io.github.philpof102-svg/biii

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

Fail-closed safe-to-pay verdicts on Base: known-bad wallets, look-alike tokens, repeat rug funders.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "biii": {
      "url": "https://biii-production.up.railway.app/mcp",
      "transport": "streamable-http"
    }
  }
}

Measured tools (29)

• till_vet_merchant

  MainStreet safe-to-pay preflight on a merchant address. Returns the hosted oracle read (advisory) AND a LOCAL CLASSIFIER verdict computed on this node via trust-core (pure, zero-oracle) — so a verdict holds even if the oracle is down. Vet the RECIPIENT before paying.

  Parameters:

  • address (required) — string — 0x merchant address
  • resourceUrl — string — optional — the endpoint/resource URL you would pay; enables the local phishing/plain-http/admin-path URL lens

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_create_charge

  Create a USDC-on-Base charge for a real-world merchant. Returns the charge + the EIP-681 payment URI your OWN wallet must execute (basetill holds no key, moves no funds).

  Parameters:

  • to (required) — string — merchant 0x address (their own wallet — non-custodial)
  • amountUsd (required) — string — e.g. "4.50"
  • label — string
  • orderId — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_check_payment

  Watch Base for the USDC transfer paying a charge and verify it FIELD-FOR-FIELD (wrong chain/token/recipient/underpay/unconfirmed = NOT paid). Only the chain says paid — verification is chain-only and never depends on any trust signal. Pass withTrust:true to ALSO get the payee's advisory MainStreet trust in the same call (advisory, never changes the paid verdict).

  Parameters:

  • to (required) — string
  • amountMicro (required) — string
  • withTrust — boolean — optional — also return advisoryTrust (MainStreet safe-to-pay on the payee); does NOT affect the chain-only paid verdict
  • lookbackBlocks — number — default 900 (~30 min on Base)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_trust

  The TRUST TRIANGLE in one call: composes reputation, standing (LAWBOR proven history, if BIII_LAWBOR_URL set) and settlement (on-chain, if amountMicro given) into ONE verdict (unsafe/unknown/trusted/settled). Reputation is shown as TWO LENSES kept SEPARATE, never merged: `local` = this node's known-bad screen against public lists (no network, decisive — a BLOCK overrides everything) and `oracle` = MainStreet's advisory read (ORACLE-REPORTED, can raise trust but never lower a local block). Fail-closed: absence is never trust; a local BLOCK holds even if the oracle is down. Every verdict carries the list's freshness (asOf/ageDays/stale).

  Parameters:

  • counterparty (required) — string — 0x address to assess (the merchant, or a payer)
  • rail — string — optional — the rail this payment settles on. BIII can WITNESS only "base" / "usdc-base" (it reads Base directly). Name any other rail — "card", "mastercard-agent-pay", "sepa", "stripe" — and the settlement vertex returns not_observable instead of pretending: the payment may well have completed, BIII simply cannot see it. Fail-closed: a rail we do not recognise is treated as unwitnessable, never as on-chain. Reputation and standing still decide, so a vetted counterparty stays payable; `proven` stays false because nothing was seen.
  • agentId — string — optional — the counterparty's ERC-8004 agentId; surfaces a SEPARATE, advisory, re-verifiable ERC-8004 reputation lens (interop, never rival)
  • amountMicro — string — optional — if given, also check on-chain settlement to this address
  • resourceUrl — string — optional — the endpoint/resource URL you would pay; enables the local phishing/plain-http/admin-path URL lens in the local classifier
  • erc8004Summary — object — optional — a ReputationRegistry.getSummary result {count, summaryValue, summaryValueDecimals} for the agentId; BIII applies the sybil-honest lens + a re-verify pointer (BIII does not read the registry live yet)
  • erc8004TrustedClients — boolean — optional — attest the getSummary was filtered to clients YOU trust (drops the sybil caveat; still advisory)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_create_invoice

  Create a Web2-style INVOICE (number, line items, due date, bill-to) on the SAME non-custodial registry: paid by the same EIP-681 intent, verified by the same chain discipline, recorded in the same provable till roll. Returns the invoice + a human-readable bill (EN/FR) + the payment URI.

