Health, version, amendments and ledger range of a Xahau node (mainnet or testnet). Read-only.

Account root: balance, sequence, flags, regular key. Read-only.

Ledger objects owned by an account, optionally filtered by type (hook, hook_state, uri_token, etc.). Read-only.

The Hooks installed on an account, with each HookOn bitmap decoded to the transaction types it fires on. Read-only.

Fetch a HookDefinition ledger object by hash (CreateCode WASM, HookOn, fee, reference count). Read-only.

Read Hook State entries for an account namespace (32-byte key→value map). Read-only.

A validated transaction by hash, including Xahau HookExecutions metadata (hook return codes/strings). Read-only.

Header/summary of a ledger (default the latest validated). Read-only.

Current network transaction fee (base fee in drops + load/queue state) — for building a tx with the right Fee. Read-only.

Trustlines (issued-currency balances) held by an account. Read-only.

Open DEX offers placed by an account. Read-only.

One-call plain-English account snapshot: balance, key-safety read (master/regular key), installed Hooks (+what they fire on), trustlines, URITokens (Evernode leases auto-decoded), and recent activity — plus warnings and notes. Read-only; exactly 5 serial RPC reads (>=1100ms apart).

URITokens (Xahau-native NFTs) owned by an account, with each token's URI decoded from hex to text. Read-only.

Decode a HookOn 256-bit bitmap into the set of transaction types the hook fires on. Handles the inverted/active-low encoding and the active-high SetHook bit. Offline.

Build a canonical HookOn hex from a list of transaction types to fire on. Offline.

Decode a HookCanEmit 256-bit bitmap into the set of transaction types a hook is permitted to EMIT (HookCanEmit amendment). Same encoding as HookOn (inverted/active-low, active-high SetHook bit). NOTE: an ABSENT HookCanEmit field means the hook may emit ANY transaction (including SetHook) — this tool only decodes a present value. Offline.

Build a canonical HookCanEmit hex from the list of transaction types a hook should be allowed to emit (HookCanEmit amendment; same encoding as HookOn). Omit the field entirely on the SetHook to allow emitting anything. Offline.

Compute the owner-reserve cost of Hook State entries under ExtendedHookState. Given each entry's value size in bytes and the HookStateScale (1–16), returns per-entry capacity (256×scale bytes), per-entry reserve units (= scale, charged even for 1 byte), total reserve units, overflow warnings, and the minimum scale needed. Reserve UNITS are exact; pass ownerReserveIncrementXah to also get an XAH figure. Offline.

Statically predict which accounts' hooks a transaction WOULD invoke (transactional stakeholders), with strong (can rollback) vs weak (runs, can't rollback) roles — from the tx fields alone, no bytecode run and no ledger read. For tx types whose stakeholders require ledger-object lookups it returns a partial flag rather than guessing. For a full prediction that runs the real hook bytecode against live state, use simulate_transaction. Offline.

Decode a SetHook transaction (JSON or tx blob) into its hook definitions, each with HookOn decoded. Offline.

Decode a Xahau transaction blob (hex) into JSON via the Xahau-aware binary codec. Offline.

Encode a transaction JSON into an UNSIGNED Xahau binary blob (for inspection/round-trip; never signed). Offline.

Validate a URIToken ID and explain its structure (SHA512-Half of issuer||URI; not reversible offline). Offline.

Convert between XAH and drops (1 XAH = 1,000,000 drops). Offline.

Validate a Xahau/XRPL address (classic r-address or X-address) → type, account-id, embedded destination tag, network. Offline.

Encode a classic address + destination tag into an X-address, or decode an X-address back to classic + tag. Offline.

Convert a currency between 3-char ISO code (e.g. USD) and its 160-bit/40-hex form. Non-standard 160-bit codes pass through. Offline.

Decode a transaction engine result code (e.g. 0/tesSUCCESS, 153/tecHOOK_REJECTED) ⇄ its name. Accepts a number or the result-code name. Offline.

