{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-05T17:24:03.992Z","url":"https://verifymcp.io/servers/devx-agent-address-poisoning-check/devx-address-poisoning-check","markdownUrl":"https://verifymcp.io/servers/devx-agent-address-poisoning-check/devx-address-poisoning-check.md","server":{"slug":"devx-agent-address-poisoning-check","name":"Address Poisoning Check","registryName":"io.github.devx-agent/address-poisoning-check","description":"Before sending crypto, check the recipient for address poisoning: lookalikes and bad checksums","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"devx-address-poisoning-check","type":"npm","identifier":"devx-address-poisoning-check","withdrawn":false,"url":"https://verifymcp.io/servers/devx-agent-address-poisoning-check/devx-address-poisoning-check","version":"1.1.0","transport":"stdio","scoredAt":"2026-11-05T03:20:53.641Z"},"score":{"total":63,"tier":"medium","status":"scored","weekDelta":null,"history":[{"date":"2026-11-05","total":63},{"date":"2026-11-04","total":63},{"date":"2026-11-03","total":63},{"date":"2026-11-02","total":63},{"date":"2026-11-01","total":63},{"date":"2026-10-31","total":63},{"date":"2026-10-30","total":43}]},"categories":[{"name":"Supply Chain Security","score":81,"verdict":"fail","reasons":["No malware found by supply-chain analysis.","CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available.","No install/post-install scripts declared.","30 of 94 dependencies flagged as unhealthy."],"codes":[{"code":"supplychain.malware_clean","args":{}},{"code":"cve.direct","args":{"package":"zod","version":"3.25.76","severity":"high"}},{"code":"installscript.none","args":{}},{"code":"dephealth.assessed","args":{"deps":"94","unhealthy":"30"}}]},{"name":"Provenance & Transparency","score":45,"verdict":"fail","reasons":["Source repository is publicly reachable at the declared URL.","Provenance check failed: no build-provenance attestation is published.","Clear OSI-approved license (MIT).","Actively maintained (last published 5 days ago).","Disclosure check failed: no security disclosure policy was found in the source repository."],"codes":[{"code":"provenance.repo_verified","args":{}},{"code":"provenance.none","args":{}},{"code":"license.osi","args":{"spdx":"MIT"}},{"code":"maintenance.recent","args":{"age_days":"5"}},{"code":"disclosure.absent","args":{}}]},{"name":"Schema Quality & AI Usability","score":66,"verdict":"fail","reasons":["AI-judged instruction clarity (excellent).","Context-footprint check failed: tool/resource definitions use about 682 tokens (~341/item across 2 items; 2 tools + 0 resources), over budget; trim descriptions and params.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"excellent"}},{"code":"schema.footprint_heavy","args":{"avg":"341","items":"2","tools":"2","tokens":"682","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":0,"verdict":"unverified","reasons":["Stability not yet verified: not enough scan history yet (needs a 30-day window)."],"codes":[{"code":"stability.insufficient_history","args":{}}]},{"name":"Tool Coverage","score":100,"verdict":"pass","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","100% of tool parameters carry a description.","Structured output schemas are declared (100% of tools); any adoption earns full credit."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"100"}},{"code":"toolquality.output_present","args":{"pct":"100"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","We read all 2 captured tool definition(s), and no name or description among them implies an irreversible operation.","An AI judge read all 3 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_none","args":{"tools":"2"}},{"code":"toolsafety.manipulation_clean","args":{"units":"3","judged":"3"}}]},{"name":"Capabilities","score":100,"verdict":"pass","reasons":["Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28."],"codes":[{"code":"protocol.supported","args":{"latest":"2026-07-28","version":"2025-11-25"}}]}],"inconclusive":["Stability not yet verified: not enough scan history yet (needs a 30-day