SicariusGuard
SicariusGuard is a Solana token safety oracle for AI agents, trading bots, and developers, offering multi-layer risk analysis of SPL tokens before swapping or trading. It integrates natively with AI agents and LLMs via MCP for autonomous risk assessment, and supports pay-per-call micropayments using SOL via the x402 protocol.
check_token_safety: 5-layer on-chain safety check (mint authority, freeze authority, Token-2022 extensions, honeypot simulation, holder concentration) returning a risk score (0β100) and verdict (SAFE / CAUTION / HIGH_RISK / CRITICAL)check_honeypot: Simulate a sell order through Jupiter DEX to detect honeypot traps without real costcheck_holder_concentration: Analyze top holder distribution to flag concentrated supply (top-1 >50%, top-5 >80%, top-10 >90%) as rug pull indicatorsfull_token_scan: Most comprehensive 7-layer scan combining on-chain byte-level inspection with Birdeye market intelligence and Helius wallet reputation, using a weighted scoring model (60% on-chain / 25% market / 15% reputation)get_wallet_reputation: Investigate a Solana wallet's trustworthiness via Helius DAS identity, funding chain analysis, deployer age, and known entity classificationget_market_intel: Real-time Birdeye market data (price, 24h volume, liquidity depth, market cap, holder count) with risk flags such as wash trading or low liquiditybatch_scan: Scan up to 10 tokens in parallel for portfolio-level or watchlist risk assessment
Provides real-time Solana token safety analysis combining byte-level on-chain inspection, market intelligence, and wallet reputation scoring for AI agents and trading bots.
π‘οΈ SicariusGuard
Solana Token & NFT Safety Oracle for AI Agents & Trading Bots
Real-time token and NFT safety analysis combining byte-level on-chain inspection, LP lock verification, deployer reputation scoring, market intelligence, and NFT fraud detection. Built for autonomous AI agents, MCP-enabled LLMs, and trading infrastructure.
"Don't trade blind. Query SicariusGuard before every swap."
π Live API: https://sicarius-guard-640545264957.us-east4.run.app
# Try it now β no auth required (100 free calls/day)
curl https://sicarius-guard-640545264957.us-east4.run.app/v1/scan/DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263π Table of Contents
Related MCP server: RAD Security
π What It Does
SicariusGuard performs 12 layers of safety analysis on any Solana SPL token or NFT:
On-Chain Safety (Layers 1-5)
Layer | Source | Detection |
π Mint Authority | Raw SPL mint bytes | Can deployer print infinite tokens? |
π§ Freeze Authority | SPL layout offset 46 | Can deployer freeze any wallet? |
β οΈ Token-2022 Extensions | Extension type scan | PermanentDelegate, TransferHook, ConfidentialTransfers |
π― Honeypot Detection | Jupiter sell simulation | Can you actually sell this token? |
π Holder Concentration |
| Top 5 wallets controlling >50% supply? |
LP & Token Maturity (Layers 6-8)
Layer | Source | Detection |
π LP Lock/Burn | Raydium V4 byte decode + GeckoTerminal | Is liquidity locked, burned, or unlocked? |
β° Token Age | Helius enhanced RPC | Newborn (<24h)? Young (<7d)? Mature? |
βοΈ Unified Scoring | 5-axis weighted engine | Combined risk across all layers |
Intelligence & Reputation (Layers 9-12)
Layer | Source | Detection |
π Market Intel | Birdeye API | Liquidity, volume, wash trading, manipulation |
π Wallet Reputation | Helius Identity + Funded-By | Is the deployer a known scammer? |
