no signup; free tier 20 calls/hour/IP under /v1/free/...; GET/HEAD on any paid path returns the 402 quote (it never settles); not charged when a call errors, because the x402 middleware settles only after the handler returns a status below 400. Input schemas and real example outputs (examples.json, captured live by test/capture-examples.mjs) are in each route's Bazaar extension and in /openapi.json, validated with node test/validate-bazaar.mjs <base>.

Stats: /v1/stats has anonymous aggregates only (UA family, daily unique counts from salted daily-rotating IP hashes, 30-day retention). They persist across deploys when STATS_GIST_ID + STATS_GIST_TOKEN (a gist-only token) are set; otherwise they are kept in memory.

Pay-per-call agent utilities, 0.001–0.002 USDC per call on Base mainnet via x402 (exact scheme, PayAI public facilitator). Author: Dan (Dansgit2b). Early-stage, unaudited.

Endpoint (POST JSON)What
/v1/x402/lint {header}decode + lint x402 PAYMENT-REQUIRED/SIGNATURE/RESPONSE
/v1/eip712/decode {typedData}domain separator, digest, risk notes
/v1/calldata/decode {data, signature?}selector, openchain/4byte lookup, decoded args
/v1/web/markdown {url, fullPage?, maxChars?} — $0.001public page → clean Markdown (Readability) + metadata. No JS rendering.
/v1/web/unfurl {url} — $0.001final URL, status, title, description, OG image, canonical, favicon
/v1/evm/address {address} (0x or ENS) — $0.002Ethereum+Base: ENS + records, EOA/contract/7702, balances, USDC/USDT, ERC-20 info (public RPC)
/v1/domain/lookup {domain} — $0.002DNS (DoH) A/AAAA/MX/NS/TXT/CAA, SPF/DMARC, RDAP registrar/created/expiry, age

Free tier: same paths under /v1/free/... (20/hour/IP). Discovery: /, /.well-known/x402, /openapi.json, /llms.txt. payTo: 0xee9790cB3960952F585379F831a89b4e00B4029A.

End-to-end proof (local run, 2026-10-10): paid call settled on Base, tx 0xff4af45df7caeef958b77700e96ba94e5ed37d3bac6e8cf40d6528a9497d77d4.

Deploy: Render (render.yaml, free plan) or any Docker host (Dockerfile). Set PUBLIC_BASE to the public origin. No secrets needed (server only receives payments). License MIT.

MCP server

Remote MCP (streamable HTTP, stateless JSON): https://lumenworks-x402-decoder.onrender.com/mcp, with tools x402_lint, eip712_decode, calldata_decode, web_markdown, url_unfurl, evm_address_lookup and domain_lookup. Free tier: 20 tool calls/hour/IP. After that the tool returns the x402 payment requirements for the matching paid HTTP endpoint (0.001–0.002 USD).

Celo

When X402_CELO_API_KEY (from the x402.celo.org dashboard) is set, every paid route also accepts USA₮ and USDC on Celo (eip155:42220), settled through Celo's hosted facilitator at api.x402.celo.org.

Free x402 payment safety check

POST /v1/x402/safety-check (MCP tool x402_payment_safety_check) — deterministic pre-payment check. Body: {url?, method?, payment_required?, expected_pay_to?, expected_network?, max_price_usdc?, listed_price_usdc?, facilitator_url?, client_config?}. We fetch the unpaid 402 (SSRF-guarded) and return ok | review | do_not_pay with checks: HTTPS/health/latency, payTo validity/checksum/mismatch, unknown asset/network, price vs your cap and the listed price, timeout/replay window, multiple payTo, unknown facilitator, missing spend caps / idempotency in your client config. Nothing is stored; inputs that look like private keys are rejected. 30/hour/IP.

Planned (not built): continuous monitoring with alerts on price/payTo/asset changes. Free waitlist: POST /v1/monitoring/waitlist {endpoint_url, contact?} (5/hour/IP). No date promised; stored in memory/logs only on a free host, so it may be lost on restart.

Stats

GET /v1/stats — anonymous in-memory counters since last restart: calls per endpoint, unpaid 402s vs paid settlements (conversion), coarse user-agent buckets. No IPs or bodies stored.

v1.3: explain-before-you-sign + public-data tools

Endpoint (POST)PriceMCP toolUpstream (free, no key)
/v1/tx/explain0.002explain_before_signcalldata (openchain/4byte) + EIP-712, risk flags
/v1/pubmed/search0.001pubmed_searchNCBI E-utilities
/v1/arxiv/search0.001arxiv_searcharXiv API
/v1/sec/filings0.001sec_filingsSEC EDGAR (set SEC_USER_AGENT with a contact email per SEC policy)
/v1/weather/forecast0.001weather_forecastOpen-Meteo (CC BY 4.0)
/v1/polymarket/markets0.001polymarket_marketsPolymarket Gamma (read-only data)

Free tier: /v1/free/<path> or MCP, 20 calls/hour/IP.

Facilitators

If CDP_API_KEY_ID and CDP_API_KEY_SECRET are set, Coinbase's CDP facilitator is used first. Settlements through it are what get the service indexed in the x402 Bazaar. The PayAI facilitator stays registered as the fallback. Without CDP keys, PayAI handles everything, as before.

來源：README.md，提交 ca7a52f

工具

0
SourceWeft 尚未讀取此伺服器的工具。

版本歷史

1
  1. v1.4.0最新Oct 10, 2026

評分

已滿足適用檢查項的 85%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分

其他 Check 整合

check.tattoo: tattoo size and placement guide

tattoo.check官方發布者

check.tattoo: tattoo size and placement guide 的託管 MCP 服務，由 check.tattoo 發布；無需登入；Streamable HTTP；5 個工具。

Streamable HTTP可網頁執行
5 個工具Oct 24, 2026

iva.pt — EU VAT check (VIES) and Portuguese VAT law

pt.iva官方發布者

在 VIES 中驗證歐盟增值稅號，並回傳葡萄牙增值稅法典（CIVA）與 RITI 條文，支援葡語與英語。

Streamable HTTP可網頁執行
商業與電商4 個工具Oct 30, 2026

Dirtsmith Evidence Quote Check

由 GitHub 帳號 throttler300 發布

一個本機 MCP 伺服器，把助理的引用綁定到已准入的來源文字並標註片段位置，可選擇拒絕雜湊已過期的引用。

STDIO僅桌面
知識與記憶1 個工具Nov 7, 2026

HTTP Header Policy Check — HSTS, CSP & Frame Declarations

由 GitHub 帳號 kriton-dev 發布

託管於 Apify 的遠端 MCP 伺服器，讓助理檢查網站宣告的七類 HTTP 安全標頭，且不傳回原始標頭值。

Streamable HTTP可網頁執行驗證方式
安全與監控需要憑證Nov 7, 2026

VOOPA Render Check

由 GitHub 帳號 Voopa-Corp 發布

對照創作要求審查已生成的影片，在再次付費算圖前建議是剪輯修改、重試一次還是更換做法。

Streamable HTTP可網頁執行
AI 與機器學習2 個工具Nov 7, 2026