GuardBot ⚡ — pre-trade safety for agents & bots

One paste field, two questions, three ecosystems (EVM · Solana · TRON):

• "Is this token a trap?" — GuardBot actually buys and sells it in a simulation against live liquidity. No vendor API. Verdict: safe / warn / block, each check with its evidence.

• "What did this wallet already approve?" — every standing approval in one table, across chains no single revoke tool unifies. Then revoke it: your wallet signs, and the effect is proven on-chain before you sign.

Try it — 2 minutes, zero dependencies

Python stdlib only. No pip install, no keys, no account. Everything runs on your machine.

git clone https://github.com/anthonygozzini/guardbot && cd guardbot
python3 guardd.py            # open http://127.0.0.1:8403/view

• Paste a token contract → safety verdict.

• Paste a wallet → its approvals, with Revoke buttons.

• Connect a wallet → one QR opens one WalletConnect session for EVM + Solana + TRON together (needs a free projectId: GUARDBOT_WC_PROJECT_ID=<id> python3 guardd.py).

From the CLI or as an agent tool:

python3 tokencheck.py bsc 0x<token>       # is it a trap?
python3 approvals.py  0x<wallet>          # what has it approved? (also T… / Solana base58)
python3 revoke.py bsc approval 0x<token> 0x<spender> 0x<wallet>   # prove the revoke first
python3 mcp_server.py                     # MCP: check_token, check_approvals,
                                          #      simulate_revoke — the agent tools

In a container, the way a registry or a sandboxed client starts it (no dependencies to install):

docker build -t guardbot . && docker run -i --rm guardbot   # MCP over stdio

Related MCP server: rug-check

Why trust the verdicts

• The buy and sell are real. A state-override eth_call gives a throwaway address native coin and trades the token atomically against the live pool. Sell reverts → honeypot. Money missing from the round trip → that is the tax.

• A failure must prove itself. Every failed sell is re-run against a control token on the same node in the same moment; if the control fails too, the observation is discarded. The whole analysis is pinned to one block. (Without this, USDT got branded a honeypot. Twice.)

• Names are never trusted. Among 1,209 real approved BSC tokens, four call themselves "USDT". Identity comes from a mined per-chain registry of who actually trades under a ticker, judged by liquidity ratio — and lookalike characters are folded first (homoglyphs.py), so a ticker that only renders as USDT fails for the disguise itself.

• Measured: 5/5 known honeypots blocked, 0 false positives in 20 consecutive runs on CAKE/USDT/BUSD/WBNB, round trips land at exactly the pool fee ×2. A user-supplied test set of 4 live fakes → all block, each for its own reason; one of them is shown as PASSED by honeypot.is.

• Solana and TRON are read first-hand too: mint/freeze authorities and Token-2022 extensions (permanent delegate, transfer hook, transfer fee); TRON bytecode scanned for seize/blacklist/mint powers.

Revoking

• Only three calls can ever be built, zeroes hard-coded: approve(spender, 0), setApprovalForAll(op, false), Permit2.approve(token, spender, 0, 0). No transfer, no arbitrary call, no path around it.

• The page shows the exact call, contract, chain and calldata before anything is signed. Your wallet signs one transaction at a time; the server never sees a key.

• Proven before signing: the revoke is executed in simulation and the permission re-read at zero. "✓ simulated" appears only when the node actually did it.

• Proven for real: EVM revokes signed and confirmed on mainnet; Solana and TRON revokes landed on their testnets, signed by this repo's own stdlib ed25519/secp256k1 signer (tools/testnet_e2e.py, self-tested against the RFC 8032 reference vectors).

• Worth knowing: zeroing your ERC-20 approval to Permit2 does not clear grants already inside Permit2. GuardBot reads and revokes those separately.

Coverage and speed

• Live multi-chain scan ≈ 2s on a normal wallet; cached re-open in microseconds (local incremental index in ~/.guardbot — private, never uploaded).

• BSC publishes no free log history, so it is probed against a chain-mined candidate universe — and the first scan of each wallet auto-starts a one-time deep scan that walks the wallet's own transactions (an approve is always a transaction the owner signed). Verified: matches revoke.cash to the decimal on a wallet the probe alone missed.

• Anything unreadable is labelled partial or probed on screen. Never silently dropped.

Honest limits

• "LP burned" is checked; third-party LP lockers are not — a locked-but-unburned LP reads as a caution.

