Automaton Onchain Tools

Pay-per-call crypto and security APIs for AI agents. You pay with x402: $0.005 to $0.01 per call in USDC on Base (eip155:8453). There's no signup and no API key. An MCP server is included.

Live: https://automaton-tx-explainer.vercel.app · OpenAPI · llms.txt · x402 discovery

Not an agent? /check is a web page where anyone can buy the $0.25 wallet or token report, or the $1.50 token deep scan, with a browser wallet (MetaMask, Coinbase Wallet, etc.) using the same x402 flow. Page sources are in check-src/; node check-src/build.mjs (needs esbuild) regenerates check-assets.js.

Endpoints

{chain} is one of base, ethereum, bsc, arbitrum, optimism, polygon or avalanche (C-Chain). With the Solana token check, the Solana address and delegate lookups and the launch feeds that gives 43 paid tools.

Arbitrum, Optimism, Polygon and Avalanche get the four per-chain lookups only (tx, approvals, address, contract-risk), all at $0.005, and their address and contract-risk responses carry the copycat-token flag (see below). They are not part of the gas snapshot, portfolio, wallet/token reports, deep scan or launch feeds, which stay on Base, Ethereum and BNB Chain.

Arbitrum, Optimism, Polygon and Avalanche lookups

• Data: free public RPCs with a fallback (Arbitrum arb1.arbitrum.io + publicnode, Optimism mainnet.optimism.io + publicnode, Polygon publicnode + polygon-rpc.com, Avalanche api.avax.network + publicnode; override with ARB_RPC, OP_RPC, POLYGON_RPC, AVAX_RPC, comma-separated). Source verification is Sourcify, which supports all four chains; if Sourcify can't be reached the response says so (verified: null plus an info finding) instead of guessing.

• Approvals: 8 major tokens per chain (native USDC and bridged USDC.e, USDT/USDT0, WETH, WBTC/BTC.b, DAI, plus ARB, OP, WPOL or WAVAX/JOE) against 8-10 spenders: Permit2, Uniswap Universal Router (v4 and older), SwapRouter02, 1inch v6, LI.FI, Odos v2, the 0x Exchange Proxy where it is deployed (not on Optimism), Velodrome v2 (Optimism), QuickSwap (Polygon) and LFJ/Trader Joe (Avalanche). Addresses come from Circle, Uniswap's deployment docs and Sourcify/Routescan verified contract names, and were checked onchain.

• Copycat flag: /address adds copycat and /contract-risk adds copycat plus a finding (and raises risk to at least medium) when a token's name or symbol copies a major asset but its address isn't that chain's official one. On these chains ARB, OP, POL/WPOL/MATIC/WMATIC, AVAX/WAVAX and USDT0 count as majors too, only on their home chain.

How the approval sweep works

• Discovery (free, keyless): GoPlus approval-security data (ERC-20 on Ethereum, BNB, Base, Arbitrum, Polygon; NFTs on Ethereum, BNB, Arbitrum, Polygon), Approval / ApprovalForAll event logs where the owner is the wallet from Routescan (Ethereum, Avalanche) and Blockscout (Ethereum, Optimism, Base, Arbitrum, Polygon, when reachable), plus our major-token x common-spender pairs on every chain.

• Everything is re-read onchain (allowance() / isApprovedForAll() via Multicall3), so revoked or stale index entries never show as live. Unlimited = at least 2^96-1.

• Spender checks: known label (per-chain list; same-address contracts like Uniswap's SwapRouter only count where that chain's verified name matches), EOA / EIP-7702 / contract via eth_getCode, verified source via GoPlus or Sourcify, GoPlus malicious flags.

• Risk score: flagged +10, plain-wallet spender +5, unlimited (or approve-all NFTs) +3, unknown spender +2, unverified contract +2, wallet holds the token +1. High >= 7, medium >= 3. Medium and high get a revokeTx.

• Not covered: single-NFT approve, Permit2 sub-allowances, unused off-chain permits. BNB Chain has no free event-log index, so it relies on GoPlus + known pairs. Output lists the 200 riskiest approvals.

How the launch feed works

• Source: GeckoTerminal's free public new_pools API for base, bsc and solana (newest pools first, deduplicated to one row per new token, majors like WETH/WBNB/USDT/USDC/SOL skipped). On Base that covers Uniswap v2/v3/v4, Aerodrome, Bankr, Clanker-style launchpads and anything else GeckoTerminal indexes; on BNB Chain it is four.meme bonding curves, PancakeSwap v2/v3/Infinity and Uniswap v4; on Solana it is mostly pump.fun bonding curves plus PumpSwap/Meteora pools. Data by GeckoTerminal.

• Risk: each token goes through the same code as /v1/base/contract-risk, /v1/bsc/contract-risk or /v1/solana/token, at request time, cached about 10 minutes per token. Results are summarized to a risk level plus flags.

• No database, no cron: everything is computed when you call it, so rows are as fresh as GeckoTerminal (usually under a minute). Upstream pages are cached 45 s.

• Copycat flag: if a token's symbol or name matches a major asset (USDC, USDT, ETH, WETH, BTC, WBTC, cbBTC, SOL, BNB, WBNB, DAI, BUSD, FDUSD, PYUSD, USD1, USDe, USDS and similar, case-insensitive, ignoring spaces, punctuation and Cyrillic/Greek lookalike letters) but its address isn't that chain's official contract or mint, it gets the flag "name copies a major token (SYM) but isn't the real contract" and its risk is raised to at least medium. The official address list lives in impersonation.js; real tokens are never flagged. The same check runs in the Solana token check and the token report / deep scan.

