# Automaton Colony

> Automated security screening of smart contracts and native tokens on Base (chain 8453).
> Reports are paid in USDC on Base. Buying on-chain puts the money in a public escrow contract
> that holds it until the report is delivered and refunds automatically if the deadline passes.
> Paying per call over x402 settles directly to the treasury, with no escrow: single facts come
> back in the same response, and the report is collected by polling.

Two things separate this from a scanner. Every report states what it could **not** verify,
as open items with the reason, instead of folding uncertainty into a score. And a report bought
on-chain has its SHA-256 written on Base by the transaction that delivers it, so the copy a buyer
holds can be checked against the chain and shown to be the one that was issued. Reports bought
over x402 are not anchored: that route has no escrow, and the buyer keeps the settlement
transaction and the hash of what it received.

There is a free check that needs no wallet and no account. It returns observed data with no
verdict and no score: verified source status, proxy detection, admin function selectors,
holder concentration, and for B20 native tokens the issuer powers read from the chain. The
paid report is what interprets that evidence.

## Pages

- [Free check and store](https://colony.automatoncolony.xyz/app/en/): paste a Base address, see what
  the chain says about it, then buy a full screening if the data warrants it.
- [B20 on Base is 0xef](https://colony.automatoncolony.xyz/app/en/b20/): why a contract scanner reports
  "unverified, no admin functions" for a B20 token, what the issuer can still do (mint, burn,
  burnBlocked, seize, pause, transfer policies, metadata), and how to read one before buying.
- [B20 Observatory](https://colony.automatoncolony.xyz/app/en/b20/observatory/): the issuer powers of the
  first 10 tokenized stocks on Base's official list (supply cap, paused operations, transfer policies
  and role holders), read on chain once an hour, compared with each other, with their history of
  changes and a state hash anyone can recompute. No score and no prediction. The same data as
  JSON: https://colony.automatoncolony.xyz/api/v1/b20/observatory
  Each stock also has its own page, with its name and ticker in the title, and its own JSON. For
  Apple (AAPLc): https://colony.automatoncolony.xyz/app/en/b20/observatory/aaplc/ and
  https://colony.automatoncolony.xyz/api/v1/b20/observatory/0xb200000000000000000000C2e324d24d7eEcd1fb
- [Honeypot checks on Base](https://colony.automatoncolony.xyz/app/en/guides/honeypot-check-base/):
  the six mechanisms that stop you selling and which checks catch each one.
- [Audit or screening](https://colony.automatoncolony.xyz/app/en/guides/audit-vs-screening/): what a
  human audit buys that an automated screening does not.
- [Limits of automated screening](https://colony.automatoncolony.xyz/app/en/guides/screening-limits/):
  what no point-in-time check can tell you, upgradeable logic above all.
- [Verifying a report](https://colony.automatoncolony.xyz/app/en/guides/verify-report-hash/): how to
  check a report was not edited after it was issued.
- [Security evidence](https://colony.automatoncolony.xyz/app/en/guides/security-evidence/): what can be
  checked about the service itself (verified non-upgradeable contracts, tests, static analysis,
  pinned frontend, anchored reports) and what has not been done. Also in Spanish:
  https://colony.automatoncolony.xyz/app/es/guides/security-evidence/
- [Glossary](https://colony.automatoncolony.xyz/app/en/glossary/): the terms the reports use, defined once
  (honeypot, unbounded mint, upgradeable proxy, admin keys, timelock, renounced ownership, holder
  concentration, anchored hash, escrow, x402, B20). One page per language under each store, e.g.
  https://colony.automatoncolony.xyz/app/es/glossary/

- [About](https://colony.automatoncolony.xyz/app/en/about/): who operates the service (an independent
  developer in Spain), what it does not promise, how the escrow works, how to contact support.
  One page per language under each store, e.g. https://colony.automatoncolony.xyz/app/es/about/
- Legal texts, binding in Spanish and anchored by hash: [Terms of Service](https://colony.automatoncolony.xyz/terms),
  [Privacy Policy](https://colony.automatoncolony.xyz/privacy), [index](https://colony.automatoncolony.xyz/legal).
  Vulnerability reports: https://colony.automatoncolony.xyz/.well-known/security.txt

## For agents

The Flash Report can be bought over the x402 protocol with an EIP-3009 authorization, in USDC on
Base, with no browser and no account. The endpoint answers 402 with the payment terms, accepts
the signed authorization, settles on chain and returns the report. The payment goes straight to
the treasury, with no escrow and no on-chain refund: if the report is not delivered within 48
hours, the provider returns the full amount to the paying address within 14 days, as section 3.3
of the Terms of Service commits.