  Parameters:

  • to (required) — string — merchant 0x address (their own wallet — non-custodial)
  • lineItems (required) — array — [{description, amountUsd} or {description, qty, unitUsd}]
  • lang — string — "en" (default) or "fr"
  • rail — string — optional — how this invoice SETTLES. Absent or "base" = USDC on Base, which BIII reads and can therefore attest. Name any other rail ("card", "sepa", "cash", "mastercard-agent-pay") and till_check_invoice returns not_observable instead of calling the customer unpaid: an invoice settled by card or in cash will never appear on Base, so the absence of an on-chain transfer says nothing about them. Pass the SAME rail to till_check_invoice.
  • billTo — string
  • number — string
  • dueDateMs — number
  • merchantName — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_check_invoice

  Check an invoice against the chain: settled (paid on-chain, field-for-field) / overdue / issued / not_observable (settles on a rail BIII cannot read — ask the merchant's books, never assume unpaid). If settled, returns the receipt for the registry.

  Parameters:

  • to (required) — string
  • totalMicro (required) — string — the invoice totalMicro
  • rail — string — optional — the SAME rail the invoice was created with. This tool rebuilds the invoice from these arguments, so a rail not passed here is a rail BIII cannot know about, and an off-chain invoice would be reported "overdue, unpaid" about a customer who has paid.
  • number — string
  • dueDateMs — number
  • merchantName — string
  • lookbackBlocks — number — default 43200 (~1 day on Base); invoices are slower than tills

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_vet_asset

  Is a TOKENIZED ASSET (stock/treasury/RWA) contract the GENUINE issuer's, or an impersonator? genuine / impersonation / unsafe / unknown — fail-closed (unknown is never genuine). Catches the FBI-flagged lookalike-token fraud. Registry is authoritative: seed only; source real addresses from issuer official docs.

  Parameters:

  • token (required) — string — 0x contract address of the token
  • claimedIssuer — string — what it claims to be, e.g. "BlackRock"
  • claimedSymbol — string — e.g. "BUIDL", "TSLAx"

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_vet_meme

  Which contract is the REAL memecoin among 10+ look-alikes? Fail-closed verdict from live market data (DexScreener). Returns: genuine (one contract dominates liquidity), ambiguous (top-2 tied — never certified), impersonation (the address you passed is NOT the dominant one), thin (no credible liquidity). Advisory + re-verifiable. ALSO returns `observedRisk`, kept SEPARATE from the verdict on purpose: `status` answers IDENTITY ("is this the contract you think it is?"), `observedRisk` carries what this node has MEASURED about outcomes. Its rate is WITHHELD unless the bound is verified — the reading was only measured where the launch funder had paid fewer than 20 sibling wallets, and outside that branch it separates almost nothing, so a number there would be a ceiling dressed as a signal. The bound is checked for free against this node's own observation database; pass `siblingCount` yourself if you have traced the funder. Every shape carries `siblingCountSource` (where the number came from) and a disclosure: it is a POPULATION statistic, never a claim that this particular token will rug. `inSample` has THREE states, not two: `true` (the caller told us the bet has graded nothing forward yet), `false` (it has graded some), and `null` (nobody supplied the count — UNKNOWN, which is not the same as zero, and the accompanying `gradedForwardNote` says so).

  Parameters:

  • symbol (required) — string — memecoin symbol, e.g. "TOSHI", "BRETT"
  • address — string — optional specific contract address to judge
  • chainId — ['string', 'number'] — optional chain filter — the DexScreener slug ("base", "solana", "ethereum") or an EVM chain id (8453 = Base). A chain we cannot map returns NO candidates rather than silently searching every chain: being handed a Solana contract after asking for Base is worse than being handed nothing.
  • siblingCount — number — optional: how many sibling wallets the launch funder has paid, if YOU have traced it. Supplying it lifts the withholding on `observedRisk`. Omit it and this node checks its own observation database for free; omit it AND the token is unknown here, and the rate stays WITHHELD rather than guessed.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_receipt

  Produce the chain-anchored receipt for a VERIFIED payment (txHash + basescan link). Refuses without verification.