window)."],"malware":[],"components":[{"slug":"address-poisoning-check","type":"remote","identifier":"https://address-poisoning-check.nextill-pos.workers.dev/mcp","withdrawn":false,"score":69,"current":false,"url":"https://verifymcp.io/servers/devx-agent-address-poisoning-check/address-poisoning-check","markdownUrl":"https://verifymcp.io/servers/devx-agent-address-poisoning-check/address-poisoning-check.md"},{"slug":"devx-address-poisoning-check","type":"npm","identifier":"devx-address-poisoning-check","withdrawn":false,"score":63,"current":true,"url":"https://verifymcp.io/servers/devx-agent-address-poisoning-check/devx-address-poisoning-check","markdownUrl":"https://verifymcp.io/servers/devx-agent-address-poisoning-check/devx-address-poisoning-check.md"}],"facts":[{"label":"Registry","value":"npm"},{"label":"Package","value":"devx-address-poisoning-check"},{"label":"Version","value":"1.1.0"},{"label":"Transport","value":"stdio"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"check_recipient_lookalike","title":"Check a recipient for address poisoning","description":"Compares the EVM address you are about to pay with addresses you trust and checks its EIP-55 checksum, to catch address-poisoning lookalikes before a transfer. Address poisoning: attackers send tiny or zero-value transfers from an address that shares the first and last hex characters with one of your real payees, hoping you copy it from your history. Use this tool before every transfer to an address that was pasted or copied, especially from wallet or explorer history. Offline and deterministic: nothing leaves the machine, no RPC calls, no keys, no signing. Rules: a lookalike shares at least 3 leading and 3 trailing hex characters with a trusted address (or 8 in total with at least 2 on each side) but is not identical. A mixed-case address whose EIP-55 checksum fails is treated as altered or mistyped. All-lowercase or all-uppercase input has no checksum (checksum_valid null). Returns: verdict (match = identical to a trusted address; danger = lookalike of a trusted address or invalid checksum: do not send; unknown = no match and no lookalike, which only means it is not similar to the addresses you supplied), a note, checksum_valid, compared, matches, lookalikes (address, shared_prefix, shared_suffix, shown_as) and onchain_check (URL of the paid history-based check). This tool only knows the addresses you pass in. To scan the sending wallet's real on-chain transfer history for poisoning transfers, see onchain_check_info.","inputs":[{"name":"known","type":"array","required":false,"description":"Up to 200 addresses you trust, for example the address book and previous real payees, each 0x + 40 hex. With an empty list only the checksum is checked."},{"name":"to","type":"string","required":true,"description":"The recipient you are about to send to: 0x followed by 40 hex characters. Pass it exactly as copied, keeping its letter case, so the EIP-55 checksum can be checked."}],"outputs":[{"name":"checksum_valid","type":"boolean|null","required":true,"description":"true valid, false invalid, null when the input has no checksum (single case)"},{"name":"compared","type":"number","required":true,"description":"number of trusted addresses compared"},{"name":"lookalikes","type":"array","required":true,"description":null},{"name":"matches","type":"array","required":true,"description":null},{"name":"note","type":"string","required":true,"description":null},{"name":"onchain_check","type":"string","required":true,"description":null},{"name":"to","type":"string","required":true,"description":"recipient, lowercased"},{"name":"verdict","type":"string","required":true,"description":null}],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":417},{"name":"onchain_check_info","title":"How to buy the on-chain poisoning check","description":"Returns the endpoint, price and payment method of the optional paid hosted check. It does not call the API and does not pay or sign anything. The paid check reads the sending wallet's real transfer history on Ethereum and Base (optionally Avalanche), finds poisoning transfers (zero-value, dust or fake-token transfers from lookalike addresses) and returns a verdict ok | caution | danger, the address you probably meant, and evidence transaction hashes. It costs 0.005 USDC on Base via x402. Use it when you have no trusted address list to pass to check_recipient_lookalike, or when check_recipient_lookalike returns unknown for a recipient copied from transaction history. Returns: method, url_template, price_usdc, network, asset, protocol, chains, settles