HexScan Token Security

xyz.hexscanPublished by hexscan.xyzOfficial publisherv1.0.0Updated Oct 24, 2026

Honeypot detection & token risk scan for ERC-20s. Risk score 0-100, tax, source verification.

VerifiedStreamable HTTPWeb executableFinanceSecurity & Monitoring

Overview

AI-generated overview

Remote MCP server that scans ERC-20 tokens for honeypot behavior and risk, returning risk scores, taxes and buy/sell simulation verdicts.

What you can do
Run a full token security scan on a contract address and chain, returning a 0-100 risk score from on-chain checks plus GoPlus data and source verification details. Perform a fast honeypot check returning honeypot status, canBuy, canSell, buy and sell tax, and risk score. Simulate a buy-then-sell transfer using real eth_call simulation and get canBuy, canSell, revert reason and an ALLOW/REVIEW/BLOCK verdict.
When to use it
Useful when an assistant needs a quick pre-trade sanity check on an ERC-20 token, such as screening for honeypots, high taxes or suspicious risk before interacting with a contract. It is a screening aid, not a substitute for a full security audit.
Requirements
A remote MCP endpoint at hexscan.xyz over streamable HTTP; no package, environment variables or headers are declared. The assistant supplies a token contract address and a supported chain (ethereum, base, arbitrum, optimism, polygon, bsc, avalanche). Network access to the endpoint is required.
Before you install
Results are explicitly not an audit and rely partly on third-party GoPlus data, so treat scores and verdicts as indicative only. The server sends token addresses and chain names to a third-party service. Simulation results do not guarantee real trading outcomes; do not rely on them for financial decisions without independent verification.

Installation

In SourceWeft

  1. Open HexScan Token Security in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/xyz.hexscan%2Ftoken-security/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "hexscan-token-security": {
      "type": "http",
      "url": "https://hexscan.xyz/mcp"
    }
  }
}

Tools

3

scan_token

Full token security scan. Args: address (0x...), chain (ethereum|base|arbitrum|optimism|polygon|bsc|avalanche). Risk score 0-100 from our on-chain checks plus GoPlus. Not an audit.

Parameterschainrequiredaddressrequired

honeypot_check

Fast honeypot check. Args: address (0x...), chain. Returns: honeypot boolean, canBuy, canSell, buyTax, sellTax, riskScore.

Parameterschainrequiredaddressrequired

simulate_transfer

Simulate buy-then-sell on-chain. Args: address (0x...), chain. Returns: canBuy, canSell, revertReason, verdict (ALLOW/REVIEW/BLOCK). Uses real eth_call simulation.

Parameterschainrequiredaddressrequired

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.