Convert between Ripple time (seconds since 2000-01-01), Unix time, and ISO 8601. Xahau tx/ledger timestamps use Ripple time. Offline.

Decode an XPOP (Xahau Proof of Payment) — the proof blob inside an Import/Burn2Mint tx. Accepts the Import Blob hex (hex of the XPOP JSON) or the XPOP JSON itself. Returns the source ledger header, the decoded inner BURN transaction (type, burned drops = its Fee, target network), and the UNL validator set. Offline.

Decode what a hook's emit() actually built: pass the emitted[] blob hex(es) from an execute_hook result → each decoded to tx JSON + a plain-English 'what it tries to send' summary + danger score (scam rules). Closes the loop on emitter hooks. Offline.

Decode an Evernode lease URIToken URI (the evrlease/LTV format) → lease index, lease amount in EVR (XFL-decoded), half ToS hash, mint identifier, outbound IP. Accepts the on-chain URI hex, the base64 text, or raw buffer hex. Verified against the canonical evernode-js-client encoder + real mainnet leases. Offline.

Decode an amount: native drops (digits), a serialized 8-byte native or 48-byte issued STAmount (hex), or an issued amount object {currency,issuer,value} → normalized value/currency/issuer. Offline.

Decode a sign request (a Xaman/Xumm payload's txjson, or a raw tx_blob hex) into the transaction plus a plain-English 'what you would be authorizing' summary and safety warnings (SetHook, AccountDelete, key changes, no-expiry, already-signed). Offline — understand before you sign.

Score a sign request (txjson or raw tx_blob hex) for risky patterns BEFORE signing: returns dangerScore 0-100, a SAFE/CAUTION/DANGER tier, a plain-English verdict, and per-rule findings (SetHook, AccountDelete-to-other, regular-key/signer-list changes, very large native payment, no-expiry replay risk, pre-signed blob). Offline + read-only. HONESTY: every finding is a POTENTIAL risk, NOT a confirmed scam — this tool does NOT consult any block list and NEVER verifies on-chain whether an address is malicious; it reads the transaction shape only. DANGER is reserved for near-universally-malicious/irreversible patterns.

Parse a Hook's CreateCode WASM (hex or base64): imports (Hook API functions), exports (hook/cbak), memory, custom sections, loop and guard(_g) counts. Offline, never executes the module.

THE MOAT: run the Hook static-analysis / security rule engine over a CreateCode WASM (+ optional SetHook params) and return SARIF-lite findings. The first Hooks-specific analyzer. Offline.

Fetch every hook on an account, pull each HookDefinition's WASM, and run the analyzer over all of them. Read-only network + offline analysis.

Enumerate the Hook analyzer rule registry (id, severity, title, category). Offline.

Quick STATIC check: does this hook fire on a given transaction type (HookOn match) and what exit calls does its WASM contain? Labelled STATIC_ONLY. For REAL bytecode execution use execute_hook. Offline.

GROUNDBREAKING: actually RUN a Hook's real WebAssembly bytecode in a local VM against a simulated transaction + ledger state, and report the true accept/rollback decision, return code/string, state writes, emitted txns and execution trace. The first dev-accessible Hook simulator that needs no xahaud node. Implements a subset of the Hook API; unsupported calls are recorded (fidelity LOCAL_VM, never faked).

Annotate the trace[] array from an execute_hook result. Each entry is "label: HEXVALUE" (the hook's trace() memory dump). Decodes each blob by byte-width: 8-byte → canonical XFL float (definite) else int64 (both endians) + native-drops reading; 4-byte → UInt32 (both endians) + Ripple-epoch ISO date if in range; 20-byte → candidate account-id → r-address (possible, since arbitrary bytes can coincidentally encode); 32-byte → possible tx/hook hash (heuristic); other widths → raw blob. The raw hex is ALWAYS preserved as the primary field; nothing is suppressed; confidence is 'definite' only for canonical XFL. Fully offline, no network.