  Parameters:

  • to (required) — string
  • amountUsd (required) — string
  • label — string
  • merchantName — string
  • lookbackBlocks — number

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_roll

  PROVABLE BOOKS: render an agent/merchant's till roll — a shareable statement where EVERY line carries its own txHash + basescan link, so the reader re-verifies each payment on Base themselves (trust no one, not even BIII). This is the substitute for the settlement statement an excluded merchant/agent loses when they leave a PSP. Pure and non-custodial (BIII holds no funds). Pass the verified receipts you collected from till_receipt.

  Parameters:

  • receipts (required) — array — the verified receipt objects (from till_receipt), each carrying a txHash
  • lang — string — "en" (default) or "fr"
  • brand — WHITE-LABEL: a partner brand for the footer ("via <name>", optionally "· powered by BIII"). String or {name, poweredBy}. The non-custodial disclosure is a fact and stays regardless.
  • merchantName — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_export

  ACCOUNTING EXPORT: turn the verified receipts into an accountant-ready CSV that QuickBooks / Xero / Excel import (the export finance teams need to adopt). Every row carries its own txHash + Basescan link, so the accountant re-verifies each amount on Base themselves — the export is a POINTER to the chain, never a book to trust. Non-custodial (BIII moved no funds). Columns: date, receipt_no, reference, description, payer, gross_usdc, tip_usdc, charged_usdc, token, chain, tx_hash, basescan_url, status. Dedup by txHash; optional block-time window; brand slugs the filename. WINDOW HONESTY: a receipt with no on-chain block time cannot be proven to fall inside a dated window, so it is excluded from one — and summary.undatedExcluded reports HOW MANY were, with the same warning prepended to `disclosure`. If that count is non-zero the CSV is short by those rows: re-run with no window to see them all.

  Parameters:

  • receipts (required) — array — the verified receipt objects (from till_receipt), each carrying a txHash
  • brand — WHITE-LABEL: a partner brand (string or {name}) — slugs the download filename; the non-custodial disclosure stays regardless.
  • toBlockTime — number — optional — only export receipts settled at/before this unix block time
  • fromBlockTime — number — optional — only export receipts settled at/after this unix block time

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_meter

  USAGE → BILL for a white-label pilot, split by trust. The settled receipts are ON-CHAIN (each txHash re-verifiable on Base — the PROVABLE basis for receipt charges); the verdict count is SELF-REPORTED (verdicts are advisory reads, not chain artifacts) and labeled as such. The pricing plan is INJECTED (the partner brings their tiers). Pure, stateless, non-custodial (BIII holds no ledger). Returns the provable/self-reported split + itemized charges + total. WINDOW HONESTY: a receipt with no on-chain block time is excluded from a DATED window (its date cannot be proven) and counted in provable.undatedExcluded — a non-zero value means the bill is UNDER-charged by those receipts, so check it before invoicing.

  Parameters:

  • receipts (required) — array — the verified receipt objects (from till_receipt) — the provable on-chain usage
  • plan — object — optional pricing plan: {name, monthlyBaseUsd, includedVerdicts, verdictOverageUsd, includedReceipts, receiptOverageUsd}. Defaults to the pilot template ($750/mo, 5000 verdicts, $0.25/verdict, $0.03/receipt).
  • toBlockTime — number
  • verdictCount — number — optional — operator-reported number of trust verdicts served this period (advisory, NOT chain-provable)
  • fromBlockTime — number

