Biii is an MCP server with 29 tools an agent can call, among them till_authorize, till_b20_authentic, till_check_invoice. It answers at https://biii-production.up.railway.app/mcp over streamable HTTP, and it listed its tools to an anonymous client, so no sign-in was needed for that. Our probes reached it 6 of 6 times since 11 September 2026; the last check, on 23 October 2026, succeeded.
Fail-closed safe-to-pay verdicts on Base: known-bad wallets, look-alike tokens, repeat rug funders.
Description as the publisher wrote it.
| Tool | What it does |
|---|---|
till_authorize | SPEND AUTHORIZATION (Skyfire Programmable Payment): create a charge AND check it against what the agent's OWNER signed off — token, recipient allow-list, per-charge max, AND the cumulative cap. Fail-closed and drain-safe: an EIP-681 payment Inputs: to, amountUsd, amountMicro, label, spendAuth, spentMicro |
till_b20_authentic | IS THIS A REAL BASE-NATIVE B20, OR AN ERC-20 WEARING ITS ADDRESS PREFIX? B20 is Base's native standard for compliant asset issuance (stablecoins, RWA); its tokens sit at addresses starting 0xb200 and run as a precompile, so a genuine one ca Inputs: address, chain |
till_check_invoice | Check an invoice against the chain: settled (paid on-chain, field-for-field) / overdue / issued / not_observable (settles on a rail BIII cannot read — ask the merchant's books, never assume unpaid). If settled, returns the receipt for the r Inputs: to, totalMicro, number, dueDateMs, merchantName, rail |
till_check_payment | Watch Base for the USDC transfer paying a charge and verify it FIELD-FOR-FIELD (wrong chain/token/recipient/underpay/unconfirmed = NOT paid). Only the chain says paid — verification is chain-only and never depends on any trust signal. Pass Inputs: to, amountMicro, lookbackBlocks, withTrust |
till_create_charge | Create a USDC-on-Base charge for a real-world merchant. Returns the charge + the EIP-681 payment URI your OWN wallet must execute (basetill holds no key, moves no funds). Inputs: to, amountUsd, label, orderId |
till_create_invoice | Create a Web2-style INVOICE (number, line items, due date, bill-to) on the SAME non-custodial registry: paid by the same EIP-681 intent, verified by the same chain discipline, recorded in the same provable till roll. Returns the invoice + a Inputs: to, lineItems, number, billTo, merchantName, dueDateMs |
till_export | ACCOUNTING EXPORT: turn the verified receipts into an accountant-ready CSV that QuickBooks / Xero / Excel import (the export finance teams need to adopt). Every row carries its own txHash + Basescan link, so the accountant re-verifies each Inputs: receipts, fromBlockTime, toBlockTime, brand |
till_floor | DECENTRALIZATION PROOF: the provenance + content-FINGERPRINT of this node's known-bad floor. Two nodes with the SAME fingerprint judge on the SAME floor — sameness is a checkable fact, not an operator's word. The floor is re-derivable from |
till_funder_history | HAS THE WALLET THAT PAID FOR THIS LAUNCH ALREADY KILLED ONE? till_launch_funder reads the graph and tells you a cluster exists; this reads our OWN observation record and tells you what happened to the rest of it. The distinction matters bec Inputs: funder |
till_key_exposure | WHAT KEY MATERIAL IS ON THIS DISK, AND WHAT STILL HOLDS AN OLD COPY OF IT? The companion to till_seed_exposure, and it exists because a real theft happened without the phrase ever being written down: the key was exfiltrated. The trap is tha Inputs: paths |
till_kya | IDENTITY STANDARD (interop): read a Skyfire KYA ("Know Your Agent") JWT — the signed token binding a real human/business to an agent (Experian's identity layer). The IDENTITY counterpart to till_trust's ERC-8004 reputation lens. Parses the Inputs: token, expectedAudience, requireExpiry, verified |
