Nightshift Labs: link, token & signature pre-checks MCP Server

by workers-nightshift-labs-nightshift-x402 Your server? Claim it

answering

Nightshift Labs: link, token & signature pre-checks is answering right now. Last checked 13 min ago. It exposes 21 tools. Last commit 9 Nov 2026.

Paid x402 pre-checks for agents: phishing links, Base tokens, EIP-712 permits, calldata, DNS.

Uptime history 4 days of history

4 days agonow

100.0%

Uptime 24h

91 of 91 checks

Tools

read from the server

447 ms

Response time

average over 24h

Stars

last commit 9 Nov 2026

What changed 6

Every tool that appeared, vanished or quietly changed what it asks for. Recorded since 6 November 2026. No other catalogue keeps this.

7 Nov 3 tools appeared domain_dns_batch, domain_overview, domain_ssl

6 Nov a tool description was rewritten2 times that day x402_preflight

6 Nov a tool changed the parameters it asks for x402_preflight

and 1 more, back to 6 November 2026

Nothing serious here today

Today is the operative word: we check Nightshift Labs: link, token & signature pre-checks every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 13 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add agent-safety --transport http https://nightshift-x402.nightshift-labs.workers.dev/mcp

Settings → Connectors → Add custom connector, then paste this address

https://nightshift-x402.nightshift-labs.workers.dev/mcp

~/.codex/config.toml

[mcp_servers.agent-safety]
url = "https://nightshift-x402.nightshift-labs.workers.dev/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "agent-safety": {
      "url": "https://nightshift-x402.nightshift-labs.workers.dev/mcp"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "agent-safety": {
      "type": "http",
      "url": "https://nightshift-x402.nightshift-labs.workers.dev/mcp"
    }
  }
}

Available tools 21

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

base

base_balance

Base wallet balances: native ETH and USDC for any address, with the block number they were read at. Price: $0.003 USDC on Base per call (x402).

base_gas

Base gas snapshot: gas price, base fee, priority fee, 10-block base-fee trend, ETH/USD (Chainlink) and estimated USD cost of an ETH transfer, ERC-20 transfer, swap and contract deploy right now. Price: $0.003 USDC on Base per call (x402).

base_portfolio

Base wallet portfolio: ETH plus 12 major Base tokens (USDC, USDbC, DAI, EURC, WETH, cbETH, wstETH, cbBTC, AERO, DEGEN, VIRTUAL, BRETT) with non-zero balances, USD values from Chainlink ETH/USD and BTC/USD feeds, and a total. Price: $0.003 USDC on Base per call (x402).

base_token_check

Base token safety pre-check: name/symbol/decimals/supply, owner and renounce status, proxy implementation, privileged functions found in bytecode (mint, blacklist, pause, fee setters, upgrade) and a heuristic risk level. Call before buying or accepting an unknown token on Base. Price: $0.003 USDC on Base per call (x402).

base_token_price

Live USD price of any ERC-20 token on Base from on-chain DEX quotes (Uniswap v3 0.05/0.3/1% pools and Aerodrome, against USDC and WETH; WETH converted with Chainlink ETH/USD). Returns the best executable route, every route's price, the price impact of selling $1,000, and flags for thin liquidity or disagreeing pools. Price: $0.003 USDC on Base per call (x402).

base_tx

Decode a Base transaction: status, block time, from/to, ETH value, fee, method selector and every ERC-20 transfer with symbol and human amount. Flags fake look-alike tokens (address-poisoning, e.g. a fake USDC with homoglyph characters). Price: $0.003 USDC on Base per call (x402).

domain

domain_dns

DNS lookup in one call: A, AAAA, CNAME, MX, TXT, NS and CAA records with TTLs (or just the types you ask for), NXDOMAIN status, DNSSEC validation, plus parsed hints: SPF record, CAA certificate issuers and which services the domain is verified with (TXT verification tokens). Resolved via DNS-over-HTTPS. Price: $0.003 USDC on Base per call (x402).

domain_dns_batch

DNS lookup for up to 12 domains in ONE paid call: A, AAAA, MX and NS by default (or the types you ask for), NXDOMAIN status, DNSSEC validation and SPF/verification hints per name, plus a summary of which names resolve, which are NXDOMAIN and which have MX. Resolved via DNS-over-HTTPS. names x types must be <= 48. Price: $0.003 USDC on Base per call (x402).