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_floor

  DECENTRALIZATION PROOF: the provenance + content-FINGERPRINT of this node's known-bad floor. Two nodes with the SAME fingerprint judge on the SAME floor — sameness is a checkable fact, not an operator's word. The floor is re-derivable from named public open-licensed lists (run scripts/biii-known-bad-ingest.js and confirm the hash), so convergence is on PUBLIC DATA + a deterministic hash, never on a central node. Compare fingerprints across nodes to prove they share the same objective floor.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_resolve

  IDENTITY BRIDGE: resolve an AGENT identity — a buzz/Nostr npub (64-hex secp256k1) AND/OR a gitlawb did:key (Ed25519) — to a payable, trust-assessable BASE address, trustlessly. The binding is a BIDIRECTIONAL attestation: each identity key AND the Base key sign the same canonical message, so anyone re-verifies the signatures (BIII never takes your word). A binding needs AT LEAST one identity key (npub or did). Fail-closed: unverified / an identity key missing its signature / expired / un-nonced / malformed ⇒ a CLAIM, not a binding (bound:false). BIII does not verify secp256k1/Ed25519 itself (no dep) — supply verified:true after checking the sigs, or re-verify with the returned pointer. When bound, feed the address to till_trust / till_vet_merchant (resolving is NOT trusting).

  Parameters:

  • address (required) — string — the claimed Base address (0x…)
  • did — string — the agent's gitlawb did:key (Ed25519 identity) — provide did and/or npub
  • npub — string — the agent's 64-hex secp256k1 pubkey (Nostr/buzz identity) — provide npub and/or did
  • nonce — string — a per-binding nonce (anti-replay) — required
  • expiry — number — optional unix seconds; 0 = no expiry
  • sigDid — string — the did:key's Ed25519 signature over the canonical message (required if did is present)
  • chainId — number — default 8453 (Base)
  • sigBase — string — the Base key's signature over the canonical message (always required)
  • sigNostr — string — the Nostr key's signature over the canonical message (required if npub is present)
  • verified — boolean — attest that every present signature verified (BIII does not check secp256k1/Ed25519 itself)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_kya

  IDENTITY STANDARD (interop): read a Skyfire KYA ("Know Your Agent") JWT — the signed token binding a real human/business to an agent (Experian's identity layer). The IDENTITY counterpart to till_trust's ERC-8004 reputation lens. Parses the JWT + validates fail-closed (iss/sub present, not expired, aud matches YOU — anti-replay), and treats it as ATTESTED only when you confirm the signature verified against the issuer JWKS (BIII does not verify JWT signatures itself — no dep; supply verified:true or re-verify with the pointer). Advisory: attesting WHO backs an agent is NOT "safe to pay" — run till_trust on the address.

  Parameters:

  • token (required) — string — the compact KYA JWT (header.payload.signature)
  • verified — boolean — attest the JWT signature verified against the issuer's JWKS (BIII does not check it itself)
  • requireExpiry — boolean — strict mode: REFUSE a KYA JWT with no exp (a never-expiring vouch). Default false — a no-exp token still attests but is flagged posture.expires:false
  • expectedAudience — string — the recipient this token must be addressed to (its aud) — anti-replay; recommended

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_authorize

  SPEND AUTHORIZATION (Skyfire Programmable Payment): create a charge AND check it against what the agent's OWNER signed off — token, recipient allow-list, per-charge max, AND the cumulative cap. Fail-closed and drain-safe: an EIP-681 payment intent is issued ONLY if the charge is authorized (ten small charges cannot beat a low cap). BIII does not verify the authorization JWT signature itself — pass verified:true after checking it, or supply a spendAuth object. The caller tracks spentMicro (BIII is stateless).

