Analyzes cryptocurrency URLs to detect phishing lookalikes, typosquats, and malicious patterns before wallet connections.
Also known as devx-agent/crypto-link-check, crypto-link-check, devx-link-check
- Stars
- 0
- Tools
- —
- Downloads, 30 days
- —
- Latest version
- 1.1.0
- Last commit
- Oct 30, 2026
- License
- MIT
What is Crypto Link Check MCP?
Crypto Link Check analyzes cryptocurrency URLs to detect phishing lookalikes, typosquats, and malicious patterns before wallet connections.
Summary generated from the project's README
About Crypto Link Check MCP server
Crypto Link Check provides a security layer for users and AI agents interacting with cryptocurrency services. It analyzes URLs to identify phishing attempts, typosquatting, and malicious patterns like punycode or lookalike characters. The tool compares provided links against a curated list of official domains for approximately 60 wallets, exchanges, and decentralized applications. This helps prevent accidental connections to fake browser extensions or hijacked sites.
Developers can implement this via a local stdio MCP server using npx or connect to a remote HTTP MCP endpoint. The basic lexical analysis is free and runs offline. For more intensive security needs, a paid full check is available for 0.005 USDC via x402 on Base. This premium option includes domain registration age via RDAP, DNS lookups, redirect tracing, and a page scan for seed-phrase prompts or token-approval drainer code. The system provides verdicts ranging from official to dangerous.
What you can do with it
- 1Verify suspicious wallet linksCheck if a URL is a phishing attempt by comparing it to official brand domains.
- 2Secure AI agent transactionsProvide a read-only second opinion for autonomous agents that click links to trade or pay.
- 3Perform deep security scansAnalyze a domain for registration age and potential drainer code using the paid API.
Written from the project's README. Every use case is checked against a quote from it.
How to install Crypto Link Check MCP
Formats verified 10 Nov 2026Install Crypto Link Check MCP in Claude Code
$ claude mcp add crypto-link-check -- npx -y devx-link-checkInstall Crypto Link Check MCP in Cursor
~/.cursor/mcp.json
{
"mcpServers": {
"crypto-link-check": {
"command": "npx",
"args": [
"-y",
"devx-link-check"
]
}
}
}Install Crypto Link Check MCP in VS Code
.vscode/mcp.json
{
"servers": {
"crypto-link-check": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"devx-link-check"
]
}
}
}Install Crypto Link Check MCP in Claude Desktop
claude_desktop_config.json
{
"mcpServers": {
"crypto-link-check": {
"command": "npx",
"args": [
"-y",
"devx-link-check"
]
}
}
}Install Crypto Link Check MCP in Codex
~/.codex/config.toml
[mcp_servers.crypto-link-check] command = "npx" args = ["-y", "devx-link-check"]
Install Crypto Link Check MCP in Gemini CLI
~/.gemini/settings.json
{
"mcpServers": {
"crypto-link-check": {
"command": "npx",
"args": [
"-y",
"devx-link-check"
]
}
}
}Automated checks
Ran Nov 14, 2026Full report →Passed our automated checks. That is not a security audit: read the code and give the server the narrowest access it needs. How checks work
- Source repository linked and reachabledevx-agent/crypto-link-check is public and reachablegithub.com/devx-agent/crypto-link-check ↗Pass
- Package names this repository as its sourcedevx-link-check names devx-agent/crypto-link-check as sourcenpmjs.com/package/devx-link-check ↗Pass
- Build provenance (Sigstore attestation)No build attestation published for this releaseNot checked
- Open source license (OSI)MITspdx.org/licenses/MIT.html ↗Pass
- Commit or release in the last yearLast commit or release 2026-10-30github.com/devx-agent/crypto-link-check ↗Pass
- OpenSSF ScorecardNot checked
- Package name not close to a popular packageNo popular package one edit away from devx-link-checkPass
- No critical advisory in the package or its dependencies99 resolved dependencies checked; no critical advisoryosv.dev ↗Pass
- No hidden instructions to the model0 tool descriptions and the README read; no override phrases, credential paths or hidden charactersPass
- Destructive tools are labelledNot checked
- Remote endpoint answers the MCP handshakeinitialize answered with protocol 2025-06-18 in 38 msPass
README
View on GitHubCrypto Link Check
Is that MetaMask / Phantom / Ledger / exchange link real? Check it before you (or your agent) connect a wallet or sign anything.
