Token Risk (x402)

npx add-mcp 'https://token-risk.orbit-builder.workers.dev/mcp'

orbit-builder ~/token-risk $

checking… · Base mainnet · USDC

Token risk check.$0.0009 a token.

Before your agent buys, lists or trusts a token, check it. Base and Solana: mint and freeze authority, proxy and owner powers, holder concentration, liquidity, pair age, dump patterns. No account. No API key. $0.0009 in USDC per token, or $0.015 for up to 10 tokens in one call, paid via x402.

agent@runtime: ~ (demo)

$0.0009

per token

batch: $0.015 for 1–10

2

chains

Base · Solana

15

flag types

pass · warn · fail · unknown

–

your last preview

measured in this browser

Try a token right now.

This calls the real free preview endpoint (/v1/preview, 30 per hour per IP). It shows the headline verdict; the paid call returns every flag with raw values and thresholds.

–

risk level

press check

One paid call. The rest is free.

Settles in USDC to 0x9Da4B249B8afa7818de5BFf7eEd8b13e6feeb9b3 on Base mainnet (eip155:8453). Malformed input is rejected with 400 before any payment, so you never pay for a typo.

single token

GET · POST

/v1/check?token=chain:address

$0.0009 / call

• 1 token, Base or Solana
• every flag with raw value + threshold
• also takes {chain,address}, {tokenAddress}, {tokens:[1]}

batch

POST · GET

/v1/risk

$0.015 / call

• 1–10 tokens, mix Base + Solana
• same full report per token
• market snapshot: price, liquidity, FDV, volume

rate-limited

GET

/v1/preview?chain=&address=

$0

• 1 token, risk level + counts
• 4 headline flags with raw values
• 30 calls / hour / IP

no payment

GET

/health · /openapi.json

$0

• /.well-known/x402 discovery
• /llms.txt for agents
• MCP: POST /mcp · tools check_token, check_token_risk
• A2A card: /.well-known/agent.json

Cheapest single-token x402 risk check we've found: $0.0009 (vs $0.00098–$0.02 for the others we checked, live x402 prices, Oct 23 2026): kushbitx token-risk $0.00098; hexscan honeypot, money-reactor honeypot, signals.edge token-risk and ottoai token-security $0.001; Pocket pump-check $0.005; money-reactor token-verdict and x402node honeypot $0.01; AX1 q-verdict $0.02. Compare outputs before you pick. Here you get raw numbers per check for Base and Solana, not a prose verdict.

What gets flagged

Each flag is pass · warn · fail · unknown with the raw value and the threshold used. unknown never counts as pass.

flag	chain	rule
mint_authority	solana	set = supply can be inflated → fail
freeze_authority	solana	set = holders can be frozen → fail
token2022_extensions	solana	transfer hook / permanent delegate / fees → warn
top10_holder_pct	solana	>50% → warn (includes LP accounts)
contract_exists	base	no bytecode → fail
upgradeable_proxy	base	EIP-1967 slot set → warn
owner	base	non-renounced owner() → warn
mint_function	base	mint(address,uint256) selector → warn
blacklist_function	base	blacklist-style selectors → warn
honeypot_tax	base	buy+sell simulation: honeypot or any tax ≥ 10% → fail · ≥ 3% → warn

flag	chain	rule
liquidity_usd	both	<$10k fail · <$50k warn
liquidity_to_fdv	both	<0.02 → warn (thin book)
pair_age_hours	both	<24h → warn
quiet_coin	both	<50 txns or <$1k vol / 24h → warn
gap_dump	both	h1 ≤ −40% or h6 ≤ −60% fail · h1 ≤ −20% or sells > 2× buys warn
dex_pair	both	no DEX pair found → unknown

// risk_level
high      any fail
elevated  ≥2 warns
insufficient_data  unknown > pass
low       otherwise

Copy, paste, pay.

Any x402 client works. Fund the agent's wallet with a little USDC on Base; no ETH needed.

# free preview
curl -s "https://token-risk.orbit-builder.workers.dev/v1/preview?chain=solana&address=DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263" | jq

# see the price: 402 with the x402 challenge (also in the PAYMENT-REQUIRED header)
curl -s "https://token-risk.orbit-builder.workers.dev/v1/check?token=base:0x4ed4E862860beD51a9570b96d89aF5E1B0Efefed" | jq '.accepts[0]'

# batch of up to 10: POST /v1/risk ($0.015)
curl -s -X POST https://token-risk.orbit-builder.workers.dev/v1/risk -H 'content-type: application/json' \
  -d '{"tokens":[{"chain":"base","address":"0x4ed4E862860beD51a9570b96d89aF5E1B0Efefed"}]}' | jq '.accepts[0].amount'

// npm i @x402/fetch @x402/evm viem
import { wrapFetchWithPayment, x402Client } from "@x402/fetch";
import { ExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

const client = new x402Client().register("eip155:8453", new ExactEvmScheme(privateKeyToAccount(process.env.AGENT_KEY)));
const pay = wrapFetchWithPayment(fetch, client);

const res = await pay("https://token-risk.orbit-builder.workers.dev/v1/risk", {
  method: "POST", headers: { "content-type": "application/json" },
  body: JSON.stringify({ tokens: [
    { chain: "solana", address: "DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263" },
    { chain: "base",   address: "0x4ed4E862860beD51a9570b96d89aF5E1B0Efefed" } ] }),
});
for (const r of (await res.json()).results) console.log(r.address, r.risk_level, r.counts);

# pip install "x402[httpx,evm]"
import asyncio, os
from eth_account import Account
from x402 import x402Client
from x402.http.clients import x402HttpxClient
from x402.mechanisms.evm import EthAccountSigner
from x402.mechanisms.evm.exact.register import register_exact_evm_client

async def main():
    client = x402Client()
    register_exact_evm_client(client, EthAccountSigner(Account.from_key(os.environ["AGENT_KEY"])))
    async with x402HttpxClient(client) as http:
        r = await http.post("https://token-risk.orbit-builder.workers.dev/v1/risk", json={"tokens": [
            {"chain": "solana", "address": "DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263"}]})
        for t in r.json()["results"]:
            print(t["address"], t["risk_level"], t["counts"])

asyncio.run(main())

Straight talk. These are descriptive data and heuristic flags from free public sources (DexScreener, Jupiter token API, honeypot.is simulation, Base and Solana public RPC), not financial advice and not an audit. Bytecode selector scans can miss renamed functions; holder concentration on Solana includes LP and bonding-curve accounts; public RPC rate limits can turn a check into unknown. The flags exist to make an agent pause, not to bless a token. No tracking, no cookies.