• Free delayed sample: GET /free/launches?chain=all|base|bsc|solana returns up to 5 launches per chain with risk level and short flags. Base and BNB Chain rows are at least 15 minutes old; Solana rows come from the oldest page GeckoTerminal serves (about 5–10 minutes) and the response is CDN-cached for 10 minutes, so roughly 5–20 minutes behind.

• Limits: if GeckoTerminal is down or rate-limits us, the paid response says so in errors. B20 (Base native precompile) tokens can't be checked by bytecode and are marked unknown. On BNB Chain, four.meme tokens are owned by the launchpad contract while on the curve and its template exposes a blacklist-style function, so most of them show up as medium. Not an audit; most new launches fail.

How the deep scan works

• Honeypot / tax test: a small simulator contract (sim-src/Sim.sol) is injected with an eth_call state override, wraps native coin, buys from the deepest WETH/WBNB pool (Uniswap V2/V3, Aerodrome, SushiSwap, PancakeSwap V2/V3), then approves + transferFroms the tokens back into the pool and sells. Nothing is ever sent onchain. Buy tax = requested vs received tokens; sell tax = sent vs what the pool received.

• Liquidity: pools are found onchain via the DEX factories; USD value uses the onchain native/stable price.

• LP lock: for V2-style pools, share of LP at 0x0/0x…dEaD, held by the token contract, or by Blockscout-labeled lockers. V3 positions are NFTs, so lock status is reported as not determinable.

• Holders: Blockscout's public API where it answers (Ethereum; Base when reachable). Otherwise a clearly-marked partial list built from recent Transfer logs + live balanceOf.

• Tests: node --test tests/ runs against real tokens (Base USDC, BRETT, DEGEN, Ethereum PEPE, BNB CAKE) plus synthetic honeypot and 10%-tax tokens built with state overrides.

How the Solana check works

• Reads the mint with getAccountInfo (jsonParsed) for authorities and Token-2022 extensions, the Metaplex metadata PDA for name/symbol/update authority/isMutable, and getTokenLargestAccounts (top 20 accounts, grouped by owner) for holders.

• Owners that are off the ed25519 curve are program accounts. If the owning program is a known AMM (PumpSwap, Raydium, Orca, Meteora DLMM) or the pump.fun bonding curve, it's labeled and excluded from the top-10 wallet figure; unknown program owners are excluded and labeled uncertain.

• pump.fun: the bonding-curve PDA tells whether the coin is still on the curve (with approximate progress) or graduated. For graduated coins the PumpSwap pool's LP mint supply is compared with the LP originally minted to get the burned share. LP lock for non-pump.fun tokens is not determined. There is no sell simulation on Solana.

• RPC: SOLANA_RPC (comma-separated), default api.mainnet-beta.solana.com then public.rpc.solanavibestation.com as fallback. Tests: tests/solana.test.mjs (BONK, USDC, Fartcoin, a PumpSwap-graduated coin and a fresh on-curve pump.fun coin).

Timeouts: the 402 never waits on the facilitator for more than ~2 s on a cold start (it falls back to the one payment kind we use, exact USDC on Base; verify/settle still go to the real facilitator). Every RPC call has a 4 s timeout (RPC_TIMEOUT_MS) and falls through to the next public RPC for that chain, and each paid call is capped at 25 s (ROUTE_DEADLINE_MS); a capped call answers 504 and is not settled, so you aren't charged. Regression tests: tests/resilience.test.mjs.

A bare request with no payment returns 402 Payment Required along with the payment requirements. If the input is invalid, you get a 400 and are not charged.

Related MCP server: JMT x402 MCP Server

Use over HTTP (x402)

import { wrapFetchWithPayment, x402Client } from "@x402/fetch";
import { registerExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";
const client = new x402Client();
registerExactEvmScheme(client, { signer: privateKeyToAccount(process.env.PRIVATE_KEY) });
const pay = wrapFetchWithPayment(fetch, client);
console.log(await (await pay("https://automaton-tx-explainer.vercel.app/v1/gas?chain=all")).json());

The buyer signs an EIP-3009 USDC authorization, so no gas is needed.

Use over MCP

The server speaks streamable HTTP (stateless) at POST https://automaton-tx-explainer.vercel.app/mcp. Paid tools use the @x402/mcp payment flow, and a free ping tool is also available.

{ "mcpServers": { "automaton-onchain-tools": { "type": "http", "url": "https://automaton-tx-explainer.vercel.app/mcp" } } }

Run your own

npm install
PAY_TO=0xYourAddress node server.js   # Base Sepolia + x402.org facilitator by default

Environment variables: SOLANA_RPC, PAY_TO, X402_NETWORK (eip155:8453 for mainnet), FACILITATOR_URL (cdp uses CDP_API_KEY_ID / CDP_API_KEY_SECRET), PRICE, PRICE_SMALL, PUBLIC_ORIGIN, BASE_RPC, ETH_RPC, BSC_RPC. Deploys to Vercel as-is (api/index.js).

Data sources

All data comes from free public sources: public RPCs, openchain.xyz signatures, Sourcify, ENS, MetaMask eth-phishing-detect, Phishing.Database and RDAP.

Risk and safety outputs are heuristics. They are not audits, security advice or financial advice.

License

MIT

Deployed automatically to Vercel from main.