English Français العربية

SaveSaveSaveSave

Official registry Developer tools

Check messages, npm packages and crypto addresses before acting. Read-only scanner tools.

Source code Website Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

NPM package savesavesavesave
Claude Code 
claude mcp add savesavesavesave -- npx -y savesavesavesave@0.1.3 mcp
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "savesavesavesave": {
            "command": "npx",
            "args": [
                "-y",
                "savesavesavesave@0.1.3",
                "mcp"
            ]
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. SaveSaveSaveSave
  2. What it does
  3. For AI agents
  4. The rules it keeps
  5. Privacy
  6. How it's built
  7. Tests
  8. Found a miss or a false alarm?
  9. Licence and support

SaveSaveSaveSave

A free checker for suspicious messages, links, crypto addresses and npm packages. Paste a message, an address, a token or an npm package and get an honest verdict: what was found, and what was not checked.

Live: https://savesavesavesave.xyz · No account · Open source (AGPL-3.0)

What it does

ToolWhat you give itWhat it checksWhere it runs
Message scanA DM, email, "support" message or AI promptRequests for a recovery phrase, keys or logins; disguised links; invisible and look-alike characters; hidden markup; prompt injection aimed at AI assistants; addresses inside the textEntirely in your browser. The text is never sent anywhere.
Address / token scanA wallet or token addressHoneypot patterns, owner powers (minting, balance edits, blacklists), sell restrictions and similar flags from public security data; sanctions screening for EVM wallets (Chainalysis oracle) and Solana wallets (US Treasury OFAC list); for Solana wallets, also what kind of account the address isYour browser asks GoPlus Security directly; some chains and the sanctions checks go through our Cloudflare Worker
Package checkAn npm package name (optionally a version)Removed by npm for security reasons; reported malicious or vulnerable in OSV.dev; code that runs during npm install; a name imitating a popular package; age, usage, source link, deprecation. The package's code is never downloadedYour browser asks the npm registry and OSV.dev directly; only the name and version are sent
Compare two addressesThe address you meant and the one you're about to payEvery character, grouped in fours, to catch address poisoningEntirely in your browser

Coverage: 14 EVM chains, Solana, Sui and TRON for token and address data. EVM wallets are also screened against the Chainalysis sanctions oracle, and their recent counterparties are screened on 8 chains.

After a FAIL or CAUTION result you can share the warning as an image. It's drawn on your device, carries the date and "not a guarantee", and never contains the message text.

For AI agents

An MCP server, CLI and Node library in agent/ give agents the same four checks as read-only tools: scan_message, check_package, scan_address, compare_addresses. Zero dependencies, a hard-coded network allowlist, and CI keeps it identical to the site's engine. llms.txt describes the site for AI assistants.

  • Install the MCP server: claude mcp add savesavesavesave -- npx -y savesavesavesave mcp (other clients: see savesavesavesave.xyz/agents).
  • GitHub Action for your npm dependencies: uses: stefantsezarov/SaveSaveSaveSave@v0.1.4 (setup).
  • Scan selected text on any web page with a one-click bookmark (install).

The rules it keeps

  • It never says "safe". Verdicts are PASS, CAUTION, FAIL or INSUFFICIENT DATA.
  • Every result lists what was not checked. A clean result on thin data is reported as INSUFFICIENT DATA, not PASS.
  • Only confirmed findings produce FAIL. One confirmed high-severity finding always means FAIL. Unreadable data leads to CAUTION, and the result says so.
  • The live scan console shows real steps only. No invented progress.

Privacy

  • Message text never leaves the browser.
  • Addresses go from your browser to GoPlus, or through our Worker for some chains and checks. When the Worker is used it may keep GoPlus's answer in Cloudflare's edge cache for up to 15 minutes; EVM wallet checks also send up to 15 counterparty addresses to the sanctions oracle via PublicNode. Routine invocation logging for this Worker was disabled on 20 October 2026; diagnostic logging remains enabled. Historical request logs may still contain addresses, IP addresses and other request metadata. This is not a no-storage guarantee; see the privacy page for remaining storage and provider practices.
  • Usage totals contain only daily counts by scan kind, chain and verdict, with no message text, scanned address, cookie, visitor ID or IP address in those totals. Before invocation logging was disabled on 20 October 2026, counting requests were logged with IP addresses and other request metadata. Historical logs were observed to reach back approximately seven days that day; the configured retention period remains unconfirmed. Global Privacy Control suppresses the counting request. The totals are public: ?stats=week.
  • Ads appear in the side columns on wide screens, on a few guides only; the scanner page loads no third-party script at all. They never appear on the high-harm guides and never receive anything you scan. Details are on the privacy page.

How it's built

  • Static site, no build step. index.html is the whole scanner. The engine inside it is copied verbatim from core.js, and a test fails if the two drift apart.
  • goplus-proxy-worker.js is the Cloudflare Worker. It relays requests for chains that browsers can't reach directly, runs the sanctions checks, and keeps the anonymous daily totals in D1.
  • Guides are plain HTML pages (*.html, styled by paper.css). guide-examples.test.js ties every factual claim in a guide to what the engine actually does.
  • Generators:
    • seo.js writes the SEO blocks.
    • apply-ads.js holds the per-page ad policy and security policy (CSP).
    • build-sitemap.js writes the sitemap.

Tests

Over 1,000 checks across 11 suites. They run on every push (.github/workflows/tests.yml), followed by a check of the live site after each deploy.

node verify_embedded.js              # page engine == core.js
node savesavesavesave.regression.test.js
node scanmodel.test.js
node goplus-routing.test.js
node challenge.test.js               # Spot the Trap content and pages
node promptscan.test.js
node promptscan.ui.test.js           # includes XSS tests
node scanconsole.test.js
node redteam.js                      # adversarial prompts
node guide-examples.test.js
node seo.test.js

No dependencies: Node 22 or later (CI runs Node 24, the current LTS).

Found a miss or a false alarm?

Open an issue with the example, and remove anything personal first. Misses are the most useful thing you can send.

Licence and support

  • Code: GNU AGPL-3.0-only (LICENSE).
  • The SaveSaveSaveSave name, logo, visual identity and guide text: all rights reserved (LICENSE.md). Forks must use their own name.
  • Supporting the project: SUPPORT.md. We never message anyone asking for crypto.

The original vision document is kept in VISION.md.

Not financial, legal or investment advice. An automated check can be wrong; use it as one input, not the only one.

Frequently asked questions

What is SaveSaveSaveSave?

Check messages, npm packages and crypto addresses before acting. Read-only scanner tools.

How do I install SaveSaveSaveSave?

It runs on your machine. In Claude Code: claude mcp add savesavesavesave -- npx -y savesavesavesave@0.1.3 mcp. For other clients, paste the JSON configuration from this page into their MCP settings.

Does SaveSaveSaveSave need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is SaveSaveSaveSave open source?

Yes. Its code is on GitHub under the AGPL-3.0 license.

Who maintains SaveSaveSaveSave?

It is published by stefantsezarov. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.