- `POST /api/v1/x402/flash-audit` — 3.49 USDC — a complete automated screening report. Requires
  `targetAddress`; accepts an optional report `language`; returns an order to poll until delivery.

Single on-chain facts are also sold one call at a time, from 0.0049 USDC, and those come back IN
THE SAME RESPONSE: there is no order to poll. Each answer carries the Base block it was read at and
that block's hash, so it can be re-read against the chain, and it states how long it stays valid.
A first read of an address can take up to 60s: keep the connection open. If it drops before the
answer arrives, send the SAME payment again within 10 minutes: the same authorization is never
charged twice.

- `/api/v1/x402/datos/codigo-verificado` — 0.0099 — verified source status and the deployed runtime
  code hash.
- `/api/v1/x402/datos/proxy-implementacion` — 0.0099 — whether it is an upgradeable proxy, and the
  implementation it points at.
- `/api/v1/x402/datos/poderes-admin` — 0.0099 — the dangerous selectors found (mint, pause,
  blacklist, upgradeTo and the rest).
- `/api/v1/x402/datos/estado-cadena` — 0.0049 — the anchor block, its hash and its timestamp. Takes
  no parameters and answers a plain GET, so it is the cheapest way to test an x402 payment loop end
  to end before buying anything that needs an address.
- `/api/v1/x402/datos/concentracion-tenedores` — 0.0399 — the largest non-excluded holder's share of
  supply in basis points, flagged when that share is only a floor.
- `/api/v1/x402/datos/poderes-emisor-b20` — 0.0399 — issuer powers of a Base native B20 token:
  mint, burn, seize, pause and transfer policies.
- `/api/v1/x402/datos/cribado-completo` — 0.0699 — all of the above in one call.

- [x402 on Base](https://colony.automatoncolony.xyz/app/en/x402/): the endpoint, the three responses, the
  fields an agent has to sign, and the failure modes worth handling.
- x402 resource manifests (the three aliases return the same live catalog):
  https://colony.automatoncolony.xyz/.well-known/x402 · https://colony.automatoncolony.xyz/.well-known/x402.json ·
  https://colony.automatoncolony.xyz/.well-known/x402-resources
- A2A JSON-RPC endpoint: https://colony.automatoncolony.xyz/a2a — supports `SendMessage` and the legacy
  `message/send` name for catalog discovery and routing. It is free and does not take payments.
- MCP server (Streamable HTTP, JSON-RPC 2.0 by POST): https://colony.automatoncolony.xyz/mcp — tools
  `check_contract_free`, `flash_audit_terms`, `buy_flash_audit` (paid over x402: the PaymentPayload
  travels in `_meta["x402/payment"]`, as in the official `@x402/mcp` client), `collect_flash_audit`,
  `contract_data_catalog` (free: what single facts are for sale and at what price) and
  `buy_contract_data` (paid, answered in the same call).
- OpenAPI 3.1 with `x-payment-info`: https://colony.automatoncolony.xyz/openapi.json
- ERC-8004 agent registration file: https://colony.automatoncolony.xyz/.well-known/agent-registration.json
  (agent 84609 on Base, owned by the treasury that receives the payments).

## What this is not

Automated screening, not a professional audit reviewed by a person. Not financial advice, and
not a guarantee that a contract is safe: the absence of a signal means the signal was not
observed, never that the risk is absent. Reports are generated by a large language model
combined with deterministic rules, disclosed under Article 50 of the EU AI Act.