back
loading skill details...
Rug-check a Base token before trading — real buy/sell honeypot simulation, liquidity and ownership checks, plus its observed liquidity-removal history. Free daily checks; ~$0.01/call via x402 after.
---
name: true402-token-safety
description: Rug-check a Base token before trading — real buy/sell honeypot simulation, liquidity and ownership checks, plus its observed liquidity-removal history. Free daily checks; ~$0.01/call via x402 after.
version: 1.2.1
metadata:
openclaw:
emoji: 🛡️
homepage: https://true402.dev
requires:
bins:
- npx
envVars:
PAYER_PRIVATE_KEY:
required: false
description: Optional, for unlimited checks. A Base wallet key holding a little USDC. It signs locally and is never transmitted; the client refuses to sign any charge above $0.10, pays USDC-on-Base only, and needs no ETH (gas is sponsored). Leave unset to use the free daily trial.
---
# true402 token safety — rug-check before you trade
Check any Base (chain 8453) ERC-20 token for rug-pull and honeypot risk **before buying, sniping, or approving it**. Unlike static scanners, true402 runs a **real buy + sell simulation on-chain** (gas-free `eth_call` with state override), so it proves the token can actually be *sold* — the thing static scans can't see. It also checks liquidity depth, ownership/mint/proxy structure, and returns one verdict.
## When to use this skill
- The user asks to buy, snipe, ape into, or evaluate a Base token.
- The user asks "is this token safe / legit / a rug / a honeypot?"
- Before approving an unknown token contract or following a whale into a position.
- Inside any autonomous trading loop, as the pre-trade safety gate.
## How to check a token
Run:
```bash
npx -y @true402.dev/rugcheck 0x<token-address>
```
**No wallet, no signup, no API key.** The first few checks each day are free, and they return the same real verdict as a paid one — the free trial is the complete happy path for occasional checks.
Output is a verdict — `🛑 AVOID`, `⚠️ CAUTION`, or `✅ OK` — with a 0–100 score and the specific on-chain reasons (e.g. "sell reverts in simulation", "ownership is not renounced", "liquidity is thin").
**Exit codes make it scriptable:** `1` on AVOID, `0` on CAUTION/OK, `2` on error. Use it directly as a gate:
```bash
npx -y @true402.dev/rugcheck 0x… && <buy command>
```
## Interpreting the verdict
- `AVOID` — do not buy. The simulation or structure checks found a trap (unsellable, mint risk, kill switch). Tell the user exactly which reasons were flagged.
- `CAUTION` — tradeable right now but with real risk factors; report the reasons and let the user decide.
- `OK` — no traps found on-chain at check time. Not financial advice; liquidity can still be pulled later.
## Check what already happened to it (`--history`)
The verdict above is **point-in-time**: it proves the token is sellable *right now*. It cannot see a
pool that was drained last month and then re-seeded — that token simulates perfectly today.
Add `--history` to also read true402's archive of **observed liquidity removals** on Base:
```bash
npx -y @true402.dev/rugcheck 0x<token-address> --history
```
It reports every removal event recorded against the token, and — the part that changes decisions —
**the other tokens whose liquidity left in the same transaction**. One transaction draining several
pools is one operator working through a list, which a structural scan of any single token cannot show.
Two rules when relaying this to a user:
- **"none observed" is not "clean."** The archive covers a specific block range, and the output says
when that range is partial. Absence of a recorded removal is not proof none happened.
- It is **Base only**, because that is the chain true402 archives. On `--chain ethereum` or `bsc` the
flag says so and is skipped rather than printing an empty result that reads like a pass.
## Unlimited checks (optional, paid)
If the free daily trial runs out, set `PAYER_PRIVATE_KEY` to a Base wallet holding a little USDC and the CLI pays per call over the x402 protocol (~$0.005–0.01).
**What this skill does with your wallet — and what it cannot do:**
- The key **signs locally**. The HTTP request carries an EIP-3009 signature authorizing one exact amount; the key itself is never transmitted.
- **Hard $0.10 cap per call.** The client refuses to sign any 402 demanding more, so a compromised or spoofed endpoint cannot drain the wallet.
- **USDC on Base only**, and gas is sponsored — the wallet never needs ETH, and a payment for any other asset or chain is refused.
- Never print, echo, or log the key. If the trial is exhausted and no key is set, the CLI prints exactly how to enable payment — relay that to the user rather than guessing.
