# Crypto Token Security Check: Honeypot, Taxes and Owner Risk (`scrapemint/crypto-token-security-check`) Actor

Keyless contract safety checks for tokens on Ethereum, BNB Chain, Polygon, Base, Arbitrum, Optimism, Avalanche and Solana: honeypot and sell restrictions, buy and sell taxes, the powers the owner keeps, liquidity locks and holder concentration.

- **URL**: https://apify.com/scrapemint/crypto-token-security-check.md
- **Developed by:** [Ken M](https://apify.com/scrapemint) (community)
- **Categories:** Business, Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$4.00 / 1,000 security check rows

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Crypto Token Security Check: Honeypot, Taxes and Owner Risk

Before buying a token the questions are always the same: **can I sell it again, what will it tax me, and what can the owner still do to me.** This returns those answers as clean rows, for tokens on **Ethereum, BNB Chain, Polygon, Base, Arbitrum, Optimism, Avalanche and Solana**.

No API key, no account, no browser.

### Modes

- **Tokens** - one row per contract: buy and sell tax, honeypot and sell restrictions, the powers the owner keeps (pause transfers, change balances, reclaim ownership, mint, blacklist), liquidity and locked liquidity, holder concentration, and every risk flag actually raised.
- **Holders** - one row per top holder and per liquidity provider: size, share of supply, whether it is a contract, whether the position is locked.
- **Address** - one row per wallet or contract: reported involvement in phishing, theft, laundering, cybercrime, sanctions and similar.

### Example output

```json
{
  "mode": "tokens",
  "chain": "Ethereum",
  "tokenSymbol": "USDT",
  "holderCount": 15651392,
  "buyTaxPercent": 0,
  "sellTaxPercent": 0,
  "isHoneypot": false,
  "isOpenSource": true,
  "top10HolderPercent": 50.832,
  "riskFlags": [
    "transfers can be paused by the owner",
    "the owner can change balances",
    "the contract can blacklist addresses"
  ],
  "criticalFlagCount": 2,
  "propertiesNotAssessed": ["cannot_sell_all"]
}
```

### What this is not

**It does not certify anything as safe, and it invents no score.** It reports what a third party contract security service found, with the flags named in plain words. Two things follow from that, and both ship on every row:

- **Some flags are normal for a legitimate token.** A centrally issued stablecoin is mintable and freezable by design. Solana USDC raises exactly those flags while also being marked a trusted token, and both facts appear in the output. Read the flags, do not count them.
- **An address the service holds no record for is UNASSESSED, not clean.** That case returns a free note saying so, rather than an empty row that reads like a pass.

### The trap that decides whether this data is any use

**A missing field is not a "no".** The service answers `1` for yes and `0` for no, but when it has not assessed a property it simply leaves the field out. Collapse that to "no" and an unchecked contract reads exactly like a clean one — the single most dangerous mistake you can make with this data.

So every row carries `propertiesNotAssessed`, naming what was never looked at, and `propertiesNotAssessedCount` next to the flag counts. In the example above the service never assessed `cannot_sell_all` for USDT; that absence is reported rather than hidden.

### Other things worth knowing

- **Batching silently drops addresses.** The endpoint accepts several comma separated contracts and then returns only the first, with a success code. A caller batching ten tokens would get one and conclude the other nine do not exist. Every address here is fetched on its own request.
- **Solana is assessed with a different property set**, on a different endpoint, because the two chain models genuinely differ: there is no buy or sell tax, and the risks are mint, freeze, close and transfer hook authorities instead. Solana rows never pretend to carry EVM fields.
- **An unsupported chain answers inside an HTTP 200** with its own code, so the status line alone never means success.
- **Taxes are published as a ratio** and converted to a percentage here, so 0.05 becomes 5.
- **Holder concentration is computed, not published.** The service lists holders individually; the top ten share is totalled here, which is usually the number people actually want.

### Who this is for

Traders checking a contract before buying, especially on new launches. Pairs directly with our **Crypto Whale Token Launch Tracker**, which finds new tokens: that one tells you what launched, this one tells you what the contract can do to you.

### Pricing

**$0.004 per row.** The first 2 rows of every run are free, and note rows (an address with no record, an unsupported chain, a token with no holder detail) are never charged.

Checking 3 tokens is 3 rows, or **$0.012**. The top 10 holders and liquidity providers for one token is up to 20 rows. A watchlist of 50 contracts is $0.20.

### How to run it via API

```bash
curl -X POST "https://api.apify.com/v2/acts/scrapemint~crypto-token-security-check/runs?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"mode":"tokens","chain":"base","tokenAddresses":["0x833589fcd6edb6e08f4c7c32d4f71b54bda02913"]}'
```

Assessments from the GoPlus Labs token security service.

# Actor input Schema

## `mode` (type: `string`):

tokens = the security profile of each token contract. holders = the top holders and liquidity providers behind a token. address = check a wallet or contract address for reported malicious activity.

## `chain` (type: `string`):

Which chain the addresses are on. Solana is assessed with a different property set to the EVM chains, because the two work differently.

## `tokenAddresses` (type: `array`):

Token contracts to check, on the chain selected above. Used by the tokens and holders modes.

## `walletAddresses` (type: `array`):

Address mode only. Wallets or contracts to check for reported phishing, theft, laundering and similar.

## `topHolders` (type: `integer`):

Holders mode. How many top holders and liquidity providers to return per token.

## `maxRows` (type: `integer`):

Cap on rows returned. Controls total cost.

## Actor input object example

```json
{
  "mode": "tokens",
  "chain": "ethereum",
  "tokenAddresses": [
    "0xdac17f958d2ee523a2206206994597c13d831ec7",
    "0x6b175474e89094c44da98b954eedeac495271d0f",
    "0x1f9840a85d5af5bf1d1762f925bdaddc4201f984"
  ],
  "walletAddresses": [],
  "topHolders": 10,
  "maxRows": 200
}
```

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "chain": "ethereum",
    "tokenAddresses": [
        "0xdac17f958d2ee523a2206206994597c13d831ec7",
        "0x6b175474e89094c44da98b954eedeac495271d0f",
        "0x1f9840a85d5af5bf1d1762f925bdaddc4201f984"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("scrapemint/crypto-token-security-check").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "chain": "ethereum",
    "tokenAddresses": [
        "0xdac17f958d2ee523a2206206994597c13d831ec7",
        "0x6b175474e89094c44da98b954eedeac495271d0f",
        "0x1f9840a85d5af5bf1d1762f925bdaddc4201f984",
    ],
}

# Run the Actor and wait for it to finish
run = client.actor("scrapemint/crypto-token-security-check").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "chain": "ethereum",
  "tokenAddresses": [
    "0xdac17f958d2ee523a2206206994597c13d831ec7",
    "0x6b175474e89094c44da98b954eedeac495271d0f",
    "0x1f9840a85d5af5bf1d1762f925bdaddc4201f984"
  ]
}' |
apify call scrapemint/crypto-token-security-check --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,scrapemint/crypto-token-security-check"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/r3ojQb4W2JP3ucs6C/builds/GEnVfOCXXNdRJKI5H/openapi.json