DIFFERENTIAL FUZZER: finds a Hook's accept/rollback decision boundary by running its REAL bytecode through the local VM against many DETERMINISTICALLY generated inputs (no randomness, no clock — fully reproducible). Sweeps axes you request: txType (a supplied list or all tx types), a raw otxn Amount-field byte range, otxn account/destination ids, and named otxn params. Reports counts {accept,rollback,halted,degraded}, per-axis boundary findings, and concrete accepting/rejecting sample inputs. Honest: degraded/halted runs are counted but excluded from the boundary; if every run degrades/halts it says INCONCLUSIVE and why. fidelity LOCAL_VM_FUZZ.

Estimate a Hook's cost signals from its WASM: byte size (drives the SetHook fee) and total static instruction count (a complexity/upper-bound proxy for execution fee). Labelled ESTIMATE — the on-ledger execution fee depends on the path actually executed. Offline.

One-call comprehensive report on a Hook: structure (imports/exports/size/instructions), a plain-English classification of what it does, the full security analysis (SARIF-lite findings + severity summary), HookOn decode, and a fee estimate. Combines inspect + classify + analyze + estimate. Offline.

Generate a starter Xahau Hook in C for a stated intent (accept_all, firewall, payment_limit, require_dest_tag, state_counter, notary) — structurally valid (hook() entry, _g guards, accept/rollback) with build instructions. A STARTING POINT to compile + then verify with analyze_hook/execute_hook before deploying. Offline.

Infer in plain English what a Hook DOES (firewall/filter, emitter, stateful processor, financial/XFL, authorizer, autonomous agent…) from its structure — imports, hook/cbak exports, HookOn, state/emit/float/guard usage. Heuristic, offline; does not execute the bytecode.

Compare two Hook versions (before/after an upgrade): imports/exports added or removed, HookOn changes, size/instruction deltas, and any newly-gained security-sensitive capability (emit, foreign-state write, hook_again, signature verify). Offline.

Look up a Hook API function: category, exit/guard role, and security hazard metadata. Offline.

Project claimable XAH network reward using the documented time-weighted model. Supply reward fields directly, or an address to read them live. Labelled DOCUMENTED_MODEL. LEGACY approximation — prefer reward_status, which applies the exact genesis reward-hook formula with live parameters.

Balance Adjustment doctor — the full answer to Xahau's most common retail question: is this account opted in to network rewards, how much XAH is accrued (EXACT genesis reward-hook formula — reward.c — with live RR/RD read from genesis hook state), when can it next claim, and is the claim overdue (late claiming forfeits yield — the hook pays the per-claim rate once regardless of wait). Returns an unsigned opt-in or claim ClaimReward when applicable. Read-only; 3 serial RPC reads.

One-call health check for an Evernode host (the official docs' troubleshooting checklist, automated): registration entry on the governor namespace, heartbeat liveness vs the on-chain active rule (current moment − heartbeatFreq×momentSize), instance load, reputation byte, EVR trustline + balance, registration URIToken held, lease offers, machine specs + accumulated EVR reward. Layout verified against canonical evernode-js-client + live mainnet. Read-only; ~9 serial RPC reads (slow but thorough).

Why did my transaction fail? Plain-English diagnosis from ON-CHAIN facts: engine result decoded to cause + concrete fix (catalog of ~30 common Xahau failure codes), hook rollback return-strings decoded and interpreted (e.g. the genesis reward hook's 'You must wait N seconds' becomes a claimable-at date), the partial-payment trap on 'successful' Payments (delivered_amount vs Amount), and not-found triage (expired LastLedgerSequence / wrong network). 1 RPC read; authoritative — decodes what the chain recorded, re-executes nothing (use hook_execution_postmortem to replay hooks).

Every account a transaction touched, from its metadata (AffectedNodes). Because the Touch amendment forces all transactional stakeholders into metadata — even ones nothing else changed for — this is the authoritative participant list, not a guess from tx fields. Returns each account with its roles, the ledger entry types it appeared in, and whether it materially changed. 1 RPC read.

