# Pre-transaction Safety Checks (Tanod) > Safety checks before you sign, pay or install: contract, token and package scans, phishing, OFAC. A focused part of Tanod (https://tanod.dev/llms.txt covers every family), over HTTP and MCP. > > Pay per call in USDC on Base or Polygon or Solana or BNB Chain or Arbitrum with x402, or on Tempo with MPP; no account or API key. Free tier: a small daily per-IP > pool per family; over HTTP add the header `X-Tanod-Free: 1` to an unpaid call (without it every unpaid call gets the 402); over MCP > the free tier is automatic. > Every result is automated and heuristic, not an audit: findings can be false positives, and a clean result is not proof that code or a package is free of risk. > Tanod is operated by an autonomous AI agent on behalf of its owner. Scans run automatically; no person reviews individual results. ## API - [OpenAPI spec](https://security.tanod.dev/openapi.json): machine-readable description of this family's 29 routes. - [x402 resources](https://security.tanod.dev/.well-known/x402) - MCP: `https://tanod.dev/mcp/security` (server `tanod-security`); also at `https://security.tanod.dev/mcp` on this host ## Routes - `POST https://security.tanod.dev/v1/chain/token-safety` (check_token_honeypot_rug_pull): Use when an agent needs a token risk check before buying an ERC-20 on Base or Ethereum, with a plain-language take. - `POST https://security.tanod.dev/v1/scan/source` (scan_solidity_code): Use when an agent holds Solidity source and needs static-analysis findings before deploying or trusting it. - `POST https://security.tanod.dev/v1/scan/address` (scan_smart_contract): Use when an agent must check a deployed contract's verified source for known risk patterns before interacting. - `GET https://security.tanod.dev/v1/source/{chain}/{address}` (get_verified_contract_source_abi): Get a verified contract's source code, ABI and compiler settings (pactlint) - `POST https://security.tanod.dev/v1/check/address` (check_address_risk): Use when an agent is about to send funds to or call an address and wants a quick risk check first. - `POST https://security.tanod.dev/v1/scan/package` (scan_mcp_server_agent_skill_package): Use when an agent is about to install an agent skill or MCP package and wants its code scanned first. - `POST https://security.tanod.dev/v1/domain/inspect` (get_dns_records): Use when an agent must check a domain's DNS records, email authentication or TLS setup. - `POST https://security.tanod.dev/v1/rdap` (whois_lookup): Use when an agent needs who registered a domain, IP or AS number, with dates, status and abuse contact. - `POST https://security.tanod.dev/v1/email/verify` (verify_email_address): Use when an agent must decide whether an email address looks deliverable before sending or storing it. - `POST https://security.tanod.dev/v1/chain/calldata` (decode_calldata): Use when an agent has raw transaction calldata and needs the function and arguments it encodes. - `POST https://security.tanod.dev/v1/chain/allowance` (check_erc20_allowance): Use when an agent must check how much an ERC-20 spender may take from an owner, and whether it is unlimited. - `POST https://security.tanod.dev/v1/sanctions` (screen_crypto_address_ofac_sanctions): Use when an agent must screen one crypto address against the US OFAC SDN list before transacting. - `POST https://security.tanod.dev/v1/headers` (check_security_headers): Use when an agent must check which security headers a site's response sets and what is missing. - `POST https://security.tanod.dev/v1/chain/proxy` (detect_proxy_contract): Use when an agent must find out whether a contract is a proxy and where its implementation and admin are. - `POST https://security.tanod.dev/v1/chain/token-honeypot` (check_token_honeypot): Use when an agent must know if an ERC-20 can be sold after buying, and its real buy and sell tax. - `POST https://security.tanod.dev/v1/chain/token-verdict` (get_token_risk_verdict_summary_card): Use when an agent must explain to a person, in plain words and a shareable card, how risky an ERC-20 token is. - `POST https://security.tanod.dev/v1/chain/solana/token-safety` (check_solana_token_safety_safe_rug_mint_freeze): Use when an agent must check a Solana token for rug risk: mint and freeze authority, holders, sell quote. - `POST https://security.tanod.dev/v1/text/unicode` (detect_invisible_unicode_homoglyphs): Use when an agent must detect invisible, bidirectional or look-alike characters in a text. - `POST https://security.tanod.dev/v1/check/url` (check_phishing_url): Use when an agent is about to open or share a URL and wants it matched against phishing and scam domain lists. - `POST https://security.tanod.dev/v1/check/url/batch` (check_urls_phishing_scam_batch): Use when an agent must match many URLs (up to 1,000) against phishing and scam domain lists in one call. - `POST https://security.tanod.dev/v1/sanctions/batch` (screen_crypto_addresses_ofac_sanctions_batch): Use when an agent must screen many crypto addresses (up to 1,000) against the US OFAC SDN list at once. - `POST https://security.tanod.dev/v1/sanctions/name` (screen_sanctions_name): Use when an agent needs sanctions name candidates before onboarding or paying a counterparty. - `POST https://security.tanod.dev/v1/chain/address-poisoning` (check_address_poisoning_before_transfer): Use when an agent is about to send USDC or a token and must check the recipient is not an address-poisoning lookalike. - `POST https://security.tanod.dev/v1/chain/approvals` (audit_wallet_token_approvals): Use when an agent must list and revoke its wallet's live token approvals, on a schedule or after a risky signature. - `POST https://security.tanod.dev/v1/chain/drain-check` (check_wallet_drain_pulled_transfers): Use when a wallet's token balance dropped and an agent must know whether it sent the tokens or someone pulled them. - `POST https://security.tanod.dev/v1/chain/counterparties` (wallet_counterparties): Use when an agent is about to send funds to an address, or vets one, and needs who it transacts with first. - `POST https://security.tanod.dev/v1/repo/info` (repo_info_lookup): Use when an agent must vet an open-source GitHub repository before adding it as a dependency. - `POST https://security.tanod.dev/v1/email/verification-code` (extract_email_verification_code_otp): Use when an agent must read a sign-up or login code or verification link from an email without the body reaching its context. - `POST https://security.tanod.dev/v1/text/secret-scan` (scan_text_for_leaked_secrets_api_keys): Use when an agent must check a log, draft or tool output for leaked API keys, private keys or seed phrases before sharing it.