till_launch_funder | WHO PAID FOR THIS LAUNCH, AND WHAT ELSE DID THEY PAY FOR? Follows the money backwards: a token names its creator, a creator minted minutes ago names the wallet that funded it, and that funder usually funded others. Three free explorer queri Inputs: address, chain |
till_meter | USAGE → BILL for a white-label pilot, split by trust. The settled receipts are ON-CHAIN (each txHash re-verifiable on Base — the PROVABLE basis for receipt charges); the verdict count is SELF-REPORTED (verdicts are advisory reads, not chain Inputs: receipts, verdictCount, plan, fromBlockTime, toBlockTime |
till_open_approvals | WHICH DOORS INTO THIS WALLET ARE STILL OPEN? An ERC-20 approval is a standing permission to move your tokens without asking again, and it is the most common drain vector that does NOT require the private key: you approved a contract once fo Inputs: owner, chain, fromBlock |
till_receipt | Produce the chain-anchored receipt for a VERIFIED payment (txHash + basescan link). Refuses without verification. Inputs: to, amountUsd, label, merchantName, lookbackBlocks |
till_recovery_offer | THE SECOND THEFT: judge an approach offering to recover already-stolen funds. Every other tool here tries to stop the first loss; this exists because the first loss is what makes a person findable, and a drained wallet is a lead with a mark Inputs: address, chain, asksForSignature, asksForUpfrontPayment, asksForSeedOrKey, asksToInstall |
till_resolve | IDENTITY BRIDGE: resolve an AGENT identity — a buzz/Nostr npub (64-hex secp256k1) AND/OR a gitlawb did:key (Ed25519) — to a payable, trust-assessable BASE address, trustlessly. The binding is a BIDIRECTIONAL attestation: each identity key A Inputs: npub, did, address, nonce, chainId, expiry |
till_roll | PROVABLE BOOKS: render an agent/merchant's till roll — a shareable statement where EVERY line carries its own txHash + basescan link, so the reader re-verifies each payment on Base themselves (trust no one, not even BIII). This is the subst Inputs: receipts, merchantName, lang, brand |
till_rug_powers | WHO CAN STILL RUG THIS TOKEN? till_vet_meme says which contract is the real one; this says whether the real one is itself a trap. A dangerous capability only counts if someone can still FIRE it — mintable with ownership renounced is inert, Inputs: address, chain |
till_seed_exposure | IS A RECOVERY PHRASE SITTING IN CLEARTEXT ON THIS MACHINE? Everything else here answers whether an ADDRESS is safe to pay; this answers whether the MACHINE is safe to hold a wallet, and a safe address on a compromised machine is worth nothi Inputs: paths |
till_trace_theft | FOLLOW STOLEN FUNDS from the victim's transaction to where the trail dies. Three modes. moved: what actually left a wallet in one transaction, marking which transfers are AUTHENTIC — ERC-20 Transfer logs are attacker-controlled text, so onl Inputs: mode, txHash, address, chain, maxHops |
till_trust | The TRUST TRIANGLE in one call: composes reputation, standing (LAWBOR proven history, if BIII_LAWBOR_URL set) and settlement (on-chain, if amountMicro given) into ONE verdict (unsafe/unknown/trusted/settled). Reputation is shown as TWO LENS Inputs: counterparty, amountMicro, rail, resourceUrl, agentId, erc8004Summary |
till_verify_delivery | I CAN PROVE I PAID. CAN I PROVE I WAS SERVED? Every other check here runs before money moves; this is the question after, and it is the one nothing in this market answers. A payment is a fact on Base that anyone can re-check forever; the de Inputs: commitmentHash, received, receivedHash, paidAt, committedAt |
till_vet_agent | IS THIS AGENT SAFE TO CONNECT TO, AND SAFE TO PAY? The gap this closes: everything else here judges tokens, launches, thefts and wallets, but never the AGENT — which is the thing that actually holds the tools. Four checkable dangers, none o Inputs: url, payTo, chain |
