FabTally Safe

io.github.zvmzaretsky由 GitHub 帳號 zvmzaretsky 發布v1.0.0更新於 Oct 24, 2026

Read-only crypto safety: token honeypot checks, EIP-712 signature decode, approval scans.

發布方自己的服務：Tally

已驗證Streamable HTTP可網頁執行金融安全與監控

服務詳細資訊

識別碼: io.github.zvmzaretsky/crypto-safety
傳輸: Streamable HTTP
執行環境: Web executable
信任: Verified
發布於: Sep 16, 2026

安全提示

MCP 服務會接收對話中的工具呼叫請求，並可能執行外部操作。啟用前請先了解該服務能做什麼，並只授予它所需的權限。

註冊中心已驗證此條目所屬的 GitHub 帳號 zvmzaretsky。這並不表明該帳號就是產品方。

SourceWeft 的檢查只涵蓋條目是否完整、端點是否回應；不審查伺服器的程式碼，也不審查其工具的行為。

在 README 中新增徽章

向讀者展示該 MCP 服務已收錄於 SourceWeft，徽章連結到本頁。

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.zvmzaretsky%2Fcrypto-safety.svg)](https://sourceweft.com/mcp/io.github.zvmzaretsky%2Fcrypto-safety?utm_source=readme&utm_medium=badge)

概覽

AI 產生的概覽

唯讀的加密資產安全伺服器，可檢查代幣蜜罐風險、解析 EIP-712 簽章並掃描錢包授權，協助助理在簽署前判斷風險。

可以做什麼: 檢查代幣的蜜罐、稅費與權限風險，給出 0-100 評分與原因
將 EIP-712 型別化資料（Permit、Permit2、Seaport）解析成白話說明並標註風險
依暴露程度掃描錢包的 ERC-20/721 授權，並回傳撤銷所需的 calldata
對交易進行免金鑰的簽署前分析，包含 revert 檢查與預期影響
四項檢查都有免費簡版，付費版提供完整明細
適用情境: 適合助理協助使用者評估某個代幣、審閱待簽署請求或檢視錢包授權時使用，涵蓋以太坊、Base、BSC、Polygon、Arbitrum 與 Optimism，提供描述性風險事實而非代為執行。
執行需求: 可透過 safe.fabtally.com 的 streamable HTTP 遠端端點使用，或在本地以 Node.js 執行 stdio 程序。不需要錢包或私鑰。付費工具需以 x_payment 權杖透過 Base 上的 USDC 走 x402 付款，或在 HTTP API 上使用預付的 X-FabTally-Key 額度標頭。可選用 FABTALLY_SAFE_BASE 覆寫 API 位址。

安裝前請注意

四個工具按次收費（Base 上 USDC 0.01-0.02 美元），需提供 x402 付款授權或預付額度金鑰；免費版僅回傳部分結果。地址與交易資料會傳送至 FabTally Safe API，該服務會彙整 GoPlus、honeypot.is 等第三方來源。輸出為描述性事實，不構成投資建議，撤銷 calldata 須由使用者自行執行。

安裝

在 SourceWeft 中

開啟儀表板中的 FabTally Safe，將其新增到工作區。
為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/io.github.zvmzaretsky%2Fcrypto-safety/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "fabtally-safe": {
      "type": "http",
      "url": "https://safe.fabtally.com/mcp"
    }
  }
}

README

FabTally Safe — MCP server

Read-only crypto safety + "what am I signing" verification for AI agents and wallets. Fronts the FabTally Safe HTTP API (https://safe.fabtally.com).

Read-only. Never holds, moves, signs for, or broadcasts funds. No private key. Outputs are descriptive facts from public sources — not financial advice.
8 tools: 4 free teasers + 4 paid (x402, USDC on Base).

Tools

Tool	Tier	What it does
`token_safety`	paid $0.02	Multi-chain token honeypot/rug check — aggregates GoPlus + honeypot.is into a 0-100 risk score with explainable reasons.
`decode_signature`	paid $0.01	"What am I signing" — decode EIP-712 / Permit / Permit2 / Seaport typed-data into plain English + risk flags (unlimited approval, malicious spender, expiry, NFT-drain).
`approvals`	paid $0.01	Wallet approval-risk scan ranked by exposure + address-poisoning "revoke bait" detection + the revoke calldata you execute yourself.
`simulate`	paid $0.02	Keyless pre-sign transaction analysis: eth_call revert check + static delta prediction + risk flags.
`token_safety_free` · `decode_signature_free` · `approvals_free` · `simulate_free`	free	Real teaser results, no wallet.

