Sato Hub
Pre-install check

Sato Check

Check your agent tools before you install them

Paste a package, MCP server, skill or repo. See what it can do with your keys and money.

Check a packageHow it works
  • Questions4
  • Evidence types3
  • Latest check2026-11-11
TryAn https URL is read as an MCP endpoint unless you pick x402.
Or paste an install command or MCP config

Every check

What you learn

  • Does it take your key?

    Whether its setup or code reads a private key or seed phrase.

  • Does your key leave?

    Whether a test key we plant gets sent to another host.

  • Can it move funds on its own?

    Which of its tools can sign or send funds when called.

  • What changed since last time?

    New hosts, key reads or fund actions since the last version.

Example

A real check

ExampleMCP serverchecked

skim-mcpv0.2.5

What the Skim listing installs.

Full check
Evidence types run
  • Declared: ran on 2026-10-19
  • Traced: ran on 2026-10-19
  • Observed: ran on 2026-10-19
Does it take your key?
Reads a key, as of 2026-10-19.

Yes — it reads private-key material. Local signing is what a wallet does; question 2 says whether the key leaves.

Strongest evidence: traced
Does your key leave?
Not observed, as of 2026-10-19.

Not observed — no planted key left during install and start-up, under our test conditions — code paths that only run later, or only on a trigger, are not covered.

Strongest evidence: observed
Can it move funds on its own?
None found, as of 2026-10-19.

No action that signs or sends funds found.

Strongest evidence: none
What changed since last time?
First check.

First profile of this subject — nothing to compare yet.

Strongest evidence: none

Paste to evidence

How it works

  1. Paste

    A package name, MCP server, skill, repo or install command.

  2. We read the code and trace what runs

    We read what the project says, then the code it publishes. We also run some versions with planted test keys.

  3. You get dated evidence

    Each line carries one label and a date.DeclaredDeclaredThe project says so — README, config, env list or tool description.TracedTracedOur static read of the published artifact found it.ObservedObservedWe ran it with planted test keys and saw it.

How a check worksShowHide

Every line of evidence carries exactly one class, and each answer shows the strongest class behind it.

Strongest evidence: declared
The project says so — README, config, env list or tool description.
Strongest evidence: traced
Our static read of the published artifact found it.
Strongest evidence: observed
We ran it with planted test keys and saw it.

"Not observed" means no planted key left during install and start-up, under our test conditions — code paths that only run later, or only on a trigger, are not covered.

MCP and API

From your agent

MCP tool

onchain_agent_check_install

Your agent calls it before it installs anything. Pass the install command or MCP config.

{
  "command": "npm i skim-mcp"
}
Connect the MCP server

HTTP

GET /api/check

The same answers as JSON. No key, no account.

curl "https://satohub.ai/api/check?target=skim-mcp"
API docs

Sato Check Team

For teams

Sato Check Team

Check every repo your agents ship from, and hear when a dependency changes.

Subscribe Compare plans
Private repos checked in CI
10
Sandbox runs a month
20
Alert webhooks
5
  • One policy for your org
  • Change alerts by email

Single checks are free, with no account.

What a check covers

  • Strongest evidence: declared

    What the project says

    Its README, config, environment variables and tool descriptions.

  • Strongest evidence: traced

    What its code does

    Our read of the exact version it publishes.

  • Strongest evidence: observed

    What happens when it runs

    Install and start-up, with planted test keys, where we ran it.

Unknown means we could not look.

What a check does not claimShowHide

A profile describes what we read and ran, with dates. It is not a safety rating, an audit or an endorsement, and "not found" is not "not there".

"Unknown" means we could not look, not that something is wrong. A planted key observed leaving is the one fact a check states as fact, with the host it went to.

Reference

QuestionsShowHide

Questions people ask

How can I check what an MCP server or npm package can do with my keys before I install it?
1. Paste the package name, MCP endpoint or install command into Sato Check, or call the onchain_agent_check_install tool. 2. Read the four answers: does it take your key, does your key leave, can it move funds on its own, and what changed since the last version. 3. Read the evidence type on each answer (declared, traced or observed), and the version and date it was read. 4. Treat unknown as unknown. "Not observed" means no planted key left during install and start-up, under our test conditions — code paths that only run later, or only on a trigger, are not covered.
What does Sato Check show?
Sato Check reads what an agent's code can do with its keys and money — before it is installed, and every time it changes.
What do declared, traced and observed mean?
Declared: The project says so — README, config, env list or tool description. Traced: Our static read of the published artifact found it. Observed: We ran it with planted test keys and saw it.
What does unknown mean in a check?
Unknown means we could not look, not that something is wrong.
Is a check a rating or an audit?
A profile describes what we read and ran, with dates. It is not a safety rating, an audit or an endorsement, and "not found" is not "not there".
How many MCP servers have a published Sato Check reading?
87 MCP servers in the directory have a published Sato Check reading, each of one version. The newest reading is dated 2026-11-11. Each row of https://satohub.ai/lists/what-mcp-servers-do-with-your-keys shows the version read, the date and whether a person reviewed it. A server with no reading is unknown, not clear.
Is there a fuller read of one project before I connect or pay?
Preflight, at https://satohub.ai/preflight, lays out every evidence line on a project with its date and its own gaps. It describes what is on record and is not a verdict.
SourcesShowHide

Sources