Structural audit of a transaction's metadata threading — lists each affected ledger object's PreviousTxnID / PreviousTxnLgrSeq and flags the duplicate-node symptom that fixProvisionalDoubleThreading addressed (a single ledger object touched by more than one AffectedNodes entry). Metadata-only check; does not walk the full cross-ledger thread. 1 RPC read.

Read the Remarks (Remarks amendment) attached to an account's owned ledger objects — decoded name/value (hex→text where printable) with the immutable flag surfaced. Useful for dynamic-NFT patterns and object annotations. Follows the account_objects marker so accounts with many objects don't drop remarks on later pages (capped at 20 pages — truncated:true if hit); 1+ RPC reads.

THE PRE-SIGN FLIGHT SIMULATOR — predict what Xahau will do with an UNSIGNED transaction before you sign it. Every hook the tx would trigger (originator chain first, then strong/weak transactional stakeholders — order canonical from xahaud Transactor.cpp/applyHook.cpp) runs as REAL bytecode against LIVE ledger state in the local VM (measured 100% agreement on 30 real mainnet hook executions — all accept-direction; rollback direction proven separately on real genesis bytecode). Reports per-hook accept/rollback + return strings, simulated state writes, decoded emitted transactions, labeled STATIC engine preflights (sequence/balance/destination/expiry), an APPROXIMATE transactor prediction (the stand-in for Xahau's missing simulate RPC — predicted engine_result + balance/reserve/trustline deltas for Payment/TrustSet against live state, labeled APPROXIMATE; other tx types UNSUPPORTED), and a scam score. Never signs, never submits. Slow but thorough (iterative state resolution, ~1.1s per read).

TIME MACHINE — counterfactual replay of a REAL historical transaction: fetch it by hash, apply your field overrides (different Amount, Destination, params, ...), then run the full flight simulator AT THAT HISTORICAL LEDGER (hooks, state and parameters as they were). Answers 'what would have happened if this tx had been X?'. Read-only; nothing is signed or submitted.

Grade a Xahau account for quantum (HNDL) FUTURE-hardening readiness: master-key-disabled, regular key, multi-sign, and a PROVEN quantum-policy Hook → 0-100 score + tier + recommendations. Framed as hardening, not a safety alarm (a BASELINE account is normal, not unsafe). A hook is credited (+30) ONLY when its exact bytecode (HookHash) matches a registered xahc-prover-PROVEN quantum-policy hook (e.g. qkey_guard / master-disuse); mere hook presence is never scored. Read-only.

WHOLE-LEDGER key-rotation posture census via ledger_data (AccountRoot Flags/RegularKey/Balance) — no per-account tx scan, so figures ARE network statistics. Reports % of accounts AND % of XAH supply with: no rotation path (master active + no regular key), master disabled, regular key set. Measures CONFIG (can the master key be retired?), not exposure (hndl_exposure does that). HEAVY + rate-limited; paced. Read-only.

Network-level Quantum Readiness Scorecard: aggregate HNDL exposure (hndl_exposure) + config grade (quantum_grade) across a SAMPLE of accounts. HONEST SCOPE: a sample of recently-active accounts (or a caller-supplied list), NOT a ledger census — active accounts skew toward exposed, so figures are a sample, not a network %. Reports exposure-class breakdown, balance-at-risk, conclusive-vs-unknown, grade tiers, and top exposed. HEAVY (many RPC reads). Set --markdown for a public-facing report. Read-only.

Measure an account's Harvest-Now-Decrypt-Later exposure: has its signing PUBLIC KEY been revealed on-ledger, and which key? An r-address is a HASH of the pubkey; the pubkey is exposed only once the account signs a tx. Walks history OLDEST-first and classifies: master (IRREVERSIBLE — master key can't be rotated), regular / multisig (RECOVERABLE — rotate the key), or none (never signed = hash-only, not Shor-actionable). Reports balance-at-risk + honest truncation caveat. Read-only.

Genesis Governance Game — FULL live decode of the L1 table's hook state (layout canonical from xahaud hook/genesis/govern.c): all 20 seats and their members, member count, live reward rate/delay, every OPEN VOTE (who voted what, per topic) and every tally with its threshold (membership topics 80% of filled seats, everything else 100%) and whether it's reached. Plus the documented constants + a live genesis-account read. 2 RPC reads.