Chains: ethereum, base, bsc, polygon, arbitrum, optimism (honeypot.is signals on ethereum/base/bsc).

Payment

Paid tools use x402 (USDC on Base, eip155:8453). Call a paid tool with no x_payment to receive the decoded 402 challenge (price, network, asset, payTo); build an x402 authorization and call again with the token in x_payment. Humans can instead prepay by card and use an X-FabTally-Key credit header on the HTTP API.

Transports

stdio (default): node index.js — for Claude Desktop and local MCP clients.
streamable-http: MCP_HTTP_PORT=8113 node http.js — hosted at https://safe.fabtally.com/mcp.

Config

FABTALLY_SAFE_BASE — API base (default https://safe.fabtally.com).

Operator: Sunstone Soft · https://fabtally.com · Not financial advice · read-only.

來源：README.md，提交 b9b1d77

工具

token_safety

Token honeypot / rug safety check (paid $0.02)

PAID $0.02 (x402, USDC on Base). Multi-chain token honeypot/rug check aggregating GoPlus token-security + honeypot.is buy/sell-tax simulation into a normalized 0-100 risk score with explainable reasons: honeypot/can't-sell, buy/sell tax, mint/blacklist/pausable/ownership privileges, top-holder concentration, LP-lock, contract verified/bytecode. Descriptive facts only — NOT a buy/sell signal. Without payment returns the x402 challenge; pass x_payment to settle. Free teaser: token_safety_free.

輸入參數chain必填address必填x_payment

token_safety_free

Token safety — score band + top-line flags (FREE)

FREE. Score band + top-line honeypot/tax/privilege flags for a token {address, chain}. Real result, no wallet. Upgrade to token_safety for the full numeric breakdown.

輸入參數chain必填address必填

decode_signature

Decode 'what am I signing' EIP-712 signature (paid $0.01)

PAID $0.01 (x402, USDC on Base). Decode an off-chain EIP-712 typed-data signature (Permit / Permit2 / Seaport / generic) into plain English with risk flags: unlimited approval, unknown/known-malicious spender, never-expiring or already-expired deadlines, zero-consideration NFT-drain orders. Off-chain signatures are the top wallet-drainer vector. Pure offline decode — never signs/broadcasts. Without payment returns the x402 challenge; pass x_payment. Free teaser: decode_signature_free.

輸入參數chainx_paymenttyped_data必填

decode_signature_free

Signature decode — type + summary + risk level (FREE)

FREE. Type + plain-English summary + risk level for an EIP-712 `typed_data`. Real result, no wallet. Upgrade to decode_signature for the full field-by-field decode + all risk flags + malicious-spender screening.

輸入參數chaintyped_data必填

approvals

Wallet approval-risk scan + revoke calldata (paid $0.01)

PAID $0.01 (x402, USDC on Base). Scan a wallet's ERC-20/721 approvals ranked by exposure; flags unlimited amounts, unverified/known-malicious spenders, and address-poisoning 'fake-approval revoke bait'; returns the exact revoke calldata you execute YOURSELF (never executed/broadcast by us). Without payment returns the x402 challenge; pass x_payment. Free teaser: approvals_free.

輸入參數chain必填address必填x_payment

approvals_free

Approvals — counts + top-3 risks (FREE)

FREE. Approval counts + top-3 riskiest spenders for {address, chain}. Real result, no wallet. Upgrade to approvals for EVERY approval ranked + revoke calldata.

輸入參數chain必填address必填

simulate

Keyless pre-sign transaction simulation (paid $0.02)

PAID $0.02 (x402, USDC on Base). Keyless pre-sign analysis of {chain, from?, to, data, value?}: public-RPC eth_call revert check + static calldata decode predicting approval/transfer deltas + risk flags (unlimited approval, approval-for-all, reverts). Honest keyless limitation stated in the response (no full fork trace). Without payment returns the x402 challenge; pass x_payment. Free teaser: simulate_free.

輸入參數to必填datafromchain必填valuex_payment

simulate_free

Simulate — method + revert + risk level (FREE)

FREE. Method + revert flag + risk level + predicted effect types for a transaction. Real result, no wallet. Upgrade to simulate for the full predicted deltas + all risk flags.

輸入參數to必填datafromchain必填value