till_vet_approach | JUDGE AN INBOUND OPPORTUNITY BY ITS ASK, NOT BY HOW GOOD IT LOOKS (podcast, interview, partnership, job, AMA). Built from a lure that worked on someone who verifies counterparties professionally: a 35-question production dossier citing his Inputs: links, platform, asksToInstall, asksForKeyOrSeed, asksForSignature, asksForUpfrontPayment |
till_vet_asset | Is a TOKENIZED ASSET (stock/treasury/RWA) contract the GENUINE issuer's, or an impersonator? genuine / impersonation / unsafe / unknown — fail-closed (unknown is never genuine). Catches the FBI-flagged lookalike-token fraud. Registry is aut Inputs: token, claimedIssuer, claimedSymbol |
till_vet_meme | Which contract is the REAL memecoin among 10+ look-alikes? Fail-closed verdict from live market data (DexScreener). Returns: genuine (one contract dominates liquidity), ambiguous (top-2 tied — never certified), impersonation (the address yo Inputs: symbol, chainId, address, siblingCount |
till_vet_merchant | MainStreet safe-to-pay preflight on a merchant address. Returns the hosted oracle read (advisory) AND a LOCAL CLASSIFIER verdict computed on this node via trust-core (pure, zero-oracle) — so a verdict holds even if the oracle is down. Vet t Inputs: address, resourceUrl |
till_watch_wallet | WHAT CHANGED AROUND THIS WALLET SINCE WE LAST LOOKED? The other tools answer at a point in time; this is what turns them into a guard, because it REMEMBERS and therefore distinguishes a new door from an old one. Three unlimited approvals gr Inputs: owner, chain, persist |
Every block below points at https://biii-production.up.railway.app/mcp. Pick your client and copy.
claude mcp add --transport http biii https://biii-production.up.railway.app/mcp
{
"mcpServers": {
"biii": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://biii-production.up.railway.app/mcp"]
}
}
}{
"mcpServers": {
"biii": {
"url": "https://biii-production.up.railway.app/mcp"
}
}
}{
"servers": {
"biii": {
"type": "http",
"url": "https://biii-production.up.railway.app/mcp"
}
}
}{
"context_servers": {
"biii": {
"url": "https://biii-production.up.railway.app/mcp"
}
}
}{
"mcpServers": {
"biii": {
"serverUrl": "https://biii-production.up.railway.app/mcp"
}
}
}{
"mcpServers": {
"biii": {
"url": "https://biii-production.up.railway.app/mcp"
}
}
}name: Biii
version: 0.0.1
schema: v1
mcpServers:
- name: Biii
type: streamable-http
url: https://biii-production.up.railway.app/mcp{
"mcpServers": {
"biii": {
"httpUrl": "https://biii-production.up.railway.app/mcp"
}
}
}{
"mcpServers": {
"biii": {
"type": "http",
"url": "https://biii-production.up.railway.app/mcp"
}
}
}{
"mcpServers": {
"biii": {
"url": "https://biii-production.up.railway.app/mcp"
}
}
}goose://extension?url=https%3A%2F%2Fbiii-production.up.railway.app%2Fmcp&type=streamable_http&id=biii&name=Biii
It answered our last check on 23 October 2026 in 212 ms. Over 6 checks since 11 September 2026 it answered 6. Status here comes from Neuronto's own probes, not from the publisher.
29, as returned by the server's own tools/list on 17 September 2026: till_authorize, till_b20_authentic, till_check_invoice, till_check_payment, till_create_charge, till_create_invoice, till_export, till_floor, and 21 more.
It answered our last check on 23 October 2026 in 212 ms. Over 6 checks since 11 September 2026 it answered 6.
Put the server under mcpServers in ~/.cursor/mcp.json with the URL https://biii-production.up.railway.app/mcp. The exact JSON is above, with the same setup for Claude Code, Claude Desktop, VS Code, Windsurf, Zed, Gemini CLI and the rest.
It listed its tools to an anonymous client, so reading the tool list needs no key. Individual tools can still ask for credentials in their own inputs.
Publisher: io.github.philpof102-svg. Endpoint host: biii-production.up.railway.app. ARD identifier: urn:air:io.github.philpof102-svg:mcp:biii.
First indexed 10 September 2026. The tools are exactly what the server returned; nothing on this page
is inferred from its name. Ranking in Neuronto search is never for sale.