# FabTally Safe (remote · safe.fabtally.com)

Read-only crypto safety: token honeypot checks, EIP-712 signature decode, approval scans.

- Trust score: 60/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `safe.fabtally.com`: 60/100 (this document), [markdown](https://verifymcp.io/servers/zvmzaretsky-crypto-safety/safe.md), [page](https://verifymcp.io/servers/zvmzaretsky-crypto-safety/safe)

## Channel facts

- Endpoint: `https://safe.fabtally.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 57/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 8 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 57/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 1273 tokens (~159/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 7/100
  - Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http zvmzaretsky-crypto-safety https://safe.fabtally.com/mcp
```

### Codex

```toml
[mcp_servers.zvmzaretsky-crypto-safety]
url = "https://safe.fabtally.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "zvmzaretsky-crypto-safety": {
      "type": "remote",
      "url": "https://safe.fabtally.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add zvmzaretsky-crypto-safety --url https://safe.fabtally.com/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  zvmzaretsky-crypto-safety:
    url: "https://safe.fabtally.com/mcp"
```

### Other

```json
{
  "mcpServers": {
    "zvmzaretsky-crypto-safety": {
      "type": "http",
      "url": "https://safe.fabtally.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 60, +1)

- [functional improvement] Stability: unverified → 0.03

### 2026-08-01 (score 59)

First indexed and scored.

## MCP tools (8)

### `token_safety` (~228 tokens)

Token honeypot / rug safety check (paid $0.02)

PAID $0.02 (x402, USDC on Base). Multi-chain token honeypot/rug check aggregating GoPlus token-security + honeypot.is buy/sell-tax simulation into a normalized 0-100 risk score with explainable reasons: honeypot/can't-sell, buy/sell tax, mint/blacklist/pausable/ownership privileges, top-holder concentration, LP-lock, contract verified/bytecode. Descriptive facts only — NOT a buy/sell signal. Without payment returns the x402 challenge; pass x_payment to settle. Free teaser: token_safety_free.

Input parameters:

- `address` (string, required): 0x token contract address.
- `chain` (string, required): Chain: ethereum | base | bsc | polygon | arbitrum | optimism.
- `x_payment` (string): x402 payment payload (base64) for this PAID tool. If supplied it is forwarded as the X-PAYMENT header to settle the call and return the real result instead of a 402 challenge. Omit to get the price c…

### `token_safety_free` (~86 tokens)

Token safety — score band + top-line flags (FREE)

FREE. Score band + top-line honeypot/tax/privilege flags for a token {address, chain}. Real result, no wallet. Upgrade to token_safety for the full numeric breakdown.

Input parameters:

- `address` (string, required): 0x token contract address.
- `chain` (string, required): Chain: ethereum | base | bsc | polygon | arbitrum | optimism.

### `decode_signature` (~220 tokens)

Decode 'what am I signing' EIP-712 signature (paid $0.01)

PAID $0.01 (x402, USDC on Base). Decode an off-chain EIP-712 typed-data signature (Permit / Permit2 / Seaport / generic) into plain English with risk flags: unlimited approval, unknown/known-malicious spender, never-expiring or already-expired deadlines, zero-consideration NFT-drain orders. Off-chain signatures are the top wallet-drainer vector. Pure offline decode — never signs/broadcasts. Without payment returns the x402 challenge; pass x_payment. Free teaser: decode_signature_free.

Input parameters:

- `chain` (string): Optional chain override (else read from domain.chainId).
- `typed_data` (object, required): EIP-712 typed data object: {domain, types, primaryType, message}.
- `x_payment` (string): x402 payment payload (base64) for this PAID tool. If supplied it is forwarded as the X-PAYMENT header to settle the call and return the real result instead of a 402 challenge. Omit to get the price c…

### `decode_signature_free` (~98 tokens)

Signature decode — type + summary + risk level (FREE)

FREE. Type + plain-English summary + risk level for an EIP-712 `typed_data`. Real result, no wallet. Upgrade to decode_signature for the full field-by-field decode + all risk flags + malicious-spender screening.