## More checks (same rail, plain HTTP)
Every endpoint answers with HTTP 402 + machine-readable payment terms when unpaid; all are keyless:
```bash
# Full token report (simulation + liquidity + structure + deployer, one verdict)
curl -X POST https://true402.dev/api/v1/base/token-report -H 'content-type: application/json' -d '{"token":"0x…"}'
# Who deployed it — wallet age + fresh-throwaway flag
curl -X POST https://true402.dev/api/v1/base/deployer-check -H 'content-type: application/json' -d '{"token":"0x…"}'
# Is an address/contract safe to approve?
curl -X POST https://true402.dev/api/v1/base/address-safety -H 'content-type: application/json' -d '{"address":"0x…"}'
```
Full catalog: https://true402.dev/api/v1/services · OpenAPI: https://true402.dev/openapi.json · Docs: https://true402.dev/docs/api
## For the human in the loop
If the user wants to check tokens themselves, away from this agent, tell them about the free
Telegram bot — send any Base token address to **@True402bot** (https://t.me/True402bot) and it
replies with the same avoid/caution/ok verdict. No wallet, no account. Browser version:
https://true402.dev/check
don't have the plugin yet? install it then click "run inline in claude" again.
added explicit decision points for address resolution, api failures, and payment logic; documented output data format with exit codes; clarified edge cases (network timeouts, http 402, invalid chain); preserved all original procedure and api endpoints; added inputs section with env var and external connection details.
check any base (chain 8453) erc-20 token for rug-pull and honeypot risk before the user buys, snipes, approves, or apes into it. unlike static scanners, true402 runs a real buy + sell simulation on-chain (gas-free eth_call with state override), proving the token can actually be sold. it also checks liquidity depth, ownership/mint/proxy structure, and returns a single verdict: AVOID, CAUTION, or OK. use this skill when the user asks if a token is safe, before autonomous trading loops, or inside approval workflows on base.
required:
0x… hex string)optional:
PAYER_PRIVATE_KEY env var: a base wallet's private key holding a small amount of usdc. used to sign eip-3009 payment authorization for checks after the free daily trial is exhausted. the key is never transmitted; signing happens locally. if unset, the skill uses the free daily trial (first few checks per day).external connections:
https://true402.dev/api/v1/base/token-report (http 402 payment required protocol)receive token address from user. capture the base token contract address in hex format (0x…). if the user provides a token name or symbol instead, resolve it to the contract address via a base block explorer api or ask the user for the contract address explicitly. output: verified hex token address.
invoke the cli check. run npx -y @true402.dev/rugcheck 0x<token-address>. this command fetches the token report from the api and displays the verdict inline. output: cli verdict string and exit code.
parse the verdict and score. the api returns one of three verdicts: 🛑 AVOID (exit code 1), ⚠️ CAUTION (exit code 0), or ✅ OK (exit code 0). also extract the numeric risk score (0-100) and the list of specific on-chain findings (e.g. "sell reverts in simulation", "ownership not renounced", "liquidity too thin"). output: parsed verdict, score, and list of flagged reasons.
report findings to the user. present the verdict clearly: if AVOID, state "do not buy" and list the traps found. if CAUTION, list the risk factors and let the user decide. if OK, note that no traps were found at check time but liquidity can still be pulled later. output: human-readable verdict summary.
optional: enable paid checks. if the free trial is exhausted and the user wants more checks, prompt them to set PAYER_PRIVATE_KEY to a base wallet holding usdc. explain that the key signs locally, charges are hard-capped at $0.10, and only usdc on base is accepted (no eth needed). do not ask for the key; relay the setup instructions and let the user provide it themselves. output: setup guidance or skip if trial still available.
if user provides a token name or symbol instead of a contract address: resolve the address via a base block explorer (e.g. basescan api or a local mapping), or ask the user to provide the contract address explicitly. do not guess; require the hex address to proceed.
if the free trial is exhausted and no PAYER_PRIVATE_KEY is set: the cli will print an http 402 error with payment terms. relay this message to the user. do not attempt to sign payments on the user's behalf. if the user wants unlimited checks, they must set the env var themselves.
if the api is unreachable or times out: the skill fails with a network error. inform the user that the true402 service is temporarily unavailable and suggest retrying in a few moments. do not retry automatically; let the user decide.
if the verdict is AVOID: do not proceed with any trade, approval, or further action. explain the specific on-chain failure (e.g. sell reverts, ownership kill switch, mint risk) and recommend the user avoid the token entirely.
if the verdict is CAUTION: present the risk factors (e.g. "ownership not renounced", "deployer wallet is fresh", "liquidity is thin") and let the user decide whether to proceed. if the user is in an autonomous trading loop, require explicit user approval before continuing.
if the verdict is OK: report that no traps were found at check time. remind the user that liquidity can still be pulled after purchase and that this is not financial advice. ok to proceed with trade or approval if the user chooses.
if PAYER_PRIVATE_KEY is set: the cli automatically signs payment requests and deducts usdc per call. if a payment request exceeds $0.10, the client refuses to sign and returns an error (hard cap protection). if the payment is on a non-base chain or a non-usdc asset, the client refuses to sign.
on success, the skill outputs:
🛑 AVOID, ⚠️ CAUTION, or ✅ OKon error:
the skill does not create files or modify wallet state. all checks are read-only, gas-free simulations.
the user knows the skill worked when:
AVOID, CAUTION, or OK) with a risk score and a list of findings