Token Safety API

Is this token a scam? Ask in one call.

Screen any ERC-20 before you trade it. One POST returns contract & ownership status, upgradeable-proxy detection, holder concentration and a honeypot transfer simulation — folded into a single 0–100 risk score (higher = riskier), with the exact reasons behind it.

It runs where the tokens and scams actually are — Ethereum, Base, BNB Chain and Polygon— and on Robinhood Chain and the other young chains where no third-party scanner exists. Free public tier for the basic check; deep checks by API key or pay-per-call in USDC over x402. Built for AI agents: it's an MCP tool, too.

POST https://rpc.nodeflare.app/data/token-safety
Try it live in your browser →

What it checks

Can you actually sell it?

A transfer() is simulated from the largest holder — if it reverts or returns false, transfers are likely blocked for ordinary sellers. The honeypot signal.

Who controls it?

Ownership renounced or not, and whether it's an upgradeable proxy whose logic the admin can swap — so an agent knows the rules can still change.

How concentrated is supply?

Top-holder and top-10 share of supply, from a Transfer-log holder scan — one wallet holding the float can dump the whole market.

Is it real and how old?

Contract-code check (is it even an ERC-20?), readable name/symbol, and a token-age hint from the first Transfer seen — brand-new tokens carry more risk.

Screen a blue-chip (Ethereum)

Major tokens are recognized as verified, so their legitimate proxy and non-renounced ownership don't produce a false alarm — USDC comes back score 0.

# Screen USDC on Ethereum — a known blue-chip (free public tier)
curl -X POST https://rpc.nodeflare.app/data/token-safety \
  -H 'Content-Type: application/json' \
  -d '{ "chain": "eth", "token": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48" }'

# → {
#   "symbol": "USDC", "isContract": true, "verified": true,
#   "ownershipRenounced": false, "isProxy": true,
#   "score": 0, "signals": []
# }
# USDC is a proxy with non-renounced ownership — legitimate for a regulated
# stablecoin — so those are NOT flagged. Same for USDT, WETH, DAI, WBTC.

Deep check on the majors (x402, no account)

Append /x402 and pay per call in USDC to add the holder-concentration scan and the honeypot simulation — the heavy checks that read Transfer logs.

# Deep check (holder concentration + honeypot sim) — pay per call, no account
curl -X POST https://rpc.nodeflare.app/data/token-safety/x402 \
  -H 'Content-Type: application/json' \
  -d '{ "chain": "base", "token": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913" }'

# → USDC on Base: { "verified": true, "transfersBlocked": false,
#                   "concentrationBasis": "full-history", "score": 0 }

Catch a honeypot before a trade

The real job: an unknown token an agent is about to buy. A blocked transfer, a 96%-held float and a brand-new contract stack up to score 85.

# Screen an unknown token BEFORE an agent buys it
curl -X POST https://rpc.nodeflare.app/data/token-safety/x402 \
  -H 'Content-Type: application/json' \
  -d '{ "chain": "bnb", "token": "0x<unknown-token-address>" }'

# → {
#   "verified": false, "ownershipRenounced": false,
#   "topHolderPct": 96, "transfersBlocked": true, "score": 85,
#   "signals": [
#     "ownership not renounced",              // +20
#     "top holder holds ≥96% of supply",      // +30
#     "transfer simulation reverted (possible honeypot — heuristic)", // +25
#     "brand-new token (very recent first transfer)"                  // +10
#   ]
# }
# An agent reads score 85 + transfersBlocked and does NOT buy.

How the score is built

Transparent and additive — every point traces to a named signal, capped at 100. Verified blue-chips have the ownership and proxy penalties suppressed.

Address has no contract codeNot an ERC-20 at all — sending to it burns funds.+60
Transfer sim reverts / returns falseHoneypot heuristic: you can buy but can't sell.+25
Top holder ≥ 50% of supplyOne wallet can dump the whole market (or ≥80% across top-10 → +20).+30
Ownership not renouncedAn owner can still change the rules — mint, pause, tax. Suppressed for verified blue-chips.+20
Upgradeable proxyThe token's logic can be swapped by the admin. Suppressed for verified blue-chips.+10
Brand-new tokenFirst transfer only hours-to-days ago — no track record.+10
No readable name/symbolMalformed or deliberately opaque ERC-20.+15

Token Safety API — FAQ

What is the Token Safety API?

A single POST that screens an ERC-20 contract and returns a 0–100 risk score (higher = riskier) plus the reasons behind it. In one call you get contract & ownership status, upgradeable-proxy detection, holder concentration, and a honeypot transfer simulation — the checks an agent (or a human) needs before trading a token. Endpoint: POST https://rpc.nodeflare.app/data/token-safety (append /x402 to pay per call in USDC with no account).

How does the honeypot check work?

On the paid path the API simulates a transfer() from the token's largest holder to a burn address via eth_call. If that reverts — or transfer() silently returns false — ordinary sellers likely can't move the token, i.e. you can buy but can't sell, the classic honeypot. It's returned as transfersBlocked: true with the basis stated (it's a heuristic, not proof: the top holder can be a whitelisted LP, and a 1-wei probe can trip an anti-dust guard).

Do you handle blue-chips like USDC and USDT correctly?

Yes — that's the point of the verified flag. Regulated stablecoins and wrapped assets are legitimately upgradeable proxies with concentrated (exchange/treasury/bridge) holders and never renounce ownership. NodeFlare recognizes a curated set of blue-chips per chain (USDC, USDT, WETH, DAI, WBTC on Ethereum; USDC/WETH on Base; USDC/USDT on BNB Chain and Polygon; and the majors on Arbitrum/Optimism/Avalanche) and suppresses those specific false-positive penalties, so USDC comes back verified: true with score 0 instead of a scary number. Unknown tokens get the full scrutiny.

Which chains does it cover?

All 23 EVM chains NodeFlare serves. The demand is on the busy majors — Ethereum, Base, BNB Chain and Polygon — where new tokens and scams appear by the thousand, and that's where the checks are sharpest. But it also runs on Robinhood Chain and the other young chains where no third-party scanner exists at all.

Is this like GoPlus or Token Sniffer?

Same job — screen a token for rug/honeypot risk — but built as a first-party API on NodeFlare's own nodes and exposed as an MCP tool and an x402 pay-per-call endpoint, so an autonomous agent can call and pay for it with no account and no API-key management. And it covers chains those tools don't, including Robinhood Chain and the other young chains.

How much does it cost?

The basic check (contract, ownership, proxy) is free on the public tier, rate-limited per IP. The deep checks — holder concentration and the honeypot simulation, which scan Transfer logs — run on a NodeFlare API key or over x402 (append /x402), priced by the work done at roughly $0.001 per call. You only pay for calls that succeed.

Can an AI agent call it directly?

Yes. It's the check_token_safety tool in the NodeFlare MCP server (npm nodeflare-mcp and the remote endpoint at mcp.nodeflare.app/mcp), and it's listed in /services.json and the x402 Bazaar for autonomous discovery and payment. A trading agent can screen every token before it buys, paying per call in USDC.

Go deeper

Screen every token your agent touches

Start free — 2,000,000 compute units per month, no credit card — or wire it into your agent over MCP / x402.

Get your free API key →Use over MCP / x402 →