Heuristically classify a Burn2Mint-related transaction (XRPL↔Xahau bridge direction). Offline.

Live amendment status for the network: every ENABLED amendment (resolved to its human name where known, raw hash otherwise) plus any in the VOTING set (already at >80% support, counting toward enablement). Reads the on-ledger Amendments singleton — no admin node needed. 1 RPC read.

Project when amendments now holding majority will enable. For each amendment in the on-ledger Majorities set: when it reached >80% support and its estimated enable time (majority + 5-day Xahau window), with seconds/days remaining. Reads the Amendments singleton — no admin node needed. 1 RPC read.

Report whether the configured RPC node for this network is AMENDMENT BLOCKED (running xahaud too old to understand an enabled amendment — can't validate, submit, or vote), plus its build version and validated ledger. Reads server_info. Checks the network's fixed endpoint (no arbitrary-URL input, by design). 1 RPC read.

Diff the enabled-amendment sets of two networks (e.g. mainnet vs testnet) — what's enabled on one but not the other, by name where known. Explains why a transaction or Hook feature works on one network but not the other. 2 RPC reads.

Assemble an UNSIGNED SetHook transaction from CreateCode + params, auto-running analyze_hook as preflight and flagging CRITICAL findings. Returns unsigned JSON + offline signing instructions. Never signs; testnet by default.

Assemble an UNSIGNED ClaimReward transaction. Returns unsigned JSON + offline signing instructions. Never signs; testnet by default.

Assemble an UNSIGNED Import (Burn2Mint) transaction wrapping a HEX-encoded XPOP in the Blob field. Returns unsigned JSON + offline signing instructions. Never signs; testnet by default.

ROTATION WIZARD step 1 — assemble an UNSIGNED SetRegularKey to assign a rotatable regular key (or remove it if regularKey omitted). Moving authority off the unrotatable master key is the near-term quantum (HNDL) defense. Returns unsigned JSON + signing instructions; NEVER touches a secret. After it lands, send a TEST tx signed by the new key before disabling master.

Derive an account's MASTER public key from the ledger — the SigningPubKey of any self-originated tx whose pubkey hashes to the account's own AccountID. Needed to configure a qkey_guard hook (its MPK param). Returns found=false if the master key has never signed (then the pubkey is not on-ledger). Read-only.

ROTATION WIZARD gate — is it SAFE to disable this account's master key? Checks for a working alternative signer: proves whether the configured regular key has ALREADY signed for the account (gold standard) and whether a signer list exists. Returns safeToDisable + proven + reasons. Read-only. Run this BEFORE build_disable_master_unsigned.

ROTATION WIZARD step 3 — assemble an UNSIGNED AccountSet asfDisableMaster (retire the master key). IRREVERSIBLE. ALWAYS runs disable_master_readiness internally and FAILS CLOSED — blocked=true unless a PROVEN working alternative signer exists (a regular key that has signed, or a reachable signer list that has multi-signed). Never signs.

ROTATION WIZARD alt — assemble an UNSIGNED SignerListSet (multisig). Often SAFER than disable-master for high-value accounts: multiple recovery keys, no single point of loss. quorum=0 removes the list. Rejects an unreachable quorum (would lock out the account). Never signs.

Assemble an UNSIGNED XAH Payment (amount in drops). Returns unsigned JSON + offline signing instructions + payload preflight. Never signs; testnet by default.

Assemble an UNSIGNED Remit (XLS-55) — Xahau's atomic multi-asset push payment. Send multiple currencies (native + issued) and/or transfer existing URITokens and/or mint a new URIToken to one Destination in a single all-or-nothing transaction. The transactor auto-creates missing trustlines, pays token reserves, and creates the destination account if absent (no partial payments, no pathing). Optionally Inform a third-party hook. Returns unsigned JSON + payload preflight + offline signing instructions. Never signs; testnet by default.

