Token Safety API: Scam, Honeypot, and Rug-Risk Checks in One Call

Most token-safety tools cover Ethereum and Base. New tokens — and new scams — launch on Zircuit, Robinhood Chain, Plasma, and Ink before any checker indexes them. NodeFlare's /data/token-safety endpoint closes that gap: one POST, any of 23 chains, a risk score you can act on before an agent or a wallet touches the token.

What a single call returns#

POST to https://rpc.nodeflare.app/data/token-safety with a chain slug and token address:

# Requires a free NodeFlare API key: nodeflare.app/sign-up
curl -X POST https://rpc.nodeflare.app/data/token-safety \
  -H 'Content-Type: application/json' \
  -d '{ "chain": "zircuit", "token": "0x..." }'

The response bundles five signals that normally require separate tools or manual contract reads:

The response includes a single aggregate risk score (0–100) and the individual signals behind it — so you get the "why", not just a number.

Try it free in the browser first#

Before wiring it into your pipeline, the free token safety checker lets you paste any ERC-20 contract, pick a chain, and get the contract check, ownership status, and a preview risk score with no account needed. Same data, no code required.

The browser tool runs the cheap decisive checks (contract + ownership + preview score) instantly. The full API adds holder concentration, honeypot simulation, and the complete composite score.

Add it to your pipeline#

Get a free NodeFlare API key — 2,000,000 compute units per month, no credit card. The token-safety endpoint requires a key or x402 payment (see below).

# Young-chain token — Zircuit, where other checkers have no coverage
curl -X POST https://rpc.nodeflare.app/data/token-safety \
  -H 'Content-Type: application/json' \
  -d '{ "chain": "zircuit", "token": "0x..." }'

# Same call works on every chain NodeFlare covers
curl -X POST https://rpc.nodeflare.app/data/token-safety \
  -H 'Content-Type: application/json' \
  -d '{ "chain": "eth", "token": "0x..." }'

The request shape is identical across all 23 chains — only the chain field changes. See the Data API reference for the full response schema and chain slugs.

Young-chain coverage: where it matters most#

The tools most developers already know — Alchemy token metadata, revoke.cash, Honeypot.is — have sparse or no data for the chains where new token launches (and new scams) happen first:

NodeFlare runs its own full nodes for these chains, so the safety endpoint queries live state at the moment of the call — not a stale index.

If you're building anything on these chains (a trading bot, a portfolio tracker, a scam detector), this is the coverage gap your existing safety checks won't catch.

Use it from an AI agent (MCP)#

If you're using Claude Code, Cursor, or any agent connected to the NodeFlare MCP server, token_safety is already a callable tool. Add the MCP server in one command:

npx nodeflare-mcp

Then in your agent:

Call token_safety with chain="zircuit" and token="0x..."

The agent calls it, gets the structured response including risk score and signals, and can decide whether to proceed — without any additional code on your side. The full suite of Data API endpoints is exposed as MCP tools: get_multichain_balances, get_portfolio, get_allowances, simulate_transaction, wallet_report, and token_safety.

Pay per call in USDC (no account)#

If you'd rather not manage an API key, pay per call in USDC on Base, Polygon, or Arbitrum using the x402 endpoint:

# x402 variant — no account needed, USDC payment inline
POST https://rpc.nodeflare.app/data/token-safety/x402

Token-safety costs around $0.001 per call. Use the @x402/fetch library to wrap your requests with the payment flow. Full payment details on the x402 page.

Ask in plain English via /answer#

If you'd rather type a question than parse a JSON response, the NodeFlare Answer Engine takes a natural-language question — "Is 0x... on Zircuit a safe token?" — and returns a cited on-chain verdict. Under the hood it runs the same checks; you get a human-readable explanation instead of a structured payload.

FAQ#

What's the difference between the free checker and the API?

The browser tool at /tools/token-safety runs the cheap decisive signals — contract verification, ownership status, and a preview score — with no account. The API at /data/token-safety adds holder concentration, honeypot simulation, and the full composite score, and returns a structured JSON response you can act on programmatically.

Does it work on mainnet tokens too?

Yes. The same endpoint and request shape works on Ethereum, Base, BNB Chain, Arbitrum, Optimism, Polygon, and every other chain NodeFlare covers — not just the young chains.

What counts as a high risk score?

Scores come back with the individual signals, so you can apply your own thresholds. The signals are the real signal — a high score with a single "moderate concentration" flag is different from one with "honeypot detected".

Does this cover NFTs (ERC-721 or ERC-1155)?

The token-safety endpoint is designed for ERC-20 tokens. NFT contract analysis is not in scope for this endpoint.

What if the chain isn't indexed yet by the endpoint?

All 23 chains NodeFlare runs nodes for are supported. The full list is on the Data API page. If you're on a chain not listed, the endpoint returns an error for an unsupported chain rather than a silent miss.

Try the free checker · Get a free API key · Data API reference · MCP server for agents