Base Token Audit — ERC-20 honeypot check and swap route data

com.oroboros-design.angelPublished by angel.oroboros-design.comOfficial publisherv1.0.0Updated Nov 14, 2026

ERC-20 honeypot and rug-pull check on Base and Ethereum, plus free swap route data.

The publisher's own server: Agent safety checks: prompt-injection scan, honeypot check, x402 preflight + crypto data (USDC/x402)

VerifiedStreamable HTTPWeb executableFinanceSecurity & Monitoring

Overview

AI-generated overview

Checks ERC-20 tokens on Base and Ethereum for honeypot and rug-pull risk, and returns free swap route data for tokens an agent is about to trade.

What you can do
  • Check a token contract for upgradeable proxies, owner powers in the bytecode, owner status and owner share of supply, with a low, medium or high risk rating and reasons
  • Get the best swap route on Base or Ethereum: quote, minimum out, approval target and, with a taker address, an unsigned transaction the agent signs and sends itself
  • Buy prepaid call packs by card when the free calls run out, returning a checkout link
When to use it
Use it when an agent is about to swap into, approve or sign for an ERC-20 on Base or Ethereum and you want a contract-level risk read first, then a route quote. It is a data and analysis service, not a trading bot.
Requirements
Remote streamable HTTP endpoint, no install or account needed; a stdio bridge is available via npx on Node 18+. An optional X-API-Key header (or ANGEL_API_KEY for the bridge) identifies the agent for its free calls. Paid calls need USDC on Base via x402, a prepaid bundle token, or a card purchase.
Before you install
Paid usage: 3 free token_risk calls per agent, then 0.99 USDC per call via x402, or prepaid packs bought by card (100 calls 5.00 EUR up to 5,000 calls 199.00 EUR). A disclosed 0.5% integrator fee is deducted inside swaps you send. The server holds no funds and does not execute orders, but it returns unsigned transactions and approval targets that you sign yourself, so verify them. Sell restrictions that only trigger during a trade are not simulated.

Installation

In SourceWeft

  1. Open Base Token Audit — ERC-20 honeypot check and swap route data in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.oroboros-design.angel%2Fbase-token-audit/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "base-token-audit-erc-20-honeypot-check-a": {
      "type": "http",
      "url": "https://angel.oroboros-design.com/mcp/base-token-audit"
    }
  }
}

README

mcp-base-token-audit

ERC-20 honeypot check and swap route data — a single-purpose MCP server for AI agents. No install, no account: it runs as a remote server; this repo also has a zero-dependency stdio bridge.

https://angel.oroboros-design.com/mcp/base-token-audit

Use it

Claude Code

bash
claude mcp add --transport http base-token-audit https://angel.oroboros-design.com/mcp/base-token-audit

Claude Desktop, Cursor, Windsurf, VS Code (remote server)

json
{ "mcpServers": { "base-token-audit": { "url": "https://angel.oroboros-design.com/mcp/base-token-audit" } } }

Any stdio client (Node 18+)

json
{ "mcpServers": { "base-token-audit": { "command": "npx", "args": ["-y", "github:daoudandiaye98-alt/mcp-base-token-audit"] } } }

Then ask your agent, for example: Before swapping 10 USDC into 0x… on Base, run token_risk; only if the risk is low, ask get_swap_route for the transaction.

Tools

ToolPriceWhat it does
token_risk3 free calls per agent, then 0.99 USDCReads the contract: upgradeable proxy (EIP-1967, beacon, clone), owner powers in the bytecode (mint, pause, blacklist, fee or max-tx setters, trading switch, burn from any address), owner renounced or active and owner share of supply. Risk low, medium or high with reasons.
get_swap_routefreeBest route on Base or Ethereum (KyberSwap, 0x as fallback): quote, minimum out, approval target and, with taker, the unsigned transaction your agent signs and sends itself.
buy_pack_with_card—Prepaid calls by card (Stripe) when the free calls are used up.

