# hexscan.xyz

> Token security scanner -- is this token safe to buy? Honeypot, rug-pull, and scam detection for any ERC-20 token. Risk score 0-100 from our on-chain checks plus GoPlus. Not an audit. Pay-per-scan via x402.

## What it does
Check any ERC-20 token contract for safety risks before buying or interacting. Detects honeypots (can't sell), rug-pull patterns, hidden mints, malicious buy/sell taxes, unverified source code, and holder concentration. Returns a composite risk score from 0 (safe) to 100 (critical).

## When to call
- Before buying a token you don't recognize
- Before interacting with an unknown contract
- To check if a token is a honeypot or rug
- To verify token taxes and source code
- As due diligence on any ERC-20 on Ethereum, Base, Arbitrum, Optimism, Polygon, BSC, or Avalanche

## API
POST https://hexscan.xyz/scan
Content-Type: application/json
{"address": "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48", "chain": "ethereum"}

## Response (200)
{"riskScore": 10, "riskLevel": "MINIMAL", "tokenName": "USD Coin", "tokenSymbol": "USDC", "findings": [{"severity": "LOW", "title": "Proxy contract", "description": "Upgradeable contract", "confidence": 0.7, "source": "goplus"}], "summary": "MINIMAL RISK (score: 10/100). 1 finding(s). Not an audit.", "settleTx": "0x..."}

## Payment
- Price: $0.10 USDC per scan (Base mainnet, eip155:8453)
- Protocol: x402 Payment Protocol (EIP-3009, gasless for buyer)
- Asset: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 (USDC on Base)
- Pay to: 0x841Ef35b7b7ee4C820BFF040369a8Ade4741b45d
- No API keys, no accounts, no registration
- Send POST without payment header to receive 402 challenge, then sign EIP-3009 and resend with payment-signature header

## Risk levels
- 0-10: MINIMAL (low risk, standard token patterns)
- 11-30: LOW (minor concerns, proceed with caution)
- 31-60: MEDIUM (notable risks, research before interacting)
- 61-80: HIGH (significant risks, likely unsafe)
- 81-100: CRITICAL (confirmed dangerous, do not interact)

## Data sources
- Inputs: GoPlus Token Security API (honeypot, taxes, source, holders, proxies), our on-chain sell simulation (eth_call transfer test), our on-chain pool-reserve read (balanceOf on the primary pair)

## Chains supported
ethereum (chainId 1), base (8453), arbitrum (42161), optimism (10), polygon (137), bsc (56), avalanche (43114)

## Discovery
- Listed on CDP Bazaar (Coinbase x402 discovery)
- Listed on x402-list.com (compliance A, 100% uptime)
- Bazaar extension in 402 response (info + schema)
- CDP facilitator: https://api.cdp.coinbase.com/platform/v2/x402

## Honeypot Check ($0.001)
POST https://hexscan.xyz/honeypot
Content-Type: application/json
{"address": "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48", "chain": "ethereum"}
# Returns 402 + payment-required header
# Price: $0.001 USDC (Base mainnet, EIP-3009, gasless)
# Response: {"honeypot": false, "canBuy": true, "canSell": true, "buyTax": "0%", "sellTax": "0%", "riskScore": 10}

## Simulate Transfer ($0.01)
POST https://hexscan.xyz/simulate
Content-Type: application/json
{"address": "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48", "chain": "ethereum"}
# Returns 402 + payment-required header
# Price: $0.01 USDC (Base mainnet, EIP-3009, gasless)
# Response: {"canBuy": true, "canSell": true, "revertReason": null, "verdict": "ALLOW", "tokenName": "USD Coin"}
# Real on-chain transfer simulation via eth_call - not a GoPlus wrapper.

## MCP Server
- URL: https://hexscan.xyz/mcp
- Protocol: JSON-RPC 2.0 over HTTP (Streamable HTTP)
- Tools: scan_token ($0.10), honeypot_check ($0.001), simulate_transfer ($0.01)
- Payment via x402 _meta["x402/payment"]
- Unpaid tool call returns PaymentRequired (code 402) with accepts[] and bazaar extension

## Disclaimer
This is NOT a security audit. Risk score 0-100 from our on-chain checks plus GoPlus. Not an audit. Automated risk triage; signals may be incomplete, wrong, or outdated. Always do independent due diligence. No warranty of any kind.