The extension reads the token address from the terminal's page and asks this server for a verdict. It never sees your wallet.