Paying

The first 3 paid calls per agent are free (identify your agent with the header X-API-Key, or set ANGEL_API_KEY for the stdio bridge). After that each call is paid per request in USDC on Base via x402 (params._meta["x402/payment"]), with a prepaid pack (bundle_token) or by card (buy_pack_with_card). The 402 answer names the exact amount and the pay-to address before anything is signed.

Angel is a technical data and risk-analysis service only: no custody, no execution or transmission of orders, no investment advice. The disclosed 0.5 % integrator fee is a technical API provisioning fee for computing the route data; the aggregator deducts it inside a swap you send yourself. Signals from on-chain code — sell restrictions that only trigger during a trade are not simulated.

More

  • Same checks as a library: npm i angel-agent-guard · pip install angel-agent-guard (angel-agent-guard)
  • All of Angel's tools in one server: https://angel.oroboros-design.com/agenten/signal/mcp · A2A agent card: https://angel.oroboros-design.com/.well-known/agent.json
  • MCP Registry: com.oroboros-design.angel/base-token-audit

Operated by Oroboros Design (Köln, Germany). MIT licence for the code in this repo.

Source: README.md at commit 38424c6

Tools

3

token_risk

Honeypot and rug-pull check for an ERC-20 before swap or approve

Honeypot and rug-pull check for an ERC-20 on Base or Ethereum before a swap, approval or signature, read straight from the contract: upgradeable proxy (EIP-1967, beacon, clone), owner powers in the bytecode (mint, pause, blacklist, fee or max-tx setters, trading switch, burn from any address), owner renounced or active and the owner's share of supply; known issuers labeled. Risk low, medium or high with reasons. Signals, not investment advice. 0.99 USDC base (new payers 0.99, >10 payments 0.693; 20 pack calls). After: gas-window before you trade on that chain (the result's next field has the exact call).

Parameterschaintokenrequiredpayment_txbundle_tokenpayer_address

buy_pack_with_card

TradeSignal: pack by card

For agents and people without USDC: prepaid packs paid in EUR by card or Link (100 calls €5.00 · 500 calls €25.00 · 5,000 calls €199.00) — including Link's wallet for agents (one-time card, approved by the human). Returns checkout_url; after payment the success page (Accept: application/json) returns the bundle_token, and it is e-mailed. After: get_signals with bundle_token.

Parameterscallsemail

get_swap_route

Swap route on Base (free)

Free route data: the best swap route on Base (or Ethereum) for a token you already checked with token_risk — quote, minimum out, approval target and, with taker, the unsigned transaction you sign and send yourself. Technical data and risk-analysis service only: no custody, no order execution, no investment advice. Disclosed: the 0.5 % integrator fee is a technical API provisioning fee for computing the route data, deducted by the aggregator inside the swap and sent to Angel's wallet; buy_amount is already net of it. Run token_risk on buy_token first. After: approve the spender if approval is set, then send the transaction from your own wallet.

Parameterschaintakerbuy_tokenrequiredsell_tokenrequiredsell_amountrequiredslippage_bps

Version history

1
  1. v1.0.0LatestNov 14, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Oroboros-Design integrations

Agent safety checks: prompt-injection scan, honeypot check, x402 preflight + crypto data (USDC/x402)

com.oroboros-design.angelOfficial publisher

Paid crypto trading feed: Binance spot trade setups, setup validation, market regime, funding, liquidations and order-flow metrics, billed per call in USDC…

Streamable HTTPWeb executable
Finance28 toolsNov 14, 2026

Prompt Sanitizer — prompt-injection scan for untrusted content

com.oroboros-design.angelOfficial publisher

Remote MCP server that scans untrusted text or web pages for prompt injection and hidden instructions before an assistant acts on them.

Streamable HTTPWeb executable
Security & Monitoring3 toolsNov 14, 2026

Checkout Guard — pre-purchase check for shops, payment links and paid APIs

com.oroboros-design.angelOfficial publisher

Remote MCP server that runs a pre-purchase safety check on a shop, checkout or payment link, paid API or x402 endpoint and returns a pay, caution or…

Streamable HTTPWeb executable
Finance2 toolsNov 14, 2026