mcpField
7
7702 Sweeper Check

7702 Sweeper Check

Remote
sweeper-check.nextill-pos.workers.devSecurity0Updated 2d ago
RepositoryVisit website

About 7702 Sweeper Check

7702 Sweeper Check is a read-only wallet checker that detects EIP-7702 delegations for EVM addresses across eight chains. It is for identifying unknown sweeper contracts; free checks and paid full reports use heuristics, and the service never handles private keys.

Key features

  1. 01Check eight EVM chains at once
  2. 02Read delegation code and nonce
  3. 03Offer a free basic check
  4. 04Add bytecode heuristics in paid reports
  5. 05Provide web, CLI, JSON API, and MCP

Use cases

  1. 01Check a wallet for unknown EIP-7702 delegations
  2. 02Request full risk reports for multiple addresses
  3. 03Inspect a wallet through the CLI or MCP
  4. 04Add basic address checks to an API workflow

MCP support

It offers a remote MCP server and a local stdio mode, with tools to check delegations and retrieve full-report information.

Configuration

Remote servers need no local install. Pick your client, then copy the config or install in one click.

Endpointhttps://sweeper-check.nextill-pos.workers.dev/mcp
Copy install command
Claude CodeTerminal
Cursor.cursor/mcp.json
VS Code.vscode/mcp.json
Claude Desktopclaude_desktop_config.json
Windsurf~/.codeium/windsurf/mcp_config.json

Run commands in a terminal; paste JSON into the client’s MCP config and restart. Servers that need sign-in will prompt on first connect.

Packages
npmdevx-7702-check1.1.0

Tools

Details

From the project README

7702 Sweeper Check

Does your EVM wallet have an EIP-7702 delegation you didn't set?

Since Ethereum's Pectra upgrade, one signature can attach contract code to an ordinary wallet (EIP-7702). Smart-wallet upgrades use this legitimately. Drainers use it to install sweepers: tiny contracts that forward anything sent to your wallet straight to the attacker.

This project checks 8 chains at once: Ethereum, Base, BNB Chain, Arbitrum, OP, Polygon, Gnosis and Unichain.

  • Web (free): https://sweeper-check.nextill-pos.workers.dev
  • CLI (free): npx devx-7702-check 0xYourAddress
  • MCP server for AI agents (free): remote https://sweeper-check.nextill-pos.workers.dev/mcp, or local npx devx-7702-check mcp
  • JSON API (free): GET /api/basic?address=0x...
  • Full report (paid, 0.01 USDC on Base via x402): GET /v1/check?address=0x..[,0x..], 1–20 addresses per call. It adds:
    • a delegate bytecode heuristic (a small contract with a hard-coded forwarding address = the sweeper shape);
    • source-verification status (Sourcify / Blockscout);
    • a risk level and what to do. You're charged only after the report is produced. Humans can pay with a browser wallet on the web page: you sign one USDC authorization and pay no gas.

Read-only. It never asks for or touches private keys or seed phrases.

How detection works

A 7702-delegated account's code is exactly 0xef0100 ‖ <20-byte delegate address>. The free check reads eth_getCode and the nonce on each chain. The paid report then fetches the delegate's bytecode and walks the opcodes (skipping PUSH data):

  • PUSH20 constants other than your own address and the ERC-4337 EntryPoints, combined with CALL, in a contract under 1.2 KB → high (sweeper pattern).
  • SELFBALANCE + CALL + a hard-coded address → medium.
  • Verified source or ERC-4337 smart-account shape → low.
  • Otherwise → medium/unknown.

These are heuristics, not guarantees. If a delegation you didn't create shows up, treat the key as compromised and move funds to a new wallet made on a clean device. Re-delegating to 0x0 doesn't help if an attacker holds the key.

CLI

npx devx-7702-check 0xabc... 0xdef...    # exit code 0 = none, 2 = delegation found, 1 = error
npx devx-7702-check 0xabc... --json

MCP

Claude Desktop / Cursor config:

{ "mcpServers": { "7702-sweeper-check": { "url": "https://sweeper-check.nextill-pos.workers.dev/mcp" } } }

or stdio: { "command": "npx", "args": ["-y", "devx-7702-check", "mcp"] }

Tools: check_7702_delegation(address), full_report_info().

x402 (agents)

GET /v1/check?address=... returns 402 with a PAYMENT-REQUIRED header (x402 v2, scheme exact, network eip155:8453, USDC 0x8335…2913, amount 10000 = 0.01 USDC). Pay with any x402 client. Discovery: /.well-known/x402.json, /openapi.json. Terms: /terms.

Layout

  • worker/: Cloudflare Worker source (page, free API, x402 paid route, remote MCP)
  • cli/: the npm package devx-7702-check (CLI + stdio MCP server)

Made by DevX. MIT.

Guide

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.