π΅οΈ Deployer Recon | DAS + Enhanced TX | Serial rugger? Burner wallet? Dead token history? |
πΌοΈ NFT Intelligence | Helius DAS + Magic Eden | Counterfeit collection? Unverified creators? Pricing anomaly? |
5-Axis Weighted Risk Scoring
finalScore = (onChain Γ 0.45) + (lpLock Γ 0.15) + (age Γ 0.05) + (market Γ 0.22) + (reputation Γ 0.13)
0 β SAFE
1-15 β CAUTION
16-50 β HIGH_RISK
51-100 β CRITICALWeight | Source | What It Catches |
45% | On-chain safety | Mint/freeze authority, honeypots, extensions, supply |
15% | LP lock analysis | Unlocked liquidity, unburned LP tokens, lock duration |
5% | Token age | Newborn tokens (<24h), recently deployed |
22% | Birdeye market data | Low liquidity, wash trading, price manipulation |
13% | Helius wallet intel | Scammer wallets, suspicious funding chains, burner deployers |
π Quick Start
# Clone
git clone https://github.com/Chronolapse411/sicarius-guard.git
cd sicarius-guard
# Install
npm install
# Configure
cp .env.example .env
# Add your HELIUS_RPC_URL and optionally BIRDEYE_API_KEY
# Build & Run
npm run build
npm startπ‘ API Endpoints
REST API (Port 3400)
Method | Endpoint | Description |
|
| Full on-chain safety analysis |
|
| Convenience GET for safety check |
|
| Full 12-layer analysis + Birdeye + Helius + deployer recon |
|
| Convenience GET for enriched scan |
|
| Honeypot-only check (Jupiter sell sim) |
|
| Holder concentration analysis |
|
| LP lock/burn status for a token |
|
| Token creation date and age category |
|
| Deployer reconnaissance dossier |
|
| NFT safety analysis (Magic Eden + Helius DAS) |
|
| x402 payment pricing table |
|
| Service health check with cache stats |
Example Request
# Basic safety check (BONK)
curl https://sicarius-guard-640545264957.us-east4.run.app/v1/check/DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263
# Full 12-layer scan
curl https://sicarius-guard-640545264957.us-east4.run.app/v1/scan/DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263
# LP lock check (POPCAT β 99.2% burned, 20,865 SOL liquidity)
curl https://sicarius-guard-640545264957.us-east4.run.app/v1/lp-lock/7GCihgDB8fe6LNjn2MYtkzZcRjQy3t9GHdC8uHYmW2hr
# NFT safety check (Mad Lads #7541)
curl https://sicarius-guard-640545264957.us-east4.run.app/v1/nft-check/7zuR45WCsAsWsrqvYPyvLXFiCRKuvjh7HrMcNJ6F36Kd
# Deployer recon (checks if a wallet is a serial scammer)
curl https://sicarius-guard-640545264957.us-east4.run.app/v1/deployer/BGkkEeg4Gj8VcoerFb2RephZNkTEfHmzJBZMv4S7qVTQExample Response (/v1/scan)
{
"safety": {
"safe": true,
"riskScore": 0,
"verdict": "SAFE",
"checks": {
"mintAuthority": { "status": "REVOKED", "safe": true },
"freezeAuthority": { "status": "REVOKED", "safe": true },
"token2022Extensions": { "status": "CLEAN", "safe": true },
"supplyConcentration": { "status": "OK", "safe": true }
}
},
"honeypot": { "isHoneypot": false, "sellable": true },
"holders": { "concentrated": false, "stats": { "top10Pct": 8.2 } },
"lpLock": {
"status": "burned",
"burnPct": 99.2,
"liquiditySOL": 20865,
"poolCreatedAt": "2023-12-12T..."
},
"tokenAge": {
"ageCategory": "mature",
"createdAt": "2022-12-08T...",
"ageDays": 1259
},
"deployerRecon": {
"verdict": "CLEAN",
"recidivismScore": 0,
"portfolioSize": 1
},
"combined": {
"safe": true,
"finalScore": 0,
"verdict": "SAFE",
"summary": "All checks passed β token appears safe"
}
}π€ MCP Server (for AI Agents)
SicariusGuard exposes tools via the Model Context Protocol (MCP), enabling LLMs and agent frameworks to call safety checks natively.
