io.github.zvmzaretsky/onchain-decode

Est-ce que io.github.zvmzaretsky/onchain-decode est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.zvmzaretsky/onchain-decode » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 4 outils

• abi_fetch≈ 310 tokens

  PAID $0.002 (x402, USDC on Base). Fetch the verified ABI + metadata for a contract. Give {address, chain}; get the ABI JSON, verification status/source (Sourcify or Blockscout), the callable function/event signatures, and full proxy-implementation resolution (EIP-1967/1822/OZ-legacy/beacon) — returning the implementation's ABI when it's a proxy. Without payment returns the x402 challenge; pass x_payment to settle.

  Paramètres, retour & exemple (3)

  Paramètres

  • chain · string · requis · ethereum | base | arbitrum | optimism | polygon | bsc
    EVM chain: ethereum | base | arbitrum | optimism | polygon | bsc.
  • address · string · requis
    Contract address (0x + 40 hex).
  • x_payment · string · optionnel
    x402 payment payload (base64) for this PAID decode. If supplied it is forwarded as the X-PAYMENT header to settle the call and return the real result instead of a 402 challenge. Omit to get the price challenge first.

  Exemple d'appel

  {"name": "abi_fetch", "arguments": {"chain": "ethereum", "address": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• decode_calldata≈ 377 tokens

  PAID $0.002 (x402, USDC on Base). Decode a contract function call. Give {chain, to?, data, abi?}; get the 4-byte selector resolved to a function signature (via provided ABI, the verified contract source, or 4byte.directory) plus fully decoded, typed arguments (tuples/arrays/nested included). Without payment returns the x402 challenge.

  Paramètres, retour & exemple (5)

  Paramètres

  • to · string · optionnel
    Contract address the call targets (optional; enables verified-ABI resolution).
  • abi · ? · optionnel
    Optional contract ABI (JSON array or JSON string). If omitted, the ABI is resolved from the verified source (Sourcify/Blockscout) or 4byte.directory.
  • data · string · requis
    Calldata (0x hex, at least the 4-byte selector).
  • chain · string · requis · ethereum | base | arbitrum | optimism | polygon | bsc
    EVM chain: ethereum | base | arbitrum | optimism | polygon | bsc.
  • x_payment · string · optionnel
    x402 payment payload (base64) for this PAID decode. If supplied it is forwarded as the X-PAYMENT header to settle the call and return the real result instead of a 402 challenge. Omit to get the price challenge first.

  Exemple d'appel

  {"name": "decode_calldata", "arguments": {"data": "texte", "chain": "ethereum"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• decode_log≈ 490 tokens

  PAID $0.003 (x402, USDC on Base). FLAGSHIP: decode EVM event LOGS to human-readable JSON. Give {chain, tx_hash} to decode every log in a transaction, OR {chain, address, topics[], data} for a single log; optional {abi}. Returns each event's name, canonical signature and named/typed args — correctly handling tuple/array/nested params, anonymous events, and indexed vs non-indexed. Resolves the ABI via Sourcify/Blockscout + 4byte event signatures when none is supplied. Without payment returns the x402 challenge; pass x_payment to settle.

  Paramètres, retour & exemple (7)

  Paramètres

  • abi · ? · optionnel
    Optional contract ABI (JSON array or JSON string). If omitted, the ABI is resolved from the verified source (Sourcify/Blockscout) or 4byte.directory.
  • data · string · optionnel
    Log data field (0x hex) holding the non-indexed args.
  • chain · string · requis · ethereum | base | arbitrum | optimism | polygon | bsc
    EVM chain: ethereum | base | arbitrum | optimism | polygon | bsc.
  • topics · array · optionnel
    Log topics array (topic0 is the event signature hash for non-anonymous events).
  • address · string · optionnel
    Contract address of a single log (used with topics + data).
  • tx_hash · string · optionnel
    Transaction hash (0x + 64 hex) — decodes every event log in the tx.
  • x_payment · string · optionnel
    x402 payment payload (base64) for this PAID decode. If supplied it is forwarded as the X-PAYMENT header to settle the call and return the real result instead of a 402 challenge. Omit to get the price challenge first.

  Exemple d'appel

  {"name": "decode_log", "arguments": {"chain": "ethereum"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• selector_lookup≈ 255 tokens

  PAID $0.001 (x402, USDC on Base). Resolve a 4-byte function selector (0x + 8 hex) OR a 32-byte event topic hash (0x + 64 hex) to its human-readable signature(s) via 4byte.directory + openchain.xyz. Returns all matches (selectors can collide) with a verified flag. Without payment returns the x402 challenge; pass x_payment to settle.

  Paramètres, retour & exemple (2)

  Paramètres

  • selector · string · requis
    A 4-byte function selector (0x + 8 hex) or a 32-byte event topic hash (0x + 64 hex).
  • x_payment · string · optionnel
    x402 payment payload (base64) for this PAID decode. If supplied it is forwarded as the X-PAYMENT header to settle the call and return the real result instead of a 402 challenge. Omit to get the price challenge first.

  Exemple d'appel

  {"name": "selector_lookup", "arguments": {"selector": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://decode.fabtally.com/mcp