# Tanod Security > Contract and agent-package scans, phishing URL and OFAC checks, domain and header checks. A focused part of Tanod (https://tanod.dev/llms.txt covers every family), over HTTP and MCP. > > Pay per call in USDC on Base or Polygon or Solana with x402, or on Tempo with MPP; no account or API key. Free tier: a small daily per-IP > pool per family; over HTTP add the header `X-Tanod-Free: 1` to an unpaid call (without it every unpaid call gets the 402); over MCP > the free tier is automatic. > Every result is automated and heuristic, not an audit: findings can be false positives, and a clean result is not proof that code or a package is free of risk. > Tanod is operated by an autonomous AI agent on behalf of its owner. Scans run automatically; no person reviews individual results. ## API - [OpenAPI spec](https://security.tanod.dev/openapi.json): machine-readable description of this family's 18 routes. - [x402 resources](https://security.tanod.dev/.well-known/x402) - MCP: `https://tanod.dev/mcp/security` (server `tanod-security`) ## Routes - `POST https://security.tanod.dev/v1/scan/source` (scan_solidity_code): Scan Solidity code: security scan and static analysis of Solidity source for contract issues (pactlint) Use when an agent holds Solidity source and needs static-analysis findings before deploying or trusting it. - `POST https://security.tanod.dev/v1/scan/address` (scan_smart_contract): Scan a smart contract: security scan of a verified contract address on Ethereum or Base (pactlint) Use when an agent must check a deployed contract's verified source for known risk patterns before interacting. - `POST https://security.tanod.dev/v1/check/address` (check_address_risk): Check address risk: risk check of a wallet or contract address before sending, Base or Ethereum (txpeek) Use when an agent is about to send funds to or call an address and wants a quick risk check first. - `POST https://security.tanod.dev/v1/scan/package` (scan_mcp_server_agent_skill_package): Scan an MCP server or AI agent skill package for security risks: npm, PyPI, GitHub (toolsniff) Use when an agent is about to install an agent skill or MCP package and wants its code scanned first. - `POST https://security.tanod.dev/v1/domain/inspect` (get_dns_records): Get DNS records and check the SSL cert (TLS), SPF, DKIM and DMARC of a domain (dnspeek) Use when an agent must check a domain's DNS records, email authentication or TLS setup. - `POST https://security.tanod.dev/v1/rdap` (whois_lookup): WHOIS lookup: get the registration info (RDAP) of a domain, IP address or AS number (dnspeek) Use when an agent needs who registered a domain, IP or AS number, with dates, status and abuse contact. - `POST https://security.tanod.dev/v1/email/verify` (verify_email_address): Check if an email address exists at domain level: syntax and MX, no mailbox probe (dnspeek) Use when an agent must decide whether an email address looks deliverable before sending or storing it. - `POST https://security.tanod.dev/v1/chain/calldata` (decode_calldata): Decode calldata: decode EVM transaction input (calldata) (chainpeek) Use when an agent has raw transaction calldata and needs the function and arguments it encodes. - `POST https://security.tanod.dev/v1/chain/allowance` (check_erc20_allowance): Check an ERC-20 token allowance and flag unlimited approvals (chainpeek) Use when an agent must check how much an ERC-20 spender may take from an owner, and whether it is unlimited. - `POST https://security.tanod.dev/v1/sanctions` (check_ofac_sanctions): Check OFAC sanctions: is a wallet address sanctioned? Sanctions screening of one address Use when an agent must screen one crypto address against the US OFAC SDN list before transacting. - `POST https://security.tanod.dev/v1/headers` (check_security_headers): Check security headers: grade a website's HTTP security headers, score and A-F grade (sitepeek) Use when an agent must check which security headers a site's response sets and what is missing. - `POST https://security.tanod.dev/v1/chain/proxy` (detect_proxy_contract): Detect a proxy contract, its kind and implementation address (chainpeek) Use when an agent must find out whether a contract is a proxy and where its implementation and admin are. - `POST https://security.tanod.dev/v1/chain/token-honeypot` (check_token_honeypot): Honeypot check: can this token be sold? Simulated buy and sell with tax (chainpeek) Use when an agent must know if an ERC-20 can be sold after buying, and its real buy and sell tax. - `POST https://security.tanod.dev/v1/chain/solana/token-safety` (check_solana_token_safety_safe_rug_mint_freeze): Check Solana token safety: rug risk, mint and freeze authority, top holders, sell quote (chainpeek) Use when an agent must check a Solana token for rug risk: mint and freeze authority, holders, sell quote. - `POST https://security.tanod.dev/v1/text/unicode` (detect_invisible_unicode_homoglyphs): Find invisible, bidi and homoglyph Unicode characters in text (utilpeek) Use when an agent must detect invisible, bidirectional or look-alike characters in a text. - `POST https://security.tanod.dev/v1/check/url` (check_phishing_url): Check a phishing URL: is a URL or domain a scam? Phishing check (chainpeek) Use when an agent is about to open or share a URL and wants it matched against phishing and scam domain lists. - `POST https://security.tanod.dev/v1/check/url/batch` (check_urls_phishing_scam_batch): Check up to 1,000 URLs or domains for phishing or scams in one batch (chainpeek) Use when an agent must match many URLs (up to 1,000) against phishing and scam domain lists in one call. - `POST https://security.tanod.dev/v1/sanctions/batch` (screen_crypto_addresses_ofac_sanctions_batch): Screen up to 1,000 crypto addresses against OFAC sanctions in one batch (chainpeek) Use when an agent must screen many crypto addresses (up to 1,000) against the US OFAC SDN list at once.