Available MCP Tools (11)
Tool | Description | Read-Only |
| 5-layer on-chain rug pull, honeypot, and holder analysis | β |
| Jupiter DEX sell simulation β zero cost, quote-only | β |
| Top holder distribution analysis with concentration flags | β |
| LP lock/burn status β Raydium V4 byte decode + burn detection | β |
| Token creation date and age category via Helius RPC | β |
| 12-layer scan: on-chain + LP + age + market + reputation + deployer | β |
| Helius DAS identity, funding chain, deployer age analysis | β |
| Birdeye market data: price, volume, liquidity, risk flags | β |
| Deployer reconnaissance β portfolio health, serial scammer detection | β |
| NFT safety analysis β collection verification, floor price, risk scoring | β |
| Parallel 12-layer scan of up to 10 tokens per call | β |
Install via npx (Recommended)
# Run directly β no cloning required
npx sicarius-guardInstall in Claude Code
claude mcp add sicarius-guard -- npx -y sicarius-guardInstall in Cursor
Or manually add to your Cursor MCP config:
{
"mcpServers": {
"sicarius-guard": {
"command": "npx",
"args": ["-y", "sicarius-guard"],
"env": {
"HELIUS_RPC_URL": "https://mainnet.helius-rpc.com/?api-key=YOUR_KEY",
"BIRDEYE_API_KEY": "your-birdeye-key"
}
}
}
}Install in VS Code
Or via CLI:
code --add-mcp '{"name":"sicarius-guard","command":"npx","args":["-y","sicarius-guard"]}'Install from Source (Claude Desktop / Cursor)
{
"mcpServers": {
"sicarius-guard": {
"command": "node",
"args": ["dist/mcp-server.js"],
"cwd": "/path/to/sicarius-guard",
"env": {
"HELIUS_RPC_URL": "https://mainnet.helius-rpc.com/?api-key=YOUR_KEY",
"BIRDEYE_API_KEY": "your-birdeye-key"
}
}
}
}ποΈ Architecture
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β SicariusGuard v1.1 β
β β
β βββββββββββββββ βββββββββββββββ ββββββββββββββββββββββββ β
β β REST API β β MCP Server β β x402 Payment Gate β β
β β Express 5 β β 11 tools β β SOL Micropayments β β
β β 12 endpts β β stdio β β β β
β ββββββββ¬βββββββ ββββββββ¬βββββββ ββββββββββββ¬ββββββββββββ β
β β β β β
β ββββββββΌβββββββββββββββββΌββββββββββββββββββββββΌββββββββββββ β
β β 12-Layer Analysis Engine β β
β β β β
β β token_safety.ts β β β
β β honeypot_sim.ts ββ On-Chain (45%) β β
β β holder_analysis.tsβ β β
β β lp_lock.ts LP Lock (15%) β β
β β token_age.ts Age (5%) β β
β β birdeye.ts Market (22%) β β
β β helius_wallet.ts Rep (13%) β β
β β scoring.ts Unified 5-Axis Engine β β
β β deployer_recon.ts Deployer Reconnaissance β β
β β nft_intel.ts NFT Intelligence (ME + DAS) β β
β ββββββββββββββββββββββββββββ¬ββββββββββββββββββββββββββββββββ β
β β β
β βββββββββββββ¬ββββββββββββΌββββββββββββ¬ββββββββββββββ β
β βΌ βΌ βΌ βΌ βΌ β
β βββββββββ βββββββββββ ββββββββββ ββββββββββββ βββββββββββ β
β βSolana β βBirdeye β βHelius β βMagic Edenβ βGecko β β
β βRPC β βAPI v3 β βDAS+RPC β βv2 (free) β βTerminal β β
β βββββββββ βββββββββββ ββββββββββ ββββββββββββ βββββββββββ β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββπ° x402 Payment Protocol
SicariusGuard implements the x402 HTTP Payment Required protocol for machine-native micropayments. AI agents can pay per API call with SOL β no registration, no API keys, no accounts.