and docs.","inputs":[],"outputs":[{"name":"asset","type":"string","required":true,"description":null},{"name":"chains","type":"array","required":true,"description":null},{"name":"docs","type":"string","required":true,"description":null},{"name":"method","type":"string","required":true,"description":null},{"name":"network","type":"string","required":true,"description":null},{"name":"price_usdc","type":"number","required":true,"description":null},{"name":"protocol","type":"string","required":true,"description":null},{"name":"settles","type":"string","required":true,"description":null},{"name":"url_template","type":"string","required":true,"description":null}],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":174}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T03:20:53.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"none","label":"No attestation","reason":null,"reasonLabel":null,"discovery":null,"discoveryLabel":null,"sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[{"id":"GHSA-mrhx-c7xc-m3w5","cve":"CVE-2023-54404","severity":"high","fixAvailable":true}],"vulnerabilitiesTotal":1,"dependencies":{"nodes":94,"partial":false,"deprecated":null,"stale":30,"noRepo":null}},"mismatches":[],"changelog":{"trackingSince":"2026-10-30","recent":[{"id":"chg_01a18ff8-c2f9-7abb-ae88-986ad0c7e365","kind":"advisory.identified","summary":"CVE-2023-54404 affects this package (high)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-31","url":"https://verifymcp.io/servers/devx-agent-address-poisoning-check/devx-address-poisoning-check#chg-chg_01a18ff8-c2f9-7abb-ae88-986ad0c7e365"},{"id":"chg_01a18ff8-c2f8-726b-8016-348fb32cc8aa","kind":"check.reverified","summary":"Known CVEs (unverified → fail)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-31","url":"https://verifymcp.io/servers/devx-agent-address-poisoning-check/devx-address-poisoning-check#chg-chg_01a18ff8-c2f8-726b-8016-348fb32cc8aa"},{"id":"chg_01a18ff8-c2fa-7255-9f79-bcf3a95fc1a6","kind":"check.reverified","summary":"Malware scan (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-31","url":"https://verifymcp.io/servers/devx-agent-address-poisoning-check/devx-address-poisoning-check#chg-chg_01a18ff8-c2fa-7255-9f79-bcf3a95fc1a6"},{"id":"chg_01a18ff8-c2fb-7681-9bfd-b2faf80b828b","kind":"check.reverified","summary":"Dependency health (unverified → 0.86)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-31","url":"https://verifymcp.io/servers/devx-agent-address-poisoning-check/devx-address-poisoning-check#chg-chg_01a18ff8-c2fb-7681-9bfd-b2faf80b828b"},{"id":"chg_01a18ff8-c2fc-701a-ac8c-28518423b8ed","kind":"score.total_changed","summary":"Trust score (43 → 63)","materiality":"functional","direction":"improvement","scoreDelta":20,"occurredOn":"2026-10-31","url":"https://verifymcp.io/servers/devx-agent-address-poisoning-check/devx-address-poisoning-check#chg-chg_01a18ff8-c2fc-701a-ac8c-28518423b8ed"},{"id":"chg_01a18ec3-8a6d-7d5d-9950-e483e99571ea","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/devx-agent-address-poisoning-check/devx-address-poisoning-check#chg-chg_01a18ec3-8a6d-7d5d-9950-e483e99571ea"},{"id":"chg_01a18dad-16af-7a94-929f-0339b4663be4","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/devx-agent-address-poisoning-check/devx-address-poisoning-check#chg-chg_01a18dad-16af-7a94-929f-0339b4663be4"}],"truncated":false,"feedUrl":"https://verifymcp.io/servers/devx-agent-address-poisoning-check/devx-address-poisoning-check/changelog.json"},"links":{"html":"https://verifymcp.io/servers/devx-agent-address-poisoning-check/devx-address-poisoning-check","markdown":"https://verifymcp.io/servers/devx-agent-address-poisoning-check/devx-address-poisoning-check.md","changelogJson":"https://verifymcp.io/servers/devx-agent-address-poisoning-check/devx-address-poisoning-check/changelog.json","changelogRss":"https://verifymcp.io/servers/devx-agent-address-poisoning-check/devx-address-poisoning-check.xml","external":[{"label":"npm package","href":"https://www.npmjs.com/package/devx-address-poisoning-check"},{"label":"Socket report","href":"https://socket.dev/npm/package/devx-address-poisoning-check"},{"label":"Repository","href":"https://github.com/devx-agent/address-poisoning-check"},{"label":"Website","href":"https://address-poisoning-check.nextill-pos.workers.dev/"}]}}