domain_email_check

Domain DNS and email-security check: A/AAAA, NS, MX (incl. null MX), SPF, DMARC policy, CAA, plus a list of issues and a 0-100 email security score. Use before sending email to or trusting a domain. Price: $0.003 USDC on Base per call (x402).

domain_overview

One-call domain overview: registration (RDAP age, expiry, registrar, DNSSEC), DNS (A/AAAA/NS/MX/CAA), email security (SPF, DMARC policy, 0-100 score, issues) and HTTPS/TLS (reachable, HSTS, cert issuer and days left), with merged flags, an 'attention' list and a verdict: ok, check (risk flags found) or incomplete (a data source did not answer; listed in 'incomplete'). Use to vet or monitor a domain with a single paid request. Price: $0.003 USDC on Base per call (x402).

domain_ssl

TLS/SSL certificate check for a host: live verified HTTPS handshake (reachable, status, HSTS) plus the newest valid certificate from public Certificate Transparency logs: issuer, notBefore/notAfter, days left, covered names, wildcard, other active certs. Flags certs expiring within 14/30 days, missing certs, failed handshakes, very new certs and mixed issuers. Use for uptime/expiry monitoring or to vet a site. Price: $0.003 USDC on Base per call (x402).

domain_whois

Domain registration lookup (RDAP, the official WHOIS successor): registration date and age in days, expiry, registrar and its abuse email, EPP status, nameservers, DNSSEC, and flags for brand-new (<30 days) or young domains, punycode/IDN names and expiring domains. Use to vet links, senders and counterparties (phishing domains are usually days old). Price: $0.003 USDC on Base per call (x402).

web

web_brand

Brand kit from a website: site name, logo candidates (JSON-LD logo, header/home-link image, inline SVG logo, apple-touch-icon/favicons, og:image), theme-color, CSS brand variables (--primary/--brand/--accent), dominant colors ranked by CSS frequency (non-neutral first), fonts (Google Fonts + CSS font families, system fonts removed) and social profile links. No rendering; flags bot-protected pages. Price: $0.003 USDC on Base per call (x402).

web_extract

Fetch any public web page and return clean Markdown of the main content plus title, meta description, word count and absolute links. Strips scripts, navigation and boilerplate. Good for feeding pages to an LLM. Price: $0.003 USDC on Base per call (x402).

web_link_check

Link / URL phishing pre-check before an agent opens, clicks or forwards a link: brand look-alikes (typosquats, homoglyphs, brand in subdomain), punycode and mixed-script hosts, credentials-in-URL tricks, high-abuse TLDs, domain age via RDAP (new domains flagged), DNS resolution and the full redirect chain. Returns a verdict, a 0-100 risk score and the flags. Price: $0.003 USDC on Base per call (x402).

web_security_headers

Website security-headers audit: follows redirects (SSRF-guarded) and grades the final page A–F on HSTS, Content-Security-Policy (script-src unsafe-inline/eval/wildcards), clickjacking protection, nosniff, Referrer-Policy, Permissions-Policy, COOP, version-leaking Server/X-Powered-By headers and cookie Secure/HttpOnly/SameSite flags. Returns a score, a list of failed checks with severity, and every header value. Price: $0.003 USDC on Base per call (x402).

evm

evm_decode_calldata

Decode EVM transaction calldata before signing: finds the function signature (signature DB, verified by re-encoding to reject selector collisions), decodes all arguments, expands multicall batches, and warns about unlimited token approvals, approve-all-NFTs, permits, ownership changes and upgrades. Works for any EVM chain. Price: $0.003 USDC on Base per call (x402).

evm_typed_data_check

Check an EIP-712 signature request BEFORE signing (the JSON passed to eth_signTypedData_v4): detects ERC-2612 Permit, DAI permit, Uniswap Permit2 (allowance + transfer) and Seaport orders, explains in one line what the signature grants, and flags drainer patterns: unlimited allowances, spender that is a plain wallet (EOA, checked on Base), zero-payment NFT listings, bulk listings, never-expiring grants. Returns risk (low/medium/high), grants, warnings and the EIP-712 digest. Price: $0.003 USDC on Base per call (x402).

