Every tool an MCP server advertises is read by your model the moment it connects — a poisoned description, a hidden-unicode instruction, or a conceal-from-user directive can steer the agent before a single tool runs. Scan any server for prompt-injection / tool-poisoning patterns in one command — no install, no key:
npx -y github:rezearcher/greyridge-x402-tools#v0.2.2 mcpscan https://mcp.deepwiki.com/mcp
Prints tools scanned, severity counts, risk score, and a verdict — clear / review / block. Exit code 2 on block, so it drops straight into CI as an admission gate. Static analysis of advertised metadata only; it never invokes a tool.
tools/list with no authentication; confirmed tool-poisoning 0%Private, local or stdio-only servers scan with nothing leaving your machine (paste the tools/list, or score an mcp-egress recording fully offline). Itemized findings with OWASP LLM01/LLM08 mapping: paid GET /scan/mcp ($0.05 USDC via x402 on Base, no account). Interactive scan: /scan/mcp-scanner.
Check a Base token before your agent buys it: honeypot sell-simulation, proxy/mint/pause/blacklist flags, measured transfer tax, liquidity depth. One HTTP call returns SAFE / CAUTION / AVOID.
curl "https://x402-data-api.sigrunner.workers.dev/chain/token-report/preview?token=0xYourBaseToken"
Paid route is the same depth: GET /chain/token-report?token=0x... at $0.01 USDC via x402 on Base. Swap guard /gate/swap returns GO / HOLD / BLOCK at $0.008.
Shipping a wallet, trading bot, agent or marketplace of your own? Embed the gate and keep the margin: you pay the wholesale call price (/gate/swap at $0.008), set whatever retail fits your product, and every referred call is tagged with ?ref=<your-tag> and reconciled to you on-chain — provable against Base txHashes, no contract or minimum. See the partner program and pull your own live reconcile report any time.
Code: greyridge-x402-tools (CLI, GitHub Action, LangChain, CrewAI, ElizaOS). API discovery: /.well-known/x402. Contact: contact@greyridgesignals.ai