io.github.gl1tchbased-pixelPublished by GitHub account gl1tchbased-pixelv1.0.0Updated Oct 29, 2026
Token rug-risk scans, Know Your Agent wallet checks and deployer reputation for AI agents.
Remote MCP server that lets an assistant run read-only crypto token safety scans, check wallet trust scores and look up deployer reputation before trading.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/io.github.gl1tchbased-pixel%2Fgl1tch/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Add this to your client's mcpServers config.
{
"mcpServers": {
"gl1tch-token-safety": {
"type": "http",
"url": "https://gl1tchbased.xyz/api/mcp"
}
}
}A free, open-source token safety scanner for Solana (plus 15 EVM chains). Paste any token and get a 0–100 risk score with a plain-language reason for every check, in seconds. Read-only: it never asks for a signature, never touches a wallet, and costs nothing to use.
mobile/Most tokens launched on Pump.fun collapse shortly after launch (Solidus Labs counted 98.6% of 7M+ tokens from Jan 2024 to Mar 2025 as pump-and-dumps). The warning signs sit in on-chain state that buyers can't read: a live mint authority, a freeze authority, a hidden Token-2022 transfer fee, unlocked liquidity, bundled sniper wallets, a deployer with a history of rugs. GL1TCH reads that state, explains it in plain words, and gives it away for free.
A token whose volume is botted, or whose holders are mostly one linked network, can't read better than CAUTION,
whatever its contract looks like. The scan also flags a token that has fallen 85% or more from its peak, and paid
DexScreener promotion. EVM chains use GoPlus for honeypot, sell tax, mintable, ownership, pausable and blacklist
checks, plus the same trading-activity check.
Every scan also feeds the Signal Graph, a cross-scan memory of deployers, so a serial
rugger's next token is flagged. Scoring changes are logged in
docs/scoring-changelog.md.
Verdicts: CLEAN, LOW RISK, CAUTION, HIGH RISK, RUG-SHAPED, UNKNOWN. The API is rate
limited per IP (40 requests/min), the same for every caller. If you are building an integration
that needs more, ask at [email protected]; it stays free.
Embed a live badge that links to the full report:
Machine-readable docs for agents: https://gl1tchbased.xyz/llms.txt.
A working mobile-first Android prototype (mobile/, MIT) built for Solana Seeker and Android devices:
mobile/README.md.Requires Node.js 22.
CI type-checks and tests the site and the bot on every push, and a security workflow runs a secret scan, a dependency audit and a check that no code ever requests a fund-moving or approval signature.
SECURITY.md to report a vulnerability, and
docs/threat-model.md.docs/verdict-anchoring.md./api/stats returns user, auto and splitSince, or a 503 while the counter is unreachable,
never a made-up 0). Automated means Rug Radar, Watchtower, link previews, badge renders and our own
pages' self-checks of $GL1TCH. Those self-checks were at first miscounted as people's scans, so the
split restarted once that was fixed (splitSince is the restart).The project also has a community token, $GL1TCH
(3HQJwwHvzy8pGkPqGQcb4thZCH88MUCHVVSNtHn6pump), launched on Pump.fun on 29 May 2026:
Token-2022, mint and freeze authority revoked, 0% tax, fixed 1B supply, liquidity in the Pump.fun bonding curve.
More: whitepaper · token page · Quantum Core and verifiable randomness.
Issues and pull requests are welcome. See CONTRIBUTING.md.
Source: README.md at commit 10c82e5
Scan a token for rug risk
Pre-trade token safety check (Solana and EVM): rug-pull and honeypot verdict, 0-100 safety score, mint/freeze authority, LP lock, buy/sell tax, holder concentration, deployer history and bot-volume flags.
mintrequiredchainKnow Your Agent: trust-check a wallet
Trust score and level for an AI-agent wallet (or any wallet) before you transact with it: signature-verified identity plus its on-chain track record in GL1TCH scans.
chainaddressrequiredToken deployer reputation
How many tokens a deployer wallet launched and how many scanned as high risk or rug-shaped (serial rugger check), from the GL1TCH Signal Graph.
chainaddressrequired100% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
// Full safety report for one tokenconst r = await fetch("https://gl1tchbased.xyz/api/scan?mint=<address>&chain=solana");const report = await r.json(); // { verdict, score, confidence, checks[], meta, bottomLine, ... }
// Search by name or symbol across chainsconst s = await fetch("https://gl1tchbased.xyz/api/scan?q=bonk").then((x) => x.json()); // { candidates }<a href="https://gl1tchbased.xyz/scan/solana-<address>"> <img src="https://gl1tchbased.xyz/api/badge?t=solana-<address>" alt="Scanned by GL1TCH" /></a>flowchart LR U[Browser · Telegram · API caller] --> S["/api/scan (Next.js on Vercel)"] S --> RPC[Solana RPC: mint, authorities, holders, deployer balance] S --> RC[RugCheck: LP lock, insiders, deployer] S --> MK[DexScreener / GeckoTerminal: market] S --> GP[GoPlus: EVM checks] S --> BOT[(Bot on an Oracle Cloud VM: Signal Graph, counters, Watchtower)] BOT --> TG[Telegram alerts]npm installcp .env.example .env.local # optional: a private Solana RPC in SCAN_RPC; public RPCs work for light usenpm run dev # http://localhost:3000/scannpm test # unit tests (vitest)
cd bot && npm install && npm test # the Telegram bot has its own package and tests