Back to Browse

Crypto Safety MCP Server

FinanceUse Caution4.8MCP RegistryLocalRemote
Free

Server data from the Official MCP Registry

Read-only crypto safety: token honeypot checks, EIP-712 signature decode, approval scans.

About

Read-only crypto safety: token honeypot checks, EIP-712 signature decode, approval scans.

Remote endpoints: streamable-http: https://safe.fabtally.com/mcp

Security Report

4.8
Use Caution4.8High Risk

A well-structured MCP server for crypto safety verification with proper read-only design and no private key handling. Network HTTP calls to FabTally Safe API are appropriate for the finance category, and authentication is delegated to the backend via x402 payment tokens. Minor code quality observations around error handling and input validation do not materially impact security. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity).

5 files analyzed · 7 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

How to Install & Connect

Available as Local & Remote

This plugin can run on your machine or connect to a hosted endpoint. during install.

Documentation

View on GitHub

From the project's GitHub README.

FabTally Safe — MCP server

Read-only crypto safety + "what am I signing" verification for AI agents and wallets. Fronts the FabTally Safe HTTP API (https://safe.fabtally.com).

  • Read-only. Never holds, moves, signs for, or broadcasts funds. No private key. Outputs are descriptive facts from public sources — not financial advice.
  • 8 tools: 4 free teasers + 4 paid (x402, USDC on Base).

Tools

ToolTierWhat it does
token_safetypaid $0.02Multi-chain token honeypot/rug check — aggregates GoPlus + honeypot.is into a 0-100 risk score with explainable reasons.
decode_signaturepaid $0.01"What am I signing" — decode EIP-712 / Permit / Permit2 / Seaport typed-data into plain English + risk flags (unlimited approval, malicious spender, expiry, NFT-drain).
approvalspaid $0.01Wallet approval-risk scan ranked by exposure + address-poisoning "revoke bait" detection + the revoke calldata you execute yourself.
simulatepaid $0.02Keyless pre-sign transaction analysis: eth_call revert check + static delta prediction + risk flags.
token_safety_free · decode_signature_free · approvals_free · simulate_freefreeReal teaser results, no wallet.

Chains: ethereum, base, bsc, polygon, arbitrum, optimism (honeypot.is signals on ethereum/base/bsc).

Payment

Paid tools use x402 (USDC on Base, eip155:8453). Call a paid tool with no x_payment to receive the decoded 402 challenge (price, network, asset, payTo); build an x402 authorization and call again with the token in x_payment. Humans can instead prepay by card and use an X-FabTally-Key credit header on the HTTP API.

Transports

  • stdio (default): node index.js — for Claude Desktop and local MCP clients.
  • streamable-http: MCP_HTTP_PORT=8113 node http.js — hosted at https://safe.fabtally.com/mcp.

Config

  • FABTALLY_SAFE_BASE — API base (default https://safe.fabtally.com).

Operator: Sunstone Soft · https://fabtally.com · Not financial advice · read-only.

Reviews

No reviews yet

Be the first to review this server!