English Français العربية

Address Poisoning Check

Registre officiel Finance et paiements

Before sending crypto, check the recipient for address poisoning: lookalikes and bad checksums

Code source Site web Documentation

Que pouvez-vous faire avec Address Poisoning Check ?

Installation

Ajoutez ceci à la configuration MCP de votre client (Claude Desktop : claude_desktop_config.json ; Cursor : .cursor/mcp.json ; VS Code et les autres utilisent la même forme « mcpServers »).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http address-poisoning-check 'https://address-poisoning-check.nextill-pos.workers.dev/mcp'
Configuration JSON (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "address-poisoning-check": {
            "type": "http",
            "url": "https://address-poisoning-check.nextill-pos.workers.dev/mcp"
        }
    }
}
NPM package devx-address-poisoning-check
Claude Code 
claude mcp add address-poisoning-check -- npx -y devx-address-poisoning-check@1.0.0 mcp
Configuration JSON (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "address-poisoning-check": {
            "command": "npx",
            "args": [
                "-y",
                "devx-address-poisoning-check@1.0.0",
                "mcp"
            ]
        }
    }
}

Documentation

Tirée du README du projet sur GitHub, actualisée chaque semaine. Les liens ouvrent GitHub.

Sommaire
  1. Address Poisoning Check
  2. CLI
  3. MCP
  4. Paid on-chain check (x402)
  5. Related DevX tools
  6. Layout

Address Poisoning Check

Is this the address you meant? Address poisoning plants a lookalike address (same first and last characters, different middle) in a wallet's history with a zero-value, dust or fake-token transfer, and waits for the owner (or their AI agent) to copy it. Bitquery counted about $76M stolen on Ethereum alone in the 12 months to July 2026.

This repo has three pieces, all read-only (we never ask for keys and never move funds):

WhatCost
CLI / stdio MCP devx-address-poisoning-checkOffline: is the recipient a lookalike of any address you trust? Is its EIP-55 checksum valid? Nothing leaves your machine.free
Remote MCP https://address-poisoning-check.nextill-pos.workers.dev/mcpSame offline check as a hosted MCP toolfree
HTTP API GET /v1/check?from=<sender>&to=<recipient>On-chain: scans the sender's real transfer history (Ethereum + Base, optional Avalanche) and flags lookalikes of real counterparties, zero-value / dust / fake-token poisoning transfers (with tx hashes), recipients that only ever appeared through such transfers, and senders that were already poisoned. Returns `ok \caution \danger` and the address you probably meant.0.005 USDC via x402 on Base

Live: https://address-poisoning-check.nextill-pos.workers.dev

CLI

npx devx-address-poisoning-check 0xd9A1C3788D81257612E2581A6ea0aDa244853a91 --known 0xd9A1b0B1e1aE382DbDc898Ea68012FfcB2853a91
# DANGER: Looks like 0xd9a1...3a91 (same first 4 / last 6 hex chars) but is a different address. Classic address-poisoning lookalike.

Exit code 2 on danger, so it can gate scripts and agent payment flows.

MCP

Claude Desktop / Cursor (stdio):

{ "mcpServers": { "address-poisoning-check": { "command": "npx", "args": ["-y", "devx-address-poisoning-check", "mcp"] } } }

Or remote (streamable HTTP): https://address-poisoning-check.nextill-pos.workers.dev/mcp

Tools: check_recipient_lookalike (free), onchain_check_info (how to buy the on-chain check; does not pay).

Paid on-chain check (x402)

GET https://address-poisoning-check.nextill-pos.workers.dev/v1/check?from=0x...&to=0x...[&chains=ethereum,base,avalanche]
  • Answers 402 with an x402 v1 body (X-PAYMENT, network base) and a v2 PAYMENT-REQUIRED header (PAYMENT-SIGNATURE, eip155:8453). Both work.
  • 5000 atomic USDC (0.005 USDC) to 0xB3cDDccEe6B150c8efFD55B961afc0Ecefe7f247, settled through the Coinbase CDP facilitator, listed in the CDP x402 Bazaar.
  • Settled only after the report is produced; bad input or data-source errors are not charged.
  • Data: Ethereum/Avalanche via the Routescan explorer API (last 300 token transfers + 150 transactions of the sender); Base via the Coinbase CDP SQL API (last 14 days of all ERC-20 transfers, including unknown/fake tokens), falling back to public RPC logs for a shorter window. Typical paid response: about 1-2 s. Data collection has a 3.5 s budget; if a source is slow you still get a report with "partial": true and the scanned window stated per chain in chains[].window. It is a heuristic over a window of public data: always confirm the full address with the payee.

Example (the May 2024 $68M WBTC case): from=0x1E227979f0b5BC691a70DEAed2e0F39a6F538FD5&to=0xd9A1C3788D81257612E2581A6ea0aDa244853a91 returns danger / possibly_already_poisoned: the victim did send real value to that address, but it first appeared in their history through a zero-value transfer.

OpenAPI: /openapi.json · Terms: /terms

Layout

  • cli/: npm package devx-address-poisoning-check (CLI + stdio MCP), npm test
  • worker/: the Cloudflare Worker behind the hosted API (npm run build)

MIT. Made by DevX · madebydevx@gmail.com

Questions fréquentes

Qu'est-ce que Address Poisoning Check ?

Before sending crypto, check the recipient for address poisoning: lookalikes and bad checksums

Comment installer Address Poisoning Check ?

Il fonctionne comme serveur distant. Dans Claude Code : claude mcp add --transport http address-poisoning-check 'https://address-poisoning-check.nextill-pos.workers.dev/mcp'. Pour les autres clients, collez la configuration JSON de cette page dans leurs réglages MCP.

Faut-il une clé API pour Address Poisoning Check ?

Son entrée au registre n'indique aucune clé ni secret obligatoire. Certaines fonctions peuvent tout de même demander un compte auprès du service auquel il se connecte.

Address Poisoning Check est-il open source ?

Oui. Son code est sur GitHub sous licence MIT.

Qui maintient Address Poisoning Check ?

Il est publié par devx-agent. AI.tn le référence sans le maintenir ni le recommander.

Issu du registre MCP officiel. Être listé n'est pas une recommandation : vérifiez le code et les permissions d'un serveur avant de lui donner accès à vos données.