Every rug frays before it's pulled.

We hash the tool definitions of public MCP servers, Agent Skills and their packages every hour, and stamp each hour on Robinhood Chain.

Reading the watchtower…

1 thread = 1 tracked server, skill or package1 row = 1 hour stamped on chaindrag a loose thread

    How it works

    Read. Hash. Stamp. Every hour.

    1. 01

      Read

      Every hour we read the official MCP registry and call tools/list, prompts/list and resources/list on each public remote server, plus popular SKILL.md files and package metadata from npm and PyPI. Read only: we never install or run anything.

    2. 02

      Hash

      Each tool definition (name, title, description, input and output schema, annotations) is canonicalised with RFC 8785 and hashed with keccak256. One leaf per server, skill and package.

    3. 03

      Stamp

      All leaves of the hour go into one merkle tree. Its root is posted to the ToolAnchor contract on Robinhood Chain, and the full snapshot is published so anyone can rebuild it.

    When a definition changes, we keep both versions, show the diff and score it with plain rules: new instructions aimed at the model, hidden unicode, new hosts, sensitive paths, new free-text parameters, sudden length jumps, a new package maintainer.

    • cosmeticscore under 20 · wording only
    • behavior20 to 59 · what the tool asks for or does changed
    • suspicious60 or more · also flagged on chain with flag()

    Labels describe the diff, not intent. Every label links to the raw diff and the on-chain proof.

    Verify it yourself

    Don't trust us. Check the chain.

    From your agent

    /mcp

    FRAYWICK is itself a read-only remote MCP server with four tools: check_server, check_skill, recent_changes, get_proof. Its own tool hashes sit in its own snapshots.

    From your browser

    Every server page has a verify in your browser button: it fetches the proof and calls verify(epoch, leaf, proof) on chain. Proof rebuilds any hour's root from its snapshot.

    The token

    The token

    Contract address

    0x0000000000000000000000000000000000000000

    Shown as the zero address until launch. Only trust the address on this page.

    Launch on Pons

    —

    Buy on Pons

    Tax 0%. Creator fees go to the creator wallet. The token has no fee, pot or burn mechanics, and holding it changes nothing about what FRAYWICK watches or shows.

    FAQ

    Questions

    What is an MCP rug pull?

    An MCP server's tools come with descriptions that the model reads as instructions. A server can look harmless when you add it, then change a description later, for example telling the model to read a private file and pass it along. Clients rarely show those changes. FRAYWICK records every version and stamps when it changed (OWASP MCP03, tool poisoning).

    Do you run the servers or install the packages?

    No. We only read: registry JSON, tools/list and friends over HTTPS, package metadata from npm and PyPI, and skill files as text. Nothing third-party is installed, imported or executed, and fetched text is never fed to a model as instructions.

    What does "suspicious" mean?

    The change scored 60 or more on plain rules (see above). It is a description of the diff, not an accusation. Read the diff and decide.

    What about servers that need a login?

    Servers that answer 401 or 403 are recorded as auth-required with their registry metadata only. We do not log in anywhere.

    Why put it on a chain?

    So nobody has to trust our database. Each hour's merkle root is on Robinhood Chain with the time it was posted, and the snapshot behind it is public, so anyone can prove what a tool said at a given hour.

    I run a server. How do I opt out?

    See the bot policy: our user agent, our rate and how to ask us to stop.