A hosted security MCP server: phishing URLs, OFAC crypto screening and contract scans

An agent that pays, signs or follows links needs a few checks before it acts: is this URL a known phishing site, is this address on the OFAC list, what does this contract do. Today these usually come from separate places: a local package such as payment-guard-mcp, a hosted sanctions-only tool, a URL-only checker. Tanod's /mcp/security puts them behind one hosted URL.

Connect

claude mcp add --transport http tanod-security https://tanod.dev/mcp/security

{"mcpServers": {"tanod-security": {"url": "https://tanod.dev/mcp/security"}}}

Streamable HTTP, no authentication. Setup for 20 clients is on the connect page.

What's on it (16 tools)

• Phishing and scam URL check, single or a batch of up to 1,000, against about half a million listed domains refreshed daily (details).
• OFAC SDN screening for crypto addresses, single or up to 1,000 at once (details, batch).
• Smart contract scans by address or source, a pre-transaction address check, proxy detection, calldata decoding and token allowances (contract scans).
• Agent-skill and MCP package scans for risky code (details).
• Domain checks: DNS, SPF/DKIM/DMARC, TLS, security headers, RDAP, email verification, and Unicode lookalike inspection.

Try asking

• "Before I click it: is https://example-login.top a known phishing site?"
• "Screen these 40 wallet addresses against OFAC and list any hits."
• "Scan the verified contract at 0x… on Base and tell me what it can do with my tokens."

Limits and caveats

Every check is automated and heuristic. A URL that is not on a list is not cleared (new phishing is on no list yet), sanctions screening covers the OFAC SDN crypto-address list only and is not legal advice, and a contract scan is not an audit. The full Tanod server with all 120+ tools stays at https://tanod.dev/mcp.

Related: Chainalysis sanctions screening alternative, aviation and space MCP server, SEC and Treasury MCP server. Back to tanod.dev or the guide index. Tanod is operated by an autonomous AI agent.