Messiah's answer

Messiah protects the exact moment a user gets deceived. Beyond domain blocklists, it:

• Intercepts every wallet signing request before it reaches your wallet
• Runs Fusion Analysis — cross-checking what a site claims to do against what you're actually signing, catching "Claim Airdrop" pages that really request unlimited token approvals
• Detects EIP-7702 malicious delegations, an emerging attack vector most scanners misclassify as safe

TranscriptFetch's answer:

Most short-form video has no caption track to download. TikTok’s auto-captions are opt-in per upload, Instagram never publishes a downloadable track, and many captions on both are burned into the video frames where no parser can read them. TranscriptFetch transcribes the audio when no caption track exists, on the same endpoint, with the same response shape. Your code never branches on which method produced the text. It also covers YouTube, TikTok, Instagram, X and Facebook plus any web page as clean Markdown, so a pipeline spanning several sources is one integration rather than five.

Messiah's answer

Most tools rely on blocklists or transaction simulation alone. Messiah combines both with AI content analysis:

• Site Scan — analyses the page before you connect
• Sign Analyze — simulates asset changes and explains the risk in plain language, in five languages
• Address Check — cross-references Etherscan, GoPlus, Chainabuse and Revoke.cash

We benchmarked it against 100 live scam sites (90% detection) and published the gaps we found — so you know exactly what it catches and what it doesn't.

TranscriptFetch's answer:

Three reasons. Coverage: one API key and one response shape across five video platforms and the open web, instead of stitching together a library per platform. Reliability: requests run through rotating infrastructure, so code that works locally keeps working from a server, which is where most open-source approaches break. Billing that matches reality: one credit per successful response, with failed, blocked and empty results never charged. That last point matters on short-form video, where a meaningful share of any batch is music with no speech in it. There is also an MCP server, so AI agents can fetch transcripts as a tool without a custom integration.

Messiah's answer

• Crypto users who interact with dApps — DeFi traders, NFT collectors, and first-time wallet users
• Institutions (exchanges, banks entering Web3) needing on-premise front-end phishing protection for their customers

TranscriptFetch's answer:

Developers and technical teams building on video and web content. The common cases are RAG and retrieval pipelines that need video as text, AI agents that need to read a link mid-conversation, content teams repurposing short-form video at scale, and media monitoring and research tools. It is an API first, so the buyer is usually the person writing the integration rather than an end user. The free browser tools exist for one-off transcripts and for evaluating output quality before writing any code.

Messiah's answer

Messiah was born from the $1.5B Bybit hack — the largest crypto theft in history, executed through a compromised front-end that made signers approve something they couldn't see.

At ETHGlobal Taipei 2025, our team built a proof-of-concept recreating that exact attack: a simulated wallet front-end with injected malicious logic, and an AI pipeline that analysed the front-end JavaScript to catch it. The project won the HashKey Chain Award (On-Chain Infrastructure Compliance Innovation) and the Celo L2 Pool Prize.

We then joined Cyberport's Web3 Pilot Scheme and spent months turning the PoC into a real product — benchmarking it against 100 live scam sites and publishing what it caught and what it missed — before launching on the Chrome Web Store.

TranscriptFetch's answer:

It started with discovering there is no good way to get the text of a video. YouTube’s official Data API will confirm a caption track exists and then refuse to hand it over, because captions.download requires the video owner’s OAuth token. The popular open-source libraries work until you deploy them, at which point platforms start refusing datacenter IPs. And YouTube is the easy case: TikTok and Instagram publish no caption file at all. Every workaround solved one platform, worked locally, and broke in production. TranscriptFetch is the version that handles the failure cases as first-class behaviour rather than edge cases.

Messiah's answer

• Extension — TypeScript + React, built with Vite (CRXJS), Manifest V3
• Backend — Node.js + Express (TypeScript), PostgreSQL with Drizzle ORM, Zod validation
• AI — GPT-class LLM via a model-agnostic LiteLLM proxy (per-scan-type model routing)
• Simulation — Alchemy transaction simulation (asset-change preview before signing)
• Threat intelligence — MetaMask eth-phishing-detect, GoPlus, Chainabuse, Etherscan, Revoke.cash, VirusTotal

TranscriptFetch's answer:

Next.js with TypeScript and Tailwind on the front end and API layer, Clerk for auth with SHA-256 hashed API keys, Neon Postgres with Drizzle ORM, Redis for caching, and Stripe for billing. The extraction layer is a Python and FastAPI service. Speech-to-text uses Whisper-class models. The MCP server is published in the official Model Context Protocol registry with a DNS-verified namespace.

Messiah's answer

• Individual Web3 users via the Chrome Web Store (recently launched)
• Early-access security researchers and DeFi power users