Token Safety & Contract Risk API

io.github.Br0ski777Published by GitHub account Br0ski777v1.1.0Updated Oct 24, 2026

Token safety check — honeypot, tax, proxy, blacklist, risk score. GoPlus-powered. x402.

VerifiedSSEWeb executableFinanceSecurity & Monitoring

Overview

AI-generated overview

Remote MCP endpoint that checks a token contract's safety — honeypot, taxes, proxy, blacklist, ownership — and returns a risk score, paid per call.

What you can do
  • Check a token contract's safety on Ethereum or Base and get a JSON risk report
  • Read honeypot status, ownership renounced, proxy upgradeability, buy and sell tax, max transaction size, liquidity lock, blacklist function, holder count and a 0–100 risk score
When to use it
Useful when an assistant is about to buy or interact with a new or unknown token and needs a quick due-diligence check for rug-pull risk. It covers contract safety only, not prices, wallet balances or holder distribution.
Requirements
A remote MCP endpoint reached over SSE; no API key or signup. Each call is paid per request in USDC on Base L2 through the x402 protocol, so an x402-aware client with a funded wallet is needed to complete the payment challenge.
Before you install
Every call costs money ($0.008 per check) and requires a wallet that signs USDC payments on Base; the payment challenge is handled by the client. The results come from a third-party scanner (GoPlus) and are advisory, not a guarantee of safety.

Installation

In SourceWeft

  1. Open Token Safety & Contract Risk API in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via SSE. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.Br0ski777%2Ftoken-safety/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "token-safety-contract-risk-api": {
      "type": "sse",
      "url": "https://token-safety.api.klymax402.com/mcp"
    }
  }
}

README

Token Safety & Contract Risk API

[MCP Server] [x402] [License: MIT]

Token contract safety scanner -- honeypot, tax, proxy, blacklist, ownership. Rug-pull protection for agents. Pay-per-call via x402 (USDC on Base L2) -- no API key, no signup, no rate-limit wall.

Part of the klymax402 marketplace -- 100 x402 micropayment APIs for AI agents, one wallet, USDC on Base.

Quickstart -- MCP

Add to your MCP client config (Claude Desktop, Cursor, ElizaOS, etc.):

json
{  "mcpServers": {    "token-safety": {      "url": "https://token-safety.api.klymax402.com/mcp"    }  }}

Quickstart -- HTTP (x402)

bash
curl "https://token-safety.api.klymax402.com/api/check?address=0x0000000000000000000000000000000000dEaD"# -> 402 Payment Required, with an x402 payment challenge in the response body

Any x402-aware client (@x402/fetch, x402-agent-tools, ATXP) handles the 402 -> sign -> retry cycle automatically.

Tools

ToolMethodPathPriceDescription
token_check_safetyGET/api/check$0.008Check token contract safety and risk score

token_check_safety

Use this when you need to check if a token is safe before buying or interacting with it. Returns a comprehensive safety report in JSON.

Parameters

NameTypeRequiredDescription
addressstringyesToken contract address (e.g. 0x...)
chainstringnoChain to check on: 'ethereum' or 'base' (default: ethereum)

Returns

  • isHoneypot -- whether the token traps buyers (cannot sell)
  • ownershipRenounced -- whether the contract owner has renounced control
  • isProxy -- whether the contract is upgradeable (proxy risk)
  • buyTax -- percentage tax on buy transactions
  • sellTax -- percentage tax on sell transactions
  • maxTxPercent -- maximum transaction size as percent of supply
  • liquidityLocked -- whether liquidity is locked
  • hasBlacklist -- whether contract has a blacklist function
  • holderCount -- total number of token holders
  • riskScore -- overall risk score (0=safe, 100=dangerous)

Example response:

json
{"isHoneypot":false,"ownershipRenounced":true,"isProxy":false,"buyTax":0,"sellTax":0,"maxTxPercent":100,"liquidityLocked":true,"hasBlacklist":false,"holderCount":15420,"riskScore":12}

When to use: buying any new or unknown token. Essential for rug-pull protection and due diligence.

Not for: token prices (use dex_get_swap_quote), wallet balance (use wallet_get_portfolio), holder distribution (use token_get_holder_analysis).

Example agent prompts

  • "Check if a token is safe before buying or interacting with it"

Payment

  • Protocol: x402 -- HTTP-native pay-per-call, no signup, no API key
  • Network: Base L2 (eip155:8453)
  • Asset: USDC
  • Facilitator: Coinbase CDP (primary), PayAI (fallback)
  • Also reachable via ATXP (OAuth-wrapped x402, RFC 9728 protected-resource metadata)

Part of klymax402

100 x402 micropayment APIs for AI agents -- one wallet, USDC on Base, zero signup.

License

MIT

Source: README.md at commit e68bdee

Tools

0
SourceWeft has not read this server's tools yet.

Version history

1
  1. v1.1.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declaredRequired10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts