Transaction forensics
Explain what an EVM transaction actually did: confirmation status, the raw transaction from the chain, decoded calldata with typed parameters, the resolved function signature, and labeled counterparties.
5 tools run server-side in one request. You pay once, settle once, and get a single response - no orchestration, no per-step payments, and a partial-success envelope if any step fails. USDC over x402 on any supported chain.
When to use this pack
An agent (or its owner) is staring at a transaction hash and needs the plain-English story - did it confirm, which function was called, with what arguments, and is the counterparty a known contract or an unknown address.
Tools in this pack
All 5 run inside the single $0.10 call above. Each is also callable on its own if you only need one part.
- Transaction status GET /api/tx-status Check the confirmation status of a transaction by hash on Base/Polygon/Arbitrum/Optimism/Ethereum/Monad/Celo/Avalanche/Sei/Robinhood Chain: success / failed / pending / not found, with block, from, to, gas used. Read-only. ?hash=0x…&network=base
- Multi-chain EVM RPC (read-only) POST /api/evm-rpc Read-only JSON-RPC against Ethereum, Base, Polygon, Arbitrum, or Optimism with built-in multi-endpoint failover - one paid call, no node or API key of your own. Prefer the named reads (block-number, chain-info, block-info, event-logs, erc721-owner, contract-code) for common tasks - they validate inputs and cost less; use this when you need a whitelisted method they do not wrap. Whitelisted methods only: eth_blockNumber, eth_gasPrice, eth_getBalance, eth_getTransactionCount, eth_getBlockByNumber, eth_getTransactionByHash, eth_getTransactionReceipt, eth_call, eth_getCode, eth_getStorageAt, eth_chainId, eth_feeHistory, net_version. Mutating, signing, subscription, and unbounded methods (eth_getLogs) are rejected. Results over 200KB serialized return 413 - narrow the query.
- Calldata decoder (ABI or selector DB) POST /api/calldata-decode Decode EVM smart-contract transaction calldata into the function name and typed parameters. Supply an ABI (from /api/contract-abi) or a signature like transfer(address,uint256) for a fully offline decode; with neither, the 4-byte selector is resolved via the openchain.xyz signature database (4byte.directory fallback) and each candidate signature is tried. Unknown selectors return a documented partial decode (selector + raw 32-byte words) instead of an error.
- Function selector / event topic lookup POST /api/selector-lookup Resolve a 4-byte function selector or a 32-byte event topic hash to its known human-readable Solidity signatures, via the openchain.xyz signature database with 4byte.directory as fallback. Unknown selectors return {found:false} with an empty list, not an error.
- Known-address label lookup POST /api/address-label Label a known EVM address from a curated, committed dataset: major stablecoin + token contracts (USDC on every chain we settle on, USDT, DAI, WETH, WBTC), DEX routers (Uniswap, 1inch, 0x), canonical L1↔L2 bridges, large exchange hot/cold wallets, and burn/system addresses. Deterministic and offline - the provenance field states the dataset revision. Unknown addresses return {found:false}, not an error.
Workflow
- Get the confirmation verdict from tx-status - success, revert, or still pending, plus gas used and block number.
- Pull the raw transaction with evm-rpc eth_getTransactionByHash for the from/to addresses, value, and the input calldata.
- Decode the calldata with calldata-decode - function name and typed parameters via ABI signature databases.
- Cross-check the 4-byte selector with selector-lookup to surface every known signature that matches.
- Label the counterparty with address-label - known token contract, DEX router, bridge, exchange wallet, or unknown.
Call it directly
Any x402 client pays the 402 and gets the whole workflow back in one response:
npx agent402-client call tx-forensics {"hash":"0x0000000000000000000000000000000000000000000000000000000000000000","network":"base"}
Run it in Claude
claude mcp add agent402 -s user -- npx -y agent402-mcp@latest
Then paste this prompt into Claude:
Explain what transaction 0x0000000000000000000000000000000000000000000000000000000000000000 on base actually did, using Agent402's tx-forensics skill pack. (1) Check its confirmation status, (2) fetch the raw transaction via eth_getTransactionByHash, (3) decode the calldata into the function and arguments, (4) resolve the selector against the signature databases, (5) label the destination address. Summarize as a plain-English story: what was called, with what arguments, by whom, to whom, and whether it succeeded.