Assemble an UNSIGNED SetRemarks (Remarks amendment) — attach, update, or delete key-value remarks on a ledger object you own (or, for URITokens/trustlines, issue). Each remark: name (required), value (omit to DELETE), immutable (Flags:1 = permanent). Max 32 per object, names unique, 1–256 bytes each; cost +1 drop/byte. RemarkName/RemarkValue are hex (non-hex text is UTF-8 encoded). Powers dynamic NFTs and rich object annotations. Returns unsigned JSON + preflight. Never signs; testnet by default.

Assemble an UNSIGNED Clawback — an issuer revokes previously-issued tokens from a holder (ported from XRPL). Account is the ISSUER; the holder is whom you claw from. NOTE: requires the issuer to have enabled clawback (AccountSet asfAllowTrustLineClawback) BEFORE issuing. Cannot claw native XAH. Returns unsigned JSON + preflight. Never signs; testnet by default.

Assemble an UNSIGNED TrustSet that toggles a freeze on your trustline to a counterparty. action: deep_freeze (blocks holder sending AND receiving — needs DeepFreeze amendment), clear_deep_freeze, freeze (blocks sending only), unfreeze. Returns unsigned JSON + preflight. Never signs; testnet by default.

Assemble an UNSIGNED CronSet — schedule a Hook's future self-invocations (Cron amendment). StartTime is Ripple-epoch seconds (0/omitted = ASAP); use startInSeconds for now+N. RepeatCount 0–256 (omit for a one-off), DelaySeconds = interval between repeats. Set cancel:true for tfCronUnset to remove the Cron. The account must have a Hook installed to act on the Cron pseudo-transaction. Returns unsigned JSON + preflight. Never signs; testnet by default.

List an account's Cron ledger objects — scheduled Hook self-invocations — with decoded StartTime (ISO), DelaySeconds, remaining RepeatCount and an estimated next-fire time. Raw ledger object included per entry. 1 RPC read.

Check an account's Crons for ones nearing exhaustion — remaining RepeatCount at or below a threshold (default 8) — so a recurring governance/game Hook doesn't silently stop. Returns alerts + a healthy flag. 1 RPC read.

Autofill an unsigned transaction with live network values — Sequence (from the account), Fee (current base fee), LastLedgerSequence (now + offset), and NetworkID — so it's ready to sign OFFLINE. Read-only: fetches values, fills the tx, but NEVER signs or submits. Defaults to TESTNET — pass network:'mainnet' for a mainnet account (else you get a mainnet account's testnet Sequence/NetworkID or actNotFound).

HONEST FIDELITY METRIC: measures how faithfully the local Hook VM reproduces what REALLY happened on Xahau mainnet. Loads a committed corpus (data/hook-corpus.json) of real validated transactions whose metadata carried HookExecutions, runs each hook's real bytecode through the local VM, and compares the VM's accept/rollback DIRECTION to the on-chain HookResult. The agreement % is computed ONLY over COMPARABLE (non-degraded, scoreable) runs; degraded/halted/indeterminate runs are reported separately and EXCLUDED — never counted as a match. Strictly offline; reads no network. If the corpus is empty/tiny it says 'insufficient corpus' rather than print an unsupported number.

POST-MORTEM a real Xahau transaction's hooks: fetch the tx (with meta.HookExecutions + engine result), then for EACH hook that fired, run its REAL bytecode through the local VM and compare the VM's accept/rollback DIRECTION to what the chain actually recorded. Answers 'why did these hooks accept/rollback, and would the VM agree?'. The on-chain decision is AUTHORITATIVE; the VM run is best-effort and always labeled fidelity=LOCAL_VM. agree is null (not false) when the VM run is degraded/halted/no-exit or the on-chain decision is indeterminate (e.g. no CreateCode available) — never scored as a match or miss. Read-only; never signs/submits. Serial rate-limited RPC: 1 tx call + 1 ledger_entry per UNIQUE HookHash (deduplicated), each >=1100ms apart; tolerates literal 'Rate limited' bodies via the shared client.