  Parameters:

  • to (required) — string — merchant 0x address (their own wallet)
  • spendAuth (required) — the owner's signed spend authorization: a Programmable-Payment JWT (string) OR an object {token, chainId, maxPerChargeMicro, cumulativeCapMicro, allowedRecipients, exp}
  • label — string
  • verified — boolean — attest the authorization JWT signature verified (BIII does not check it itself)
  • amountUsd — string — e.g. "12.50" (or use amountMicro)
  • spentMicro — string — how much has ALREADY been spent under this authorization (the caller's running total — the cumulative guard)
  • amountMicro — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_rug_powers

  WHO CAN STILL RUG THIS TOKEN? till_vet_meme says which contract is the real one; this says whether the real one is itself a trap. A dangerous capability only counts if someone can still FIRE it — mintable with ownership renounced is inert, the same flag with a live owner is an armed rug, and scoring flags without that distinction is why most scanners are noise. Merges two sources that fail at opposite ends: a curated index (owner powers, LP locks) that has never heard of a token minted ten minutes ago, and a live trade simulation that always works on fresh deploys but sees nothing about control. Fail-closed: NEVER returns clean on simulation alone, because "you can sell it right now" is not safety. Verdicts: rug_ready / high_risk / caution / clean / unknown.

  Parameters:

  • address (required) — string — token contract address
  • chain — string — base (default) | ethereum | bsc | polygon | arbitrum | optimism | avalanche

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_launch_funder

  WHO PAID FOR THIS LAUNCH, AND WHAT ELSE DID THEY PAY FOR? Follows the money backwards: a token names its creator, a creator minted minutes ago names the wallet that funded it, and that funder usually funded others. Three free explorer queries surface a cluster no buyer can see from a chart. Proven live: one funder had sent an identical 15.020 ETH to 26 fresh wallets. Reports STRUCTURE ONLY — a shared funder proves shared control or shared infrastructure, never fraud; a launchpad and a rug factory are indistinguishable from the graph. What it does prove is that these tokens share fate and should be judged together.

  Parameters:

  • address (required) — string — token contract address
  • chain — string — base (default) — chains with a public Blockscout instance

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_b20_authentic

  IS THIS A REAL BASE-NATIVE B20, OR AN ERC-20 WEARING ITS ADDRESS PREFIX? B20 is Base's native standard for compliant asset issuance (stablecoins, RWA); its tokens sit at addresses starting 0xb200 and run as a precompile, so a genuine one carries almost no EVM bytecode. As people learn to read 0xb200 as "official Base asset", a plain ERC-20 at a vanity address of the same prefix inherits that credibility for free — landing on it by chance is about 1 in 65,536. Both outcomes matter and differ: an impostor lacks the issuer controls the standard implies, while a GENUINE B20 lets its issuer freeze and burn a blocked holder's balance — a power no ERC-20 has and no ERC-20-shaped scanner looks for. Verdicts: native_b20 / prefix_impostor / not_b20 / unknown.

  Parameters:

  • address (required) — string — token contract address
  • chain — string — base (default)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_trace_theft

  FOLLOW STOLEN FUNDS from the victim's transaction to where the trail dies. Three modes. moved: what actually left a wallet in one transaction, marking which transfers are AUTHENTIC — ERC-20 Transfer logs are attacker-controlled text, so only the transaction signer is authoritative and forged events are flagged rather than followed. bridge: read a cross-chain exit; aggregators write the destination chain and receiver into their own calldata because the far side needs them, and chain ids are checked against a table before any field is called an amount (0x2b6653dc reads as a plausible token amount and is in fact TRON mainnet). tron: walk a TRON account's flow, detecting relay hops — an account forwarding the amount it received, within seconds, is a pass-through and not a destination. Reports hops, never identity or intent.

  Parameters:

  • mode (required) — string — moved | bridge | tron
  • chain — string — EVM chain for moved/bridge — base (default) | ethereum | optimism | polygon | arbitrum | gnosis
  • txHash — string — transaction hash (modes: moved, bridge)
  • address — string — TRON address, T-form (mode: tron)
  • maxHops — number — tron mode: how far to walk (default 3)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_recovery_offer

  THE SECOND THEFT: judge an approach offering to recover already-stolen funds. Every other tool here tries to stop the first loss; this exists because the first loss is what makes a person findable, and a drained wallet is a lead with a market for it. Answerable with certainty rather than a score, because the ask itself is the tell: recovery happens through the thief returning funds, or a court, exchange, or issuer freezing and reassigning them — none of which require anything from the victim's wallet. So a recovery needing your signature or an upfront fee is not merely suspect, it is structurally impossible as described, no matter how credible the person sounds or how accurately they recite your loss (the theft is public — anyone can read it back to you). Also reads the chain for the harvesting shape: many unrelated senders paying one address that returns nothing. NEVER returns "safe".