• No holder-distribution check on EVM (Solana has concentration).

• Relayer-executed EIP-2612 permits leave no owner transaction, so the BSC deep scan cannot see them (the Permit2 kind is probed).

• The first scan of a busy wallet is slow on free public RPCs (~30–90s). Re-scans are instant.

• Mined data (registries, probe universes) ages; the UI shows its age and python3 tools/refresh.py re-mines everything.

Tests

python3 -m unittest discover -s tests                    # 51 offline tests, ~0.3s
GUARDBOT_LIVE=1 python3 -m unittest discover -s tests    # + 19 live tests on real chains

Many are regressions for bugs that actually shipped here. The testnet signing proof is python3 tools/testnet_e2e.py solana|tron — throwaway local key, zero value at risk.

Configuration (all optional)

Payments (x402) — off by default

The repo is free forever; humans never pay for safety. For a hosted deployment there is a real x402 rail: unpaid calls get HTTP 402 with the price, an agent pays USDC through a facilitator (/verify + /settle, replay-guarded), and the paid endpoint serves the same first-hand engines. Missing facilitator → paid calls are rejected, never faked.

GUARDBOT_PRICE_USDC=0.01 GUARDBOT_NETWORK=base-sepolia \
GUARDBOT_FACILITATOR=<url> GUARDBOT_PAY_TO=0x<you> python3 guardd.py

Files

• tokencheck.py / solcheck.py / troncheck.py — the first-hand safety engines

• approvals.py — multi-chain approvals scanner (+ local index)

• revoke.py — the three revoking calls + on-chain simulation

• guardd.py — HTTP daemon and /view UI · mcp_server.py — agent tools

• homoglyphs.py — lookalike-character folding · keccak.py — pure-Python keccak256

• tools/ — miners (mine_*.py), refresh.py, deepscan_bsc.py, testnet_e2e.py

Measured error rate

GuardBot is scored, not trusted. benchmark/harness.py replays check_token over a fixed set of tokens whose nature was established by someone else, and publishes every wrong answer by name. Ground truth is never GuardBot's own verdict: a trap is either an impostor proven by an on-chain fact (symbol() claims a major ticker while the canonical contract lives at another address) or a honeypot labeled by GoPlus on a recorded date; a blue chip is a canonical contract whose tradability nobody disputes. A trap counts only while its pool is alive — a dead trap is blocked by anyone, so it is listed, not scored.

Run of 2026-09-19 23:23 UTC, GuardBot 9068887, 29 tokens (benchmark/results.json has every row):

What the harness has already paid for, on its first run: Ethereum USDT came back block, a false honeypot on the most traded token there is. The cause was a stranger's leftover 4 USDT allowance from the shared Multicall3 contract to the Uniswap router, which Tether's approve() refuses to overwrite; the sell simulation now zeroes the allowance first. That is the point of measuring: the number was wrong before anyone said so.

What the numbers do not say:

• Five live traps is a small set. Live honeypots with an independent label are rare and short-lived — of 155 pools launched on BSC and Base on 2026-09-19, two still had a pool twelve hours later, and the labelers disagreed on the one flagged. benchmark/hunt.py collects fresh launches and labels them with both GoPlus and honeypot.is; only tokens both agree on, with a live pool, are added. The set grows as they are found; the rate is re-measured every release.

• Liquidity is measured on the native-coin pair only. A token whose depth sits in a USDT pair can be reported as thin even when it trades fine (seen on a BSC token with $194k in its USDT pool and $20 against WBNB). That is a coverage limit, not a verdict, and it is not in the score.

• Labelers are not oracles. honeypot.is flags a BSC token (AKE, 42k holders) as a honeypot; GoPlus and GuardBot's own buy-and-sell both say it sells at 101%. Disputed tokens stay out.

Reproduce: python3 benchmark/harness.py (adds --relabel to re-ask GoPlus whether each trap still is one). Extend: python3 benchmark/hunt.py collect bsc today, … label tomorrow.

References

• x402 payment protocol (the spec the payment rail implements) — https://github.com/x402-foundation/x402

• GoPlus address_security — https://docs.gopluslabs.io/reference/api-overview — used only as a reputation hint on spender addresses and as legacy fallback for uncovered chains; token verdicts are always produced first-hand.

This is a safety signal on public data, not financial advice.

License

MIT — see LICENSE.

Who built this

Anthony Gozzini — project page · anthonygozzini.github.io