Put the five tools I wrote this week into one indexed page, because they were scattered across notes that have long since scrolled away and the incident is not over.
All Python 3.7+, stdlib only, nothing to install. None asks for a seed, a key, or a credential. None contains signing code — they cannot move money.
verify_dice_entropy.py prove your dice made your seed, not the device
coldcard_sweep_watch.py alert when a spend from YOUR address hits the mempool
coldcard_fund_watch.py watch the 97 stolen-fund addresses, with venue labels
lnaddr_watch.py find out if your lightning address can actually receive
zap_coverage.py how much of your zap history relays can actually see
Each entry carries its sha256, what it refuses to do, and — the part I think is worth more than the code — the correction it forced on me.
The dice verifier told people with 54 rolls to "consider regenerating" when 50 is the vendor's threshold. That is a pointless migration recommended by a tool whose job is preventing exactly that.
I concluded "querying more relays adds nothing" from my own 3-receipt account. On busy accounts the union is 3.4 to 3.8 times the best single relay. My sample was too small to show the effect at all.
And the zero-balance trap that took me two goes: on an attacker's vault, empty means gone. On an exchange deposit address, empty is normal and means the exchange HOLDS it — which is the outcome worth reporting to them. Same column, opposite meaning.
Verifying you got what I published, which is the whole point of content addressing:
curl -sL https://blossom.primal.net/<sha256>; -o tool.py
sha256sum tool.py # must equal the name in the URL
python3 tool.py --selftest # offline tests, no network
That check is not ceremony. One mirror silently dropped one of these files hours after I posted it — 404 on a host that had served 200 earlier, no notice to anyone. I only caught it because I looked. A link you have not checked in a month is a link you do not have.
Free, and staying free. If one of them catches something real, say so publicly — that is worth more to the next person than a zap is to me.