  Parameters:

  • chain — string — base (default) | ethereum | polygon | arbitrum | optimism
  • address — string — the address you were asked to pay or interact with (optional — its absence is not reassurance)
  • asksToInstall — boolean — were you asked to download or run anything?
  • asksForSeedOrKey — boolean — were you asked for a seed phrase, private key or keystore?
  • asksForSignature — boolean — were you asked to sign a message or transaction?
  • asksForUpfrontPayment — boolean — were you asked to pay a fee before delivery?

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_vet_approach

  JUDGE AN INBOUND OPPORTUNITY BY ITS ASK, NOT BY HOW GOOD IT LOOKS (podcast, interview, partnership, job, AMA). Built from a lure that worked on someone who verifies counterparties professionally: a 35-question production dossier citing his real scoring model, his settlement rails, his own catchphrase, quoting his posts verbatim — and asking genuinely HARD questions, because a flatterer never includes criticism and including it is what flips an approach from marketing to journalism in the reader's head. The mechanism is EFFORT AS A TRUST SIGNAL: that much researched detail used to cost hours of human work, so nobody spent it on one target, and everyone's instinct silently priced that in. The arithmetic was right for decades and is not right now. So this deliberately does NOT score how convincing an approach is — grading convincingness would just give a forgery a good mark. It grades the two things a forger cannot hide: where a link ACTUALLY points (a brand name to the left of the registrable domain is a free label, so wechat.web09eu.com is web09eu.com), and what the sender wants you to do. Never returns "safe".

  Parameters:

  • links — array — every URL in the message
  • urgency — boolean — was time pressure applied?
  • platform — string — the platform they named, e.g. "WeChat", "Zoom"
  • asksToInstall — boolean
  • asksForKeyOrSeed — boolean
  • asksForSignature — boolean
  • asksForUpfrontPayment — boolean

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_open_approvals

  WHICH DOORS INTO THIS WALLET ARE STILL OPEN? An ERC-20 approval is a standing permission to move your tokens without asking again, and it is the most common drain vector that does NOT require the private key: you approved a contract once for an unlimited amount and forgot. Wallets do not surface these, so almost nobody knows what they have granted. The load-bearing discipline: an Approval EVENT IS NOT THE CURRENT STATE — a later approval of zero revokes an earlier one silently, so the log is used only to find candidate (token, spender) pairs and every one is then confirmed by calling allowance() on the chain right now. Reports three outcomes, never two: live, confirmed-revoked, and COULD-NOT-CHECK. The first draft collapsed the last two and reported forty closed doors having verified nine — an unanswered call is not a closed door. Read-only: it tells you what to revoke and where, and can never revoke or sign anything itself.

  Parameters:

  • owner (required) — string — the wallet address to audit
  • chain — string — base (default) | ethereum
  • fromBlock — number — optional: scan from this block (default 0)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_watch_wallet

  WHAT CHANGED AROUND THIS WALLET SINCE WE LAST LOOKED? The other tools answer at a point in time; this is what turns them into a guard, because it REMEMBERS and therefore distinguishes a new door from an old one. Three unlimited approvals granted last year are a standing condition; a fourth appearing this morning is an event, and only the second deserves to interrupt anyone — a monitor that repeats its standing conditions every run teaches its reader to close it, and a closed monitor is worth nothing. Detects new live allowances and first-time counterparties, using TRANSACTIONS rather than event logs (an ERC-20 Transfer log names whoever the emitting contract chose, so it cannot establish that this wallet sent anything). Reports its own blind spots every run: on a wallet monitor an empty alert list reads as "you are safe", so a check that could not complete is stated, never swallowed. First run is an inventory, not a set of events. Read-only: holds no key, cannot revoke or sign.