How It Works
1. Agent hits /v1/scan β gets 402 + payment instructions
2. Agent sends SOL to treasury wallet
3. Agent retries with X-PAYMENT: <tx_signature>
4. Server verifies on-chain β returns safety dataPricing
Endpoint | Price (SOL) | Description |
| 0.001 | On-chain safety check |
| 0.002 | Full 12-layer scan |
| 0.0005 | Honeypot simulation |
| 0.0005 | Holder analysis |
| 0.001 | NFT safety check |
Example (Paid Request)
# Step 1: Get pricing + treasury address
curl https://sicarius-guard-640545264957.us-east4.run.app/v1/pricing
# Step 2: Send SOL to treasury address (returned in pricing response)
solana transfer <TREASURY_ADDRESS> 0.002
# Step 3: Use tx signature as payment proof
curl -X POST https://sicarius-guard-640545264957.us-east4.run.app/v1/scan \
-H "Content-Type: application/json" \
-H "X-PAYMENT: <your_tx_signature>" \
-d '{"mint": "DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263"}'Security
On-chain verification β Every payment is verified against Solana mainnet
Replay protection β Each tx signature can only be used once
Amount validation β Exact SOL amount must match endpoint pricing
Freshness check β Transactions older than 10 minutes are rejected
Verified live on mainnet β Tested with real SOL transfers
Access Tiers
Tier | Auth Method | Rate Limit |
Free | None | 100 calls/day per IP |
x402 Pay-Per-Call |
| Unlimited |
π§ Configuration
Variable | Description | Default |
| Solana RPC endpoint (Helius recommended) |
|
| API server port |
|
| Bind address |
|
| Birdeye API key (optional, enriches scans) | β |
| SOL payment recipient (x402) | β |
| Cache duration |
|
| Free tier rate limit |
|
| Upstash Redis URL for persistent rate limiting | β |
| Upstash Redis auth token | β |
π Performance
Tested with 50-token bulk scan on Solana mainnet:
Metric | Value |
Success rate | 50/50 (100%) |
Avg response time | 5.4s |
x402 payment verification | Verified live on mainnet |
π¦ Tech Stack
Runtime: Node.js 22+ (ESM)
Language: TypeScript 5.9
Blockchain: @solana/web3.js (direct RPC, no wrapper SDKs)
API: Express 5
MCP: @modelcontextprotocol/sdk
Market Data: Birdeye API v3
NFT Data: Magic Eden v2 API (free tier)
Wallet Intel: Helius DAS / Identity / Funded-By APIs
Pool Data: GeckoTerminal API + Raydium V4 byte decode
π‘οΈ Why SicariusGuard?
Most token safety tools rely on third-party APIs that can be gamed. SicariusGuard reads raw mint account bytes directly from the blockchain β the same data the Solana runtime uses to execute transactions. No middleman, no stale data, no API that can be fooled.
Feature | SicariusGuard | RugCheck | GoPlus |
Byte-level SPL analysis | β | β | β |
Token-2022 extension scanning | β | β | Partial |
Jupiter honeypot simulation | β | β | β |
LP lock/burn detection | β | β | β |
Raydium V4 byte decode | β | β | β |
Token age analysis | β | β | β |
Deployer serial scammer detection | β | β | β |
NFT fraud detection | β | β | β |
Helius wallet reputation | β | β | β |
12-layer weighted scoring | β | β | β |
MCP server for AI agents | β | β | β |
x402 pay-per-call (SOL) | β | β | β |
Self-hosted (no vendor lock-in) | β | β | β |
Birdeye market enrichment | β | β | β |
Sub-6s full scan | β | β | β |
π Related MCP Servers
Build powerful agentic workflows by combining SicariusGuard with these complementary MCP servers:
Server | Description | Use With SicariusGuard |
AI-powered smart contract auditing for Solidity & Anchor/Rust | Audit the contract β scan the token with SicariusGuard | |
Real-time cryptocurrency market data | Get macro market context β validate token safety | |
DeFi safety layer β SPL approval scans & contract registry | Check approvals β scan token safety with SicariusGuard | |
Stock & market data for AI assistants | Cross-market correlation analysis |
β Star History
π License
MIT β Built by Chronolapse411
π Links
Twitter/X: @chronolapse411
Author: @Chronolapse411
Available Tools
11 toolsbatch_scanA
Scan multiple Solana tokens in a single call for portfolio-level risk assessment. Runs the full 10-layer analysis (same as full_token_scan) on each mint in parallel. Returns a JSON object with scanned count and a results array, each containing mint, safe (boolean), finalScore (0-100), verdict, honeypot status, LP lock status, token age, liquidity, marketFlags, and walletAge. Max 10 tokens per batch. This is a read-only operation with no on-chain side effects. Use this when evaluating a portfolio, watchlist, or multiple tokens from a pool discovery. Do not use this for a single token β use full_token_scan or check_token_safety instead, as they return more detailed results.
Inputs: mints (required).
check_holder_concentrationA
Analyze token holder distribution to detect supply concentration (a key rug pull indicator). Returns a JSON object with concentrated (boolean), reason, and stats showing percentage held by top 1/5/10 wallets. Flags risk if top 1 holder >50%, top 5 >80%, or top 10 >90%. This is a read-only RPC call with no on-chain side effects. Use this when you specifically need holder distribution data; use check_token_safety for a broader safety analysis that includes this check among others.
Inputs: mint (required).
check_honeypotA
Check if a Solana token is a honeypot by simulating a sell order through Jupiter DEX. Zero cost β only requests a quote, no actual transaction is executed. Returns a JSON object with isHoneypot (boolean) and sellability details. This is a read-only operation with no on-chain side effects or gas costs. Use this when you only need to verify sellability; use check_token_safety for a broader 8-layer analysis, or full_token_scan for the most comprehensive 10-layer scan including market data.
Inputs: mint (required), amount.
check_lp_lockA
Check whether a Solana token's liquidity pool has its LP tokens burned or locked. Discovers the primary pool via GeckoTerminal/Raydium, decodes the Raydium V4 pool state, computes LP burn percentage, and checks holders against known burn addresses and locker programs (Streamflow, UNCX). Returns pool address, LP mint, burn percentage, lock type, and risk score. This is a read-only operation with no on-chain side effects. Use this for LP-specific analysis; use full_token_scan for comprehensive analysis.
Inputs: mint (required).
check_nftA
Perform a safety analysis on a Solana NFT combining Helius DAS on-chain metadata with Magic Eden marketplace intelligence. Returns riskScore (0-100), verdict (SAFE | CAUTION | HIGH_RISK | CRITICAL), collection verification status, floor price, volume, creator verification, and per-signal flags. Read-only β no on-chain side effects. Use this for NFTs; use check_token_safety for fungible SPL tokens.
Inputs: mint (required).
check_token_ageA
Determine when a Solana token was created by finding its first-ever on-chain transaction. Returns creation timestamp, age in days, age category (newborn/young/adolescent/mature), and risk score. Newer tokens carry higher risk as they haven't been market-tested. This is a read-only RPC operation. Use this for age-specific analysis; use full_token_scan for comprehensive analysis.
Inputs: mint (required).
check_token_safetyA
Analyze a Solana SPL token for rug pull, honeypot, and safety risks. Call this BEFORE executing any swap or buy transaction. Performs 8 checks: mint authority, freeze authority, Token-2022 extensions, honeypot simulation, holder concentration, LP lock status, and token age. Returns a JSON object with a combined risk score (0-100) and verdict (SAFE | CAUTION | HIGH_RISK | CRITICAL). This is a read-only operation with no on-chain side effects. Rate limited to 100 free calls/day per IP. Use this instead of check_honeypot or check_holder_concentration when you need a comprehensive pre-trade safety check. Use full_token_scan instead when you also need Birdeye market data and wallet reputation.
Inputs: mint (required), txSignature, isPumpSwap.
full_token_scanA
Most comprehensive 10-layer safety analysis: combines on-chain byte-level inspection (mint auth, freeze, Token-2022, honeypot, holders), LP lock detection (burn %, locker status), token age analysis, Birdeye market intelligence (liquidity, volume, wash trading), and Helius wallet reputation data. Returns a JSON object with layered breakdown, weighted finalScore (0-100), verdict (SAFE | CAUTION | HIGH_RISK | CRITICAL), and detailed per-layer data. This is a read-only operation with no on-chain side effects. Use this for high-value trades where you need maximum confidence; use check_token_safety for a faster check without market data. Rate limited to 100 free calls/day per IP.
Inputs: mint (required), txSignature, isPumpSwap.
get_market_intelA
Get real-time market intelligence for a Solana token from the Birdeye API. Returns a JSON object with price, 24h volume, liquidity depth, market cap, holder count, 24h price change, and market risk flags (wash trading, low liquidity, extreme volume-to-liquidity ratios). This is a read-only API call with no on-chain side effects. Use this for trade sizing, market health assessment, and liquidity analysis. Do not use this for safety/rug-pull checks β use check_token_safety or full_token_scan for that. Requires a Birdeye API key for data.
Inputs: mint (required).
get_wallet_reputationA
Analyze a Solana wallet's reputation using Helius DAS identity data and funding chain analysis. Checks deployer/wallet age, funding source identity, and known entity classification. Returns a JSON object with creatorAddress, reputation verdict, riskScore, flags, creatorAge, and identity data. This is a read-only operation β queries Helius API with no on-chain side effects. Use this to evaluate whether a token deployer or counterparty wallet is trustworthy before transacting. Do not use this for token analysis β use check_token_safety or full_token_scan for that. Requires a Helius API key for full results.
Inputs: address (required).
recon_deployerA
Perform a deep background investigation on a Solana wallet to determine if they are a serial rugger. Analyzes their entire token deployment history algorithmically β no hardcoded blacklists. Returns a JSON dossier with: totalTokensLaunched, portfolio health breakdown (alive/abandoned/rugged), deadTokenRatio, wallet creation date, funding genesis (who funded them), Recidivism Score (0-100), and verdict (CLEAN | SUSPICIOUS | SERIAL_DEPLOYER | LIKELY_SCAMMER). Use this to evaluate a deployer before trusting their token. This is a read-only operation using DAS API and Enhanced Transactions β zero extra cost on Helius Developer plan.
Inputs: address (required).
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelogβ¦
TDQS
Scored across 11 tools
Each tool targets a distinct aspect of Solana token safety analysis (e.g., batch scanning, specific checks for honeypot, LP lock, holder concentration, NFT, wallet reputation, deployer background). No two tools have overlapping purposes, and descriptions clearly delineate when to use each.
All tool names follow a consistent verb_noun pattern (e.g., check_honeypot, get_market_intel, recon_deployer). Verbs are appropriately descriptive and uniform, aiding predictability for an agent.
With 11 tools, the server is well-scoped for its domain of Solana token security analysis. Each tool serves a necessary function without redundancy, covering individual checks, comprehensive scans, and specialized analyses.
The tool surface covers a wide range of safety checks (token, NFT, wallet, deployer) and includes batch processing and market intelligence. A minor gap might be the lack of a direct buy simulation, but the honeypot check covers sell simulation, and the overall set is highly comprehensive.
Maintenance
Related MCP Connectors
Solana token safety for AI agents β rug-pull, honeypot & Token-2022 trap detection before you buy.
AI Agent Utility Layer for agent safety, web monitoring, crypto research and tool discovery.
Pre-trade token safety checks for AI agents on Solana and Base. x402 USDC per call, no key.
Solana onchain intelligence for AI agents: wallet risk, due-diligence, perps funding, smart money.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceA cryptocurrency price query service based on Model Context Protocol that provides tools for retrieving virtual currency prices, market trends, detailed information, and K-line data.3-

RAD Securityofficial
AlicenseCqualityCmaintenanceCP server for RAD Security, providing AI-powered security insights for Kubernetes and cloud environments. This server provides tools for querying the Rad Security API and retrieving security findings, reports, runtime data and many more.65702 npm7MIT- AlicenseAqualityDmaintenanceAn MCP server that tracks stablecoin peg integrity across multiple blockchains.44MIT
- AlicenseNot gradedqualityDmaintenanceAn MCP server that connects ZetaChain CLI into your editor. Query balances, send cross-chain transactions, and manage universal contracts directly through MCP.117 npm6ISC