Nightshift Labs: link, token & signature pre-checks

dev.workers.nightshift-labs.nightshift-x402/agent-safety · v1.0.1

Paid x402 pre-checks for agents: phishing links, Base tokens, EIP-712 permits, calldata, DNS.

Website Source code Set it up

Connect Remote server

Terminal

claude mcp add --transport http agent-safety https://nightshift-x402.nightshift-labs.workers.dev/mcp

~/.cursor/mcp.json

{
  "mcpServers": {
    "agent-safety": {
      "url": "https://nightshift-x402.nightshift-labs.workers.dev/mcp"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "agent-safety": {
      "type": "http",
      "url": "https://nightshift-x402.nightshift-labs.workers.dev/mcp"
    }
  }
}

Claude Desktop

Settings > Connectors > Add custom connector
URL: https://nightshift-x402.nightshift-labs.workers.dev/mcp

Tools 21 found in our last check

base_token_check
Base token safety pre-check: name/symbol/decimals/supply, owner and renounce status, proxy implementation, privileged functions found in bytecode (mint, blacklist, pause, fee setters, upgrade) and a heuristic risk level. Call before buying or accepting an unknown token on Base.…
base_token_price
Live USD price of any ERC-20 token on Base from on-chain DEX quotes (Uniswap v3 0.05/0.3/1% pools and Aerodrome, against USDC and WETH; WETH converted with Chainlink ETH/USD). Returns the best executable route, every route's price, the price impact of selling $1,000, and flags f…
base_balance
Base wallet balances: native ETH and USDC for any address, with the block number they were read at. Price: $0.003 USDC on Base per call (x402).
base_tx
Decode a Base transaction: status, block time, from/to, ETH value, fee, method selector and every ERC-20 transfer with symbol and human amount. Flags fake look-alike tokens (address-poisoning, e.g. a fake USDC with homoglyph characters). Price: $0.003 USDC on Base per call (x402…
domain_email_check
Domain DNS and email-security check: A/AAAA, NS, MX (incl. null MX), SPF, DMARC policy, CAA, plus a list of issues and a 0-100 email security score. Use before sending email to or trusting a domain. Price: $0.003 USDC on Base per call (x402).
evm_decode_calldata
Decode EVM transaction calldata before signing: finds the function signature (signature DB, verified by re-encoding to reject selector collisions), decodes all arguments, expands multicall batches, and warns about unlimited token approvals, approve-all-NFTs, permits, ownership c…
evm_typed_data_check
Check an EIP-712 signature request BEFORE signing (the JSON passed to eth_signTypedData_v4): detects ERC-2612 Permit, DAI permit, Uniswap Permit2 (allowance + transfer) and Seaport orders, explains in one line what the signature grants, and flags drainer patterns: unlimited allo…
base_gas
Base gas snapshot: gas price, base fee, priority fee, 10-block base-fee trend, ETH/USD (Chainlink) and estimated USD cost of an ETH transfer, ERC-20 transfer, swap and contract deploy right now. Price: $0.003 USDC on Base per call (x402).
ens_resolve
Resolve ENS and Basenames (name.eth, name.base.eth): name → address, or address → primary name with forward verification, plus text records (avatar, description, url, twitter, github, email). Price: $0.003 USDC on Base per call (x402).
domain_whois
Domain registration lookup (RDAP, the official WHOIS successor): registration date and age in days, expiry, registrar and its abuse email, EPP status, nameservers, DNSSEC, and flags for brand-new (<30 days) or young domains, punycode/IDN names and expiring domains. Use to vet li…
domain_dns
DNS lookup in one call: A, AAAA, CNAME, MX, TXT, NS and CAA records with TTLs (or just the types you ask for), NXDOMAIN status, DNSSEC validation, plus parsed hints: SPF record, CAA certificate issuers and which services the domain is verified with (TXT verification tokens). Res…
domain_dns_batch