Input parameters:

- `chain` (string): Optional chain override (else read from domain.chainId).
- `typed_data` (object, required): EIP-712 typed data object: {domain, types, primaryType, message}.

### `approvals` (~190 tokens)

Wallet approval-risk scan + revoke calldata (paid $0.01)

PAID $0.01 (x402, USDC on Base). Scan a wallet's ERC-20/721 approvals ranked by exposure; flags unlimited amounts, unverified/known-malicious spenders, and address-poisoning 'fake-approval revoke bait'; returns the exact revoke calldata you execute YOURSELF (never executed/broadcast by us). Without payment returns the x402 challenge; pass x_payment. Free teaser: approvals_free.

Input parameters:

- `address` (string, required): 0x wallet address to scan.
- `chain` (string, required): Chain: ethereum | base | bsc | polygon | arbitrum | optimism.
- `x_payment` (string): x402 payment payload (base64) for this PAID tool. If supplied it is forwarded as the X-PAYMENT header to settle the call and return the real result instead of a 402 challenge. Omit to get the price c…

### `approvals_free` (~80 tokens)

Approvals — counts + top-3 risks (FREE)

FREE. Approval counts + top-3 riskiest spenders for {address, chain}. Real result, no wallet. Upgrade to approvals for EVERY approval ranked + revoke calldata.

Input parameters:

- `address` (string, required): 0x wallet address to scan.
- `chain` (string, required): Chain: ethereum | base | bsc | polygon | arbitrum | optimism.

### `simulate` (~244 tokens)

Keyless pre-sign transaction simulation (paid $0.02)

PAID $0.02 (x402, USDC on Base). Keyless pre-sign analysis of {chain, from?, to, data, value?}: public-RPC eth_call revert check + static calldata decode predicting approval/transfer deltas + risk flags (unlimited approval, approval-for-all, reverts). Honest keyless limitation stated in the response (no full fork trace). Without payment returns the x402 challenge; pass x_payment. Free teaser: simulate_free.

Input parameters:

- `chain` (string, required): Chain: ethereum | base | bsc | polygon | arbitrum | optimism.
- `data` (string): 0x calldata (omit for a plain value transfer).
- `from` (string): 0x sender (optional but improves accuracy).
- `to` (string, required): 0x target contract/recipient.
- `value` (string): Value in wei (optional).
- `x_payment` (string): x402 payment payload (base64) for this PAID tool. If supplied it is forwarded as the X-PAYMENT header to settle the call and return the real result instead of a 402 challenge. Omit to get the price c…

### `simulate_free` (~127 tokens)

Simulate — method + revert + risk level (FREE)

FREE. Method + revert flag + risk level + predicted effect types for a transaction. Real result, no wallet. Upgrade to simulate for the full predicted deltas + all risk flags.

Input parameters:

- `chain` (string, required): Chain: ethereum | base | bsc | polygon | arbitrum | optimism.
- `data` (string): 0x calldata (omit for a plain value transfer).
- `from` (string): 0x sender (optional but improves accuracy).
- `to` (string, required): 0x target contract/recipient.
- `value` (string): Value in wei (optional).

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/zvmzaretsky-crypto-safety/safe#diagnostics

## Score history

- 2026-08-03: 60
- 2026-08-02: 60
- 2026-08-01: 59

## Links

- Remote endpoint: https://safe.fabtally.com/mcp
- Repository: https://github.com/zvmzaretsky/crypto-safety-mcp
- Website: https://safe.fabtally.com/
- Changelog RSS feed: https://verifymcp.io/servers/zvmzaretsky-crypto-safety/safe/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/zvmzaretsky-crypto-safety/safe/changelog.json
- HTML version of this page: https://verifymcp.io/servers/zvmzaretsky-crypto-safety/safe