Token Honeypot & Rug Pull Safety Check — ETH, BSC, Base

Before you touch a token, check if you can actually sell it. Give ERC-20 contract addresses on Ethereum, BSC or Base and each gets a keyless safety brief: a honeypot simulation (buy + sell), buy/sell tax, contract posture (open-source? upgradeable proxy?), liquidity, holders, and a safetyScore + verdict + findings. Read-only, keyless, agent-callable.

Signals for due diligence, not financial advice. A "fewer-red-flags" result is not a guarantee — tokens can still rug via owner powers, liquidity pulls or off-chain scams this check can't see. Always verify before risking funds.

What it does

• Runs a honeypot simulation (a simulated buy then sell) to see if selling is blocked or taxed into the ground.
• Reports buy tax / sell tax, and flags contracts that are not open-source or are upgradeable proxies (owner can change the rules).
• Pulls liquidity, pair age and holder count, and the provider's risk read.
• Composes a transparent safetyScore (0–100) + a verdict: honeypot--do-not-trade / high-risk--avoid / caution--multiple-flags / fewer-red-flags, with human-readable findings.

Field	Meaning
isHoneypot	did the sell simulation fail?
buyTaxPct / sellTaxPct	simulated taxes
contractOpenSource / isProxy	contract posture
liquidityUsd / totalHolders / pairAgeHours	market context
safetyScore / signal	0–100 + verdict
findings[]	each red/amber flag with severity

Why not just ask an AI agent?

An agent can't simulate a buy-and-sell against a live contract or read its proxy/verification status and taxes on demand. This runs that simulation and composes the contract + market red flags into one scored, structured verdict — the exact due-diligence step people skip and get rugged on.

Input

Field	Type	Required	Description
tokens	array of strings	✅	ERC-20 contract addresses (0x…).
chain	string		ethereum / bsc / base.
webhookUrl	string		POST the finished checks here as JSON.

Example input

{ "tokens": ["0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48"], "chain": "ethereum" }

Output

One record per token. Example output (real run, trimmed):

{
  "tokenSymbol": "USDC",
  "chain": "ethereum",
  "signal": "fewer-red-flags",
  "safetyScore": 88,
  "isHoneypot": false,
  "buyTaxPct": 0.0,
  "sellTaxPct": 0.0,
  "contractOpenSource": true,
  "isProxy": true,
  "liquidityUsd": 82374198.68,
  "totalHolders": 9088782,
  "providerRisk": "low",
  "findings": [
    {"severity": "medium", "detail": "Upgradeable proxy contract - owner can change logic."}
  ],
  "disclaimer": "Automated honeypot/contract SIGNALS ... NOT a guarantee of safety ... not financial advice."
}

A honeypot returns signal: "honeypot--do-not-trade", safetyScore: 0, and a critical finding that the sell simulation failed.

Use cases

• Pre-buy safety check — confirm a token is sellable and not taxed to death before aping in.
• Rug avoidance — thin liquidity, closed-source, proxy and honeypot flags in one view.
• Pairs with discovery — vet the hits from the New Token Momentum Scanner before acting.
• AI trading agents — a safety gate: don't act on a token that fails the check.

Ready-made tasks

• Honeypot Checker - Can You Sell This Token? (Ethereum)
• Rug Pull Checker for BSC Tokens - Taxes & Liquidity
• Base Token Safety Check - Honeypot, Tax & Contract

For AI agents / MCP

https://mcp.apify.com/?tools=actors,docs,centorprat/token-honeypot-rugpull-check

Loads as centorprat--token-honeypot-rugpull-check. Claude Code:

claude mcp add apify -- npx -y @apify/actors-mcp-server --actors centorprat/token-honeypot-rugpull-check

FAQ

Which chains? Ethereum, BNB Smart Chain (BSC), Base.

Does it need an API key? No — keyless public honeypot-simulation API.

Does a high score mean it's safe to buy? No. It means fewer detectable red flags. Owner privileges, future liquidity removal and social scams can't be caught by a contract simulation. It's a due-diligence aid, not advice.

What's a honeypot? A token you can buy but can't sell (or only at a punitive tax). The simulation catches this.

Why is a blue-chip flagged as a proxy? Many legitimate tokens (e.g. USDC) are upgradeable proxies — it's a consideration, not a verdict; the score only lightly penalises it.

How fast / how much? Under a second per token. Pay-per-event, one charge per token checked.

Data & attribution

Uses the keyless Honeypot.is public API (contract simulation + market data). No keys, no personal data. All outputs are computed signals from public data, not financial advice.

Related actors

• New Token Momentum Scanner
• Crypto Address Risk & AML Screener