ens

ens_resolve

Resolve ENS and Basenames (name.eth, name.base.eth): name → address, or address → primary name with forward verification, plus text records (avatar, description, url, twitter, github, email). Price: $0.003 USDC on Base per call (x402).

wallet

wallet_screen

Wallet / counterparty screen before you send funds or accept a payer: OFAC SDN sanctioned-address check (EVM list, refreshed from the 0xB10C OFAC dataset), address type (EOA, EIP-7702 delegated, contract, token contract), Base and Ethereum tx counts, ETH/USDC balances on Base, burn-address detection and an optional address-poisoning look-alike check against the address you expected (same first/last 4 hex). Verdict block/high_risk/caution/no_red_flags. Price: $0.003 USDC on Base per call (x402).

x402

x402_preflight

x402 seller preflight: check a paid endpoint BEFORE paying. Probes it unpaid, parses the 402 (v2 header or v1 body) and checks each option: scheme, network, asset is real USDC on Base, EIP-712 name/version match on-chain, payTo not a burn address, amount, timeout, discovery metadata. Plus on-chain seller reputation: recent USDC payments to payTo (last ~11 h: distinct payers, total, last payment). Returns verdict ok/caution/fail, issues and the recommended option. Price: $0.003 USDC on Base per call (x402).

Endpoints

URL	Transport	State	Latency	Checked
https://nightshift-x402.nightshift-labs.workers.dev/mcp	streamable-http	answering	505 ms	13 min ago

Alternatives to Nightshift Labs: link, token & signature pre-checks

same job, measured the same way

Wren Pre-sign Check

by claudeisgod

Check a tx, EIP-712 payload, text or Base token before your agent signs. Paid per call over x402.

4 tools answering

Byte Protocol

by 0rkz

PayPerByte — per-byte data for AI agents: x402 USDC on Base, EIP-712-attested. No token.

86 installs/wk 15 tools answering

DYOE Trust Tools (x402)

by bjyoe2016

22 pay-per-call x402 tools for agents: scam checks, payment pre-flight, approvals, data. USDC/Base

73 installs/wk local only

KushBitx AgentProof

by kushbitx

Safety checks for AI agents paying on Base: free SpendGuard, paid x402 token risk and preflight.

7 tools answering

Preflight Checks (x402)

by josediegorobles

Deterministic pre-execution verification tools for AI agents with x402 USDC pay-per-call on Base

45 installs/wk local only

Base Token Facts

by yankiifr

Base token checks for agents: simulated buy and sell, taxes, honeypots. Pay per call in USDC (x402).

91 installs/wk local only

Lazareus

by ajwentcrazy

S3 storage and Solana/Base/Ethereum health checks for AI agents, paid per call via x402.

8 tools answering

Tokenized Stocks & Agent Data (x402)

by fly-x402-accelerometer-feed

x402-paid data for agents: tokenized stocks on Base, Solana token verdicts, AI-progress readings

12 tools answering

Nightshift Labs: link, token & signature pre-checks — questions

Answers built from our own checks of this server.

What can Nightshift Labs: link, token & signature pre-checks do?

It exposes 21 tools, read directly from the server on our last check. Among them: base_balance, base_gas, base_portfolio, base_token_check, base_token_price, base_tx and 15 more. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

What is Nightshift Labs: link, token & signature pre-checks mostly used for?

Its tools cluster around domain, base and web. That is what this server is built to work with — the grouping comes from the actual tool names, not from a category we assigned.

Is Nightshift Labs: link, token & signature pre-checks working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 447 ms. The bar chart above shows every period we have measured.

How do I connect Nightshift Labs: link, token & signature pre-checks?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does Nightshift Labs: link, token & signature pre-checks need an API key?

No. Nightshift Labs: link, token & signature pre-checks completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 21 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is Nightshift Labs: link, token & signature pre-checks?

It answers our handshake in 447 ms on average, which is faster than 27% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.

Is Nightshift Labs: link, token & signature pre-checks open source?

The code is open source: it is published under the MIT licence, written in JavaScript and 0 stars on GitHub. The licence covers the code in the repository, not the hosted service at nightshift-x402.nightshift-labs.workers.dev, which runs on its operator's own terms.