The reason this is more than a regex over calldata is the recursion: a drain wrapped in a Safe `multiSend` inside a router batch is exactly the shape that looks harmless to a model reading hex, and it gets decoded here. The README is unusually honest about where it stops — known patterns, static only, EVM only — which is the right frame: a first-line guard to pair with simulation and a human on anything expensive.
A safety layer for agents that touch a blockchain. Three guards sit in front of the moment of signing: one decodes an unsigned transaction, one reads an EIP-712 message, one checks an action against your policy. A non-custodial wallet is bundled, but the guards work with whatever wallet you already use.
- `preflight` decodes unsigned calldata and flags the classic drain setups — unlimited approval, `setApprovalForAll`, `transferFrom`, proxy `upgradeTo`, on-chain permit
- It recurses into wrappers, so approvals hidden inside `multicall`, Multicall3 `aggregate`, ERC-4337 `executeBatch`, Gnosis Safe `multiSend` or a Universal Router command still surface
- `inspect_signature` catches permit-phishing in a typed-data message, including Permit2 and Seaport orders that route proceeds to a third party
- `check_action` enforces allow and forbid lists plus value and recipient limits before the agent acts
- `assert_safe` is the hard-stop form — it raises on a HIGH flag, with `force=True` to override deliberately
- Nine tools in total: the three guards plus create_wallet, get_balance, send, call_contract, swap and bridge
- The wallet is non-custodial — the agent holds its own key and signs locally, with no account anywhere
`pip install chain-signer`, then point your client at `chain-signer-mcp`, which speaks stdio. `ETHERSCAN_API_KEY` is optional and only needed for live balance reads and broadcasting — the guards themselves run offline with no network, no key and no funds. Bitcoin and Solana support installs as an extra. Read the limits the author states plainly: this is static analysis, not simulation, so a novel or obfuscated drain it cannot decode gets a low-severity unknown flag rather than a block, and transaction analysis is EVM-only.
One command — pip install chain-signer