# Token Honeypot & Rug Pull Safety Check - ETH, BSC, Base (`centorprat/token-honeypot-rugpull-check`) Actor

Give ERC-20 token contracts (Ethereum/BSC/Base). Runs a keyless honeypot simulation + contract & market checks - can you sell it, buy/sell tax, open-source/proxy, liquidity, holders - into a safety score, verdict and findings. Signals for due diligence, not advice. Read-only, agent-callable.

- **URL**: https://apify.com/centorprat/token-honeypot-rugpull-check.md
- **Developed by:** [Centor Prat](https://apify.com/centorprat) (community)
- **Categories:** Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $17.00 / 1,000 token checkeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Token Honeypot & Rug Pull Safety Check — ETH, BSC, Base

Before you touch a token, check if you can actually **sell** it. Give ERC-20 contract addresses on Ethereum, BSC or Base and each gets a keyless safety brief: a **honeypot simulation** (buy + sell), **buy/sell tax**, contract posture (**open-source? upgradeable proxy?**), **liquidity**, **holders**, and a **safetyScore + verdict + findings**. Read-only, keyless, agent-callable.

> **Signals for due diligence, not financial advice.** A "fewer-red-flags" result is **not** a guarantee — tokens can still rug via owner powers, liquidity pulls or off-chain scams this check can't see. Always verify before risking funds.

### What it does

- Runs a **honeypot simulation** (a simulated buy then sell) to see if selling is blocked or taxed into the ground.
- Reports **buy tax / sell tax**, and flags contracts that are **not open-source** or are **upgradeable proxies** (owner can change the rules).
- Pulls **liquidity**, **pair age** and **holder count**, and the provider's risk read.
- Composes a transparent **safetyScore (0–100)** + a verdict: `honeypot--do-not-trade` / `high-risk--avoid` / `caution--multiple-flags` / `fewer-red-flags`, with human-readable findings.

| Field | Meaning |
|---|---|
| `isHoneypot` | did the sell simulation fail? |
| `buyTaxPct` / `sellTaxPct` | simulated taxes |
| `contractOpenSource` / `isProxy` | contract posture |
| `liquidityUsd` / `totalHolders` / `pairAgeHours` | market context |
| `safetyScore` / `signal` | 0–100 + verdict |
| `findings[]` | each red/amber flag with severity |

### Why not just ask an AI agent?

An agent can't simulate a buy-and-sell against a live contract or read its proxy/verification status and taxes on demand. This runs that simulation and composes the contract + market red flags into one scored, structured verdict — the exact due-diligence step people skip and get rugged on.

### Input

| Field | Type | Required | Description |
|---|---|---|---|
| `tokens` | array of strings | ✅ | ERC-20 contract addresses (0x…). |
| `chain` | string | | `ethereum` / `bsc` / `base`. |
| `webhookUrl` | string | | POST the finished checks here as JSON. |

**Example input**

```json
{ "tokens": ["0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48"], "chain": "ethereum" }
```

### Output

One record per token. **Example output** (real run, trimmed):

```json
{
  "tokenSymbol": "USDC",
  "chain": "ethereum",
  "signal": "fewer-red-flags",
  "safetyScore": 88,
  "isHoneypot": false,
  "buyTaxPct": 0.0,
  "sellTaxPct": 0.0,
  "contractOpenSource": true,
  "isProxy": true,
  "liquidityUsd": 82374198.68,
  "totalHolders": 9088782,
  "providerRisk": "low",
  "findings": [
    {"severity": "medium", "detail": "Upgradeable proxy contract - owner can change logic."}
  ],
  "disclaimer": "Automated honeypot/contract SIGNALS ... NOT a guarantee of safety ... not financial advice."
}
```

A honeypot returns `signal: "honeypot--do-not-trade"`, `safetyScore: 0`, and a critical finding that the sell simulation failed.

### Use cases

- **Pre-buy safety check** — confirm a token is sellable and not taxed to death before aping in.
- **Rug avoidance** — thin liquidity, closed-source, proxy and honeypot flags in one view.
- **Pairs with discovery** — vet the hits from the New Token Momentum Scanner before acting.
- **AI trading agents** — a safety gate: don't act on a token that fails the check.

### Ready-made tasks

- [Honeypot Checker - Can You Sell This Token? (Ethereum)](https://apify.com/centorprat/token-honeypot-rugpull-check/examples/honeypot-checker-ethereum)
- [Rug Pull Checker for BSC Tokens - Taxes & Liquidity](https://apify.com/centorprat/token-honeypot-rugpull-check/examples/rug-pull-checker-bsc)
- [Base Token Safety Check - Honeypot, Tax & Contract](https://apify.com/centorprat/token-honeypot-rugpull-check/examples/base-token-safety-check)

### For AI agents / MCP

```
https://mcp.apify.com/?tools=actors,docs,centorprat/token-honeypot-rugpull-check
```

Loads as `centorprat--token-honeypot-rugpull-check`. Claude Code:

```
claude mcp add apify -- npx -y @apify/actors-mcp-server --actors centorprat/token-honeypot-rugpull-check
```

### FAQ

**Which chains?** Ethereum, BNB Smart Chain (BSC), Base.

**Does it need an API key?** No — keyless public honeypot-simulation API.

**Does a high score mean it's safe to buy?** No. It means fewer **detectable** red flags. Owner privileges, future liquidity removal and social scams can't be caught by a contract simulation. It's a due-diligence aid, not advice.

**What's a honeypot?** A token you can buy but can't sell (or only at a punitive tax). The simulation catches this.

**Why is a blue-chip flagged as a proxy?** Many legitimate tokens (e.g. USDC) are upgradeable proxies — it's a *consideration*, not a verdict; the score only lightly penalises it.

**How fast / how much?** Under a second per token. Pay-per-event, one charge per token checked.

### Data & attribution

Uses the keyless Honeypot.is public API (contract simulation + market data). No keys, no personal data. All outputs are computed signals from public data, not financial advice.

### Related actors

- [New Token Momentum Scanner](https://apify.com/centorprat/new-token-momentum-scanner)
- [Crypto Address Risk & AML Screener](https://apify.com/centorprat/crypto-address-risk-aml-screener)

# Actor input Schema

## `tokens` (type: `array`):

ERC-20 token contract addresses (0x...). One safety check per token.

## `chain` (type: `string`):

Which chain the tokens are on.

## `webhookUrl` (type: `string`):

If set, the finished safety checks are POSTed here as JSON when the run completes.

## Actor input object example

```json
{
  "tokens": [
    "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48"
  ],
  "chain": "ethereum"
}
```

# Actor output Schema

## `checks` (type: `string`):

One safety brief per token: honeypot (can you sell?), buy/sell tax, open-source/proxy contract posture, liquidity, holders, provider risk level, flags, a safetyScore (0-100), a verdict and findings. Signals, not advice.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "tokens": [
        "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("centorprat/token-honeypot-rugpull-check").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "tokens": ["0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48"] }

# Run the Actor and wait for it to finish
run = client.actor("centorprat/token-honeypot-rugpull-check").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "tokens": [
    "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48"
  ]
}' |
apify call centorprat/token-honeypot-rugpull-check --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,centorprat/token-honeypot-rugpull-check"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/vxWwfjHyD5grHpsPy/builds/79lnw4Urf6DBeheco/openapi.json