blocktools CLI

Commands

44 man(1) pages: the 42 tools in bin/, the blocktools wrapper and recover.sh (man blocktools lists them). Summaries are the man pages' NAME lines.

Read wallets and derive addresses

Old wallet files and seed phrases in, public addresses out.

classify: unknown wallet material -> public JSON lines, one per item:
recover.sh: unknown wallet file to sweep, with human confirmation at each step
seed-repair: read a (possibly mistyped) BIP39 / Electrum 2.x phrase, print checksum-valid
seed-to-master: seed phrase (+ optional passphrase) -> BIP32 master key(s)
derive: master key -> child keys and addresses. A Swiss Army knife for "which path
key-to-addresses: one raw 32-byte private key per line -> addresses on every chain in the
xpub-addresses: extended public key (xpub/ypub/zpub/tpub..., stdin, one per line) -> watch-only · try it on SwapChan: Xpub to addresses
keystore-open: Ethereum Web3 Secret Storage v3 JSON + password -> address
dat-read: Bitcoin Core wallet.dat (legacy Berkeley DB or SQLite descriptor
electrum-read: Electrum wallet file (JSON, optionally field-encrypted, or BIE1 whole-file encrypted) -> its seed phrase
armory-read: Armory (PyBtcWallet) `.wallet` -> {"wif","chain_index"} per stored address
multibit-read: MultiBit Classic .key export, bitcoinj/MultiBit Classic `.wallet` protobuf, or
blockchain-read: Blockchain.com wallet.aes.json (v2/v3) + password -> wif / xprv lines
bip38-open: BIP38 encrypted private key + passphrase -> WIF. Spec vectors only for non-EC
phrase-to-key: pre-BIP39 brainwallet phrase -> raw 32-byte private key, one line per scheme
pw-candidates: expand a token list into password candidates (btcrecover-style, from public
xmr-keys: xmr-keys [--net main|stage|test] [--scan-out FILE [--restore-height N]] < seed
zec-sapling: zec-sapling [--count N] [--unified] [--viewkey-out FILE] < BIP39 mnemonic

Build, check, sign and send transactions

Unsigned transactions are built offline; a human types a code before signing and before broadcast.

utxo-fetch: utxo-fetch (HOST-SIDE, network): public chain data for addresses -> files tx-build reads
tx-build: build an UNSIGNED transaction offline from files and flags. Never touches the network
tx-decode: one transaction on stdin (hex/base64 raw tx, PSBT, EVM RLP, or a JSON line with
tx-verify: check a transaction (stdin; any format tx-decode reads) against what you expect
tx-envelope: common signing envelope (public half). Reads one JSON object from stdin
tx-sign: sign ONE transaction after a human reads its summary and types a code on /dev/tty
tx-broadcast: tx-broadcast (HOST-SIDE, network): send ONE already-signed transaction, after the human reads
acct-tx: account-model payments for xlm, algo and atom. Encoded transactions are base64 (each chain's native form)
sol-tron-tx: build unsigned, decode and verify Solana and Tron transfers. The chain is detected · try it on SwapChan: Tron raw_data decoder
xrp-tx: xrp-tx keys < family-seed -> {"chain":"xrp","algo","address","x_address","public"} (public only)
xmr-wallet: host-side driver for a LOCAL monero-wallet-rpc (loopback only; never runs in the sealed image)

Contracts, ABI and messages

Offline EVM helpers and message signatures.

abi-encode: Solidity ABI-encode calldata (selector + args) or a bare type list, offline
abi-decode: decode Solidity ABI calldata, returndata, revert data or event logs, offline · try it on SwapChan: ABI decoder
abi-inspect: list an ABI's functions, events and errors with selectors/topics, flag selector
sig-hash: Solidity function/event/error selector and topic hash, plus reverse lookup against a file you supply
create-address: contract address from CREATE (deployer, nonce) or CREATE2 (EIP-1014: deployer, salt, init code), offline · try it on SwapChan: CREATE / CREATE2 address
bytecode-inspect: classify runtime bytecode (EIP-1167 proxy, EIP-7702 delegation, EOF, plain code), · try it on SwapChan: Contract bytecode inspector
typed-data-verify: EIP-712 typed data -> encodeType, domain separator, message hash and digest; · try it on SwapChan: EIP-712 typed data
msg-verify: check a message signature against an address. No keys are read
msg-sign: sign ONE text message after a human reads it and types a code on /dev/tty

Chains, RPC and the sealed boundary

The chain registry, node RPC, and the tools that keep secrets inside the sealed run.

chain-table: print the chain registry (crates/core chains.rs) as data, one JSON object per · try it on SwapChan: Chain parameters table
rpc: pipe filter for node and wallet RPC endpoints (HOST-SIDE, network)
blocktools: host wrapper that runs a pipeline in the sealed container
sealed-run: the agent-facing boundary. Runs a pipeline of blocktools tools
redact: stdin raw JSON lines (may contain secrets) -> stdout public lines
read-file: concatenate files to stdout (like cat), std only. Exists so the