DNS lookup for up to 12 domains in ONE paid call: A, AAAA, MX and NS by default (or the types you ask for), NXDOMAIN status, DNSSEC validation and SPF/verification hints per name, plus a summary of which names resolve, which are NXDOMAIN and which have MX. Resolved via DNS-over-…
domain_ssl
TLS/SSL certificate check for a host: live verified HTTPS handshake (reachable, status, HSTS) plus the newest valid certificate from public Certificate Transparency logs: issuer, notBefore/notAfter, days left, covered names, wildcard, other active certs. Flags certs expiring wit…
domain_overview
One-call domain overview: registration (RDAP age, expiry, registrar, DNSSEC), DNS (A/AAAA/NS/MX/CAA), email security (SPF, DMARC policy, 0-100 score, issues) and HTTPS/TLS (reachable, HSTS, cert issuer and days left), with merged flags, an 'attention' list and a verdict: ok, che…
web_security_headers
Website security-headers audit: follows redirects (SSRF-guarded) and grades the final page A–F on HSTS, Content-Security-Policy (script-src unsafe-inline/eval/wildcards), clickjacking protection, nosniff, Referrer-Policy, Permissions-Policy, COOP, version-leaking Server/X-Powere…
base_portfolio
Base wallet portfolio: ETH plus 12 major Base tokens (USDC, USDbC, DAI, EURC, WETH, cbETH, wstETH, cbBTC, AERO, DEGEN, VIRTUAL, BRETT) with non-zero balances, USD values from Chainlink ETH/USD and BTC/USD feeds, and a total. Price: $0.003 USDC on Base per call (x402).
x402_preflight
x402 seller preflight: check a paid endpoint BEFORE paying. Probes it unpaid, parses the 402 (v2 header or v1 body) and checks each option: scheme, network, asset is real USDC on Base, EIP-712 name/version match on-chain, payTo not a burn address, amount, timeout, discovery meta…
wallet_screen
Wallet / counterparty screen before you send funds or accept a payer: OFAC SDN sanctioned-address check (EVM list, refreshed from the 0xB10C OFAC dataset), address type (EOA, EIP-7702 delegated, contract, token contract), Base and Ethereum tx counts, ETH/USDC balances on Base, b…
web_brand
Brand kit from a website: site name, logo candidates (JSON-LD logo, header/home-link image, inline SVG logo, apple-touch-icon/favicons, og:image), theme-color, CSS brand variables (--primary/--brand/--accent), dominant colors ranked by CSS frequency (non-neutral first), fonts (G…
web_link_check
Link / URL phishing pre-check before an agent opens, clicks or forwards a link: brand look-alikes (typosquats, homoglyphs, brand in subdomain), punycode and mixed-script hosts, credentials-in-URL tricks, high-abuse TLDs, domain age via RDAP (new domains flagged), DNS resolution…
web_extract
Fetch any public web page and return clean Markdown of the main content plus title, meta description, word count and absolute links. Strips scripts, navigation and boilerplate. Good for feeding pages to an LLM. Price: $0.003 USDC on Base per call (x402).

Details

Endpoint	`https://nightshift-x402.nightshift-labs.workers.dev/mcp` (Streamable HTTP)
First published	6 Nov 2026
Last updated	6 Nov 2026
Registry name	`dev.workers.nightshift-labs.nightshift-x402/agent-safety`

More ai and media servers See all

Live status

Live

Typical response: 273 ms
Answered: 100% of 2 checks
Last check: 13 Nov 2026

30 days agoToday

We connect daily without credentials and run initialize and tools/list.

Pair it with live search

Agents that use Nightshift Labs: link, token & signature pre-checks often also need current facts. NestDaddy MCP gives your AI today's internet: web search, real-time breaking news and full page reading in one connector.

See NestDaddy MCP

For maintainers

[![NestDaddy MCP](https://nestdaddy.com/mcp/servers/dev-workers-nightshift-labs-nightshift-x402-agent-safety/badge.svg)](https://nestdaddy.com/mcp/servers/dev-workers-nightshift-labs-nightshift-x402-agent-safety)

Add the badge to your README. It turns green while your server passes our daily check. Listing details come from the official MCP registry; update them there.

Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.