  Parameters:

  • owner (required) — string — the wallet address to watch
  • chain — string — base (default) | ethereum
  • persist — boolean — default true — save state so the NEXT call can diff against it. Pass false for a one-off look that does not become the baseline.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_vet_agent

  IS THIS AGENT SAFE TO CONNECT TO, AND SAFE TO PAY? The gap this closes: everything else here judges tokens, launches, thefts and wallets, but never the AGENT — which is the thing that actually holds the tools. Four checkable dangers, none of which require trusting a word of the description. It does not exist (a listing is not a service, and paying an endpoint that never answers is the simplest loss available). Its tools can move money (a name is marketing; the input SCHEMA is the capability, and only a QUANTITY field proves a payment surface, because a message has a recipient exactly as a payment does but you cannot move value without saying how much). It asks for key material (a schema field for a private key or seed is the whole attack, declared in the open). Or it is paid to an address with no past. Deliberately does NOT grade how good the description reads: a well-written tool listing is free to fabricate now, so scoring prose would hand a forgery a good mark. Read-only — it introspects and never calls a tool. Never returns "safe".

  Parameters:

  • url — string — the agent's HTTP MCP endpoint
  • chain — string — base (default)
  • payTo — string — optional: the address that would receive payment

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_seed_exposure

  IS A RECOVERY PHRASE SITTING IN CLEARTEXT ON THIS MACHINE? Everything else here answers whether an ADDRESS is safe to pay; this answers whether the MACHINE is safe to hold a wallet, and a safe address on a compromised machine is worth nothing. "Self custody if you know how to keep your seedphrase safe" puts the whole condition in the sentence and nothing ships that checks it: an antivirus answers "do you have a known virus", which is a different question. This one is DECIDABLE rather than scored. A keyword scan drowns — abandon, able, about and absent are ordinary English and all four are BIP-39 words — but a mnemonic is a RUN of 12/15/18/21/24 consecutive words from a 2048-word list with a CHECKSUM in the last word, so a candidate is proven by arithmetic. Measured across 204 files and 1.6 MB of real prose and source: zero false confirmations. It NEVER outputs the phrase — file, line and word count only, because this output ends up in terminal buffers, logs and screenshots, and a scanner that prints the seed it found is a stealer with good intentions. Reports its own blind spots: no images, PDFs, password managers, browser storage or encrypted archives, so "nothing found" means nothing was found IN WHAT WAS READ. Read-only, no network, nothing is copied.

  Parameters:

  • paths — array — directories to scan; defaults to Documents, Desktop, Downloads and the OneDrive equivalents

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_key_exposure

  WHAT KEY MATERIAL IS ON THIS DISK, AND WHAT STILL HOLDS AN OLD COPY OF IT? The companion to till_seed_exposure, and it exists because a real theft happened without the phrase ever being written down: the key was exfiltrated. The trap is that a secp256k1 private key is 64 hex characters and so is every SHA-256 hash, git object id and transaction hash in a saved response, so the value SHAPE carries almost no information. Two things do: STRUCTURE (a Web3 Secret Storage keystore has version 3 and a crypto member with ciphertext, kdf and mac — nothing else looks like that, and finding one is not an exposure but an encrypted wallet whose strength is its password) and THE LABEL (cleartext keys are named by what needs them, so PRIVATE_KEY matches and PRIVATE_KEY_HASH is rejected as a digest). RETAINED COPIES are what people miss: ROTATING A SECRET DOES NOT REMOVE IT FROM THE DISK, because editor history, session caches and backup folders keep snapshots of what the file used to say — on the machine this was built for, one .env holding three named keys had eighteen previous versions still readable, and the folder had been copied into a keep-across-the-reformat backup. Also reports browser wallet vaults by PRESENCE only, nothing opened or parsed, because that is how a key leaves a machine when it was never in a text file. Never outputs key material, not even a prefix: four bytes narrow a brute force. Never decrypts, never derives an address.