October 2026 alone brought fake Phantom, Jupiter and Bitget browser extensions, a hijacked NGRAVE push alert that sent users to a seed-phrase page, and exchange phishing mails. AI agents can now trade from exchange accounts and pay for things on their own, so they click links too. This tool gives them (and you) a quick, read-only second opinion.
- Free, offline: CLI and MCP server that compare a link with the official domains of ~60 wallets, exchanges and dapps and flag lookalike characters (
0/o,rn/m, Cyrillic), typosquats, punycode, free hosting and bait words like "claim" or "sync". - Free API + remote MCP:
https://crypto-link-check.nextill-pos.workers.dev - Paid full check (optional, 0.005 USDC via x402 on Base): adds domain registration age (RDAP), DNS, redirect tracing and one fetch of the page scanned for seed-phrase prompts and token-approval drainer code. 1-10 URLs per call.
It never asks for keys or seed phrases. Verdicts are heuristics, not guarantees.
CLI
npx devx-link-check phantorn.app metamask.io
# verdict: dangerous phantorn.app
# [danger] phantorn.app spells the official phantom.app with lookalike characters ...
# verdict: official metamask.io
Exit code: 0 official / no red flags, 2 caution / suspicious / dangerous, 1 error. --json for machine output.
MCP
Local (stdio), runs offline:
{ "mcpServers": { "crypto-link-check": { "command": "npx", "args": ["-y", "devx-link-check", "mcp"] } } }
Remote (streamable HTTP, no key): https://crypto-link-check.nextill-pos.workers.dev/mcp
Tools: check_crypto_link(url) and full_report_info().
HTTP API
| Route | Price | What |
|---|---|---|
GET /api/basic?url=... |
free | lexical verdict + findings |
GET /v1/check?url=...&url=... |
0.005 USDC (x402 v2 exact, eip155:8453) |
full check, 1-10 URLs |
GET /brands.json |
free | the official-domain list we use |
GET /openapi.json, /.well-known/x402.json |
free | discovery |
The paid route answers 402 with a PAYMENT-REQUIRED header; any x402 client can pay. Settlement happens only after the report is produced. Humans can pay from a browser wallet on the web page. Terms: /terms.
Verdicts: official, no_red_flags, caution, suspicious, dangerous. Same-name-different-TLD domains are only caution because the brand may own them.
Official-domain list
cli/src/brands.js. It is curated by hand and incomplete. PRs that add brands or official domains (with a source) are welcome.
Layout
cli/: npm packagedevx-link-check(CLI + stdio MCP)worker/: the Cloudflare Worker behind the hosted API
MIT. Made by DevX. Contact madebydevx@gmail.com.
Guide
- How to spot fake crypto links
- Related free tool: 7702 Sweeper Check — is a sweeper on your wallet?
- Related free tool: Address Poisoning Check — is the address you are about to pay a poisoned lookalike?
Crypto Link Check MCP questions
How do I add Crypto Link Check MCP to Claude Code?
Run claude mcp add crypto-link-check -- npx -y devx-link-check in your terminal. Add --scope user to make it available in every project.
How do I add Crypto Link Check MCP to Cursor?
Open ~/.cursor/mcp.json and add the server under mcpServers, using the Cursor config shown in the install section above.
Does this tool require my private keys?
No, the tool never requests your keys or seed phrases.
What kind of threats does it detect?
It flags lookalike characters, typosquats, punycode, free hosting, and bait words like 'claim' or 'sync'.
Are the verdicts guaranteed to be accurate?
No, the verdicts provided are based on heuristics and are not absolute guarantees.
Can I use this tool offline?
Yes, the CLI and local MCP server can run offline.