  Parameters:

  • paths — array — directories to scan; defaults to Documents, Desktop and Downloads

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_verify_delivery

  I CAN PROVE I PAID. CAN I PROVE I WAS SERVED? Every other check here runs before money moves; this is the question after, and it is the one nothing in this market answers. A payment is a fact on Base that anyone can re-check forever; the deliverable was a sentence in a message. So a buyer can prove it spent and cannot prove it received — and every settlement record in existence, including the ones this server writes, records the money and takes the goods on trust. The fix is a commitment, not an opinion: the seller publishes sha256(deliverable) BEFORE being paid, the buyer hashes what arrived and compares. That settles exactly two things no prose can fake — the deliverable EXISTED before the money (you cannot hash what you have not made, which kills "pay me and I will get to it") and the bytes were NOT SWAPPED for something cheaper once the funds cleared. FOUR states, and the last two are the point. `commitment_too_late`: the bytes match but the hash was published at or after payment, so it proves only that nobody edited it afterwards — a hash published after the funds clear can simply be the hash of whatever was eventually sent, which is the exact trick this catches, and calling it `served` would bless it. `unverifiable`: no commitment was made, which is the honest verdict for almost every agent transaction today — a buyer must know it never had the MEANS to check rather than believe it passed one. It proves NOTHING about quality: a committed hash of garbage verifies perfectly. Pure, offline, no network, no keys.

  Parameters:

  • paidAt — number — block or unix ms of the payment — needed for the strong claim
  • received — string — the bytes you actually received (or pass receivedHash instead if you hashed them yourself)
  • committedAt — number — block or unix ms at which the commitment was recorded somewhere the seller cannot rewrite
  • receivedHash — string — 0x + sha256 of what you received, if you would rather not send the artifact
  • commitmentHash — string — 0x + sha256 the seller published BEFORE payment. Omit it and the answer is unverifiable, which is the truth.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• till_funder_history

  HAS THE WALLET THAT PAID FOR THIS LAUNCH ALREADY KILLED ONE? till_launch_funder reads the graph and tells you a cluster exists; this reads our OWN observation record and tells you what happened to the rest of it. The distinction matters because every other check here asks the token a question it cannot answer in time: a curated security index returns an owner address for roughly one Base token in ten, so "who can still fire a rug power" — the question this whole scanner was built on — came back unanswerable on 221 of 221 launches we watched. Who PAID is answerable, because we watched that ourselves. THE EVIDENCE IS WALK-FORWARD, which is the only kind worth quoting: every token was replayed in time order and judged using strictly earlier history, so no prediction ever saw its own outcome or any later one. A payer with a prior kill was followed by another death in 62 of 67 resolved cases (93%) against a 52% base rate, and it holds across SIX independent payers, each 75-100% lethal — not one outlier carrying an average. Read the limits as part of the answer: six operators is not sixty, "clean so far" rests on two payers and is an absence of a bad record rather than a good one, and 47% of watched launches have no funder on file — but 96% of THOSE were never traced at all, because tracing is capped per run, so that number measures our own budget and not the chain; they are reported as out of reach rather than safe, and never as evidence. AND IT IS EVADABLE FOR THE PRICE OF ONE HOP — a fresh funding wallet lands in "never seen", which is already 30% of cases. It makes REUSE expensive, which is what an operation running dozens of launches an hour actually does; expect the strong bucket to decay as operators adapt. Structure, never intent: a shared funder proves shared control or shared infrastructure, and a launchpad looks identical from the graph. Every answer carries the age of the database, and past the freshness bar the reassuring verdicts are WITHDRAWN rather than annotated, because a stale "never killed" is the exact sentence that gets someone hurt. Pure, offline, read-only.

  Parameters:

  • funder — string — the wallet that PAID for the launch — get it from till_launch_funder, which traces deployer→funder on chain. Omit it and the honest answer is that this check has nothing to say.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

Repository

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.