# Token Security & Rug-Pull Risk Scraper (Multi-Chain EVM) (`scrapers_lat/token-security-risk-scraper`) Actor

Crypto token due-diligence across 14 EVM chains: honeypot status, buy/sell/transfer taxes, ownership/mint/blacklist controls, holder concentration, open-source and proxy flags, plus a derived risk score, risk level and human-readable risk flags.

- **URL**: https://apify.com/scrapers\_lat/token-security-risk-scraper.md
- **Developed by:** [Scrapers Lat](https://apify.com/scrapers_lat) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $12.00 / 1,000 token risk profile results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

[![Token Security & Rug-Pull Risk Scraper (Multi-Chain EVM)](https://scrapers.lat/banners/token-security-risk-scraper.png)](https://console.apify.com/actors/b8hwXbNjcP4oBT2Fh/input)

## Token Security & Rug-Pull Risk Scraper (Multi-Chain EVM)

Here is one real result, with every field the actor returns:

```json
{
  "chain": "ethereum",
  "chainId": 1,
  "contractAddress": "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48",
  "token_name": "USD Coin",
  "token_symbol": "USDC",
  "riskScore": 6,
  "riskLevel": "low",
  "riskFlags": ["Proxy contract (logic can change)"],
  "total_supply": "49650908188.223021",
  "holder_count": 8574945,
  "creator_address": "0x95ba4cf87d6723ad9c0db21737d862be80e93911",
  "creator_balance": "2505.454092",
  "creator_percent": 0,
  "owner_address": null,
  "owner_balance": null,
  "owner_percent": null,
  "is_open_source": true,
  "is_proxy": true,
  "is_mintable": null,
  "can_take_back_ownership": null,
  "owner_change_balance": null,
  "hidden_owner": null,
  "selfdestruct": null,
  "external_call": null,
  "is_honeypot": false,
  "honeypot_with_same_creator": false,
  "buy_tax": 0,
  "sell_tax": 0,
  "transfer_tax": null,
  "cannot_buy": false,
  "cannot_sell_all": null,
  "slippage_modifiable": null,
  "is_anti_whale": null,
  "anti_whale_modifiable": null,
  "trading_cooldown": null,
  "personal_slippage_modifiable": null,
  "is_blacklisted": null,
  "is_whitelisted": null,
  "transfer_pausable": null,
  "is_in_dex": true,
  "is_in_cex": true,
  "cex_list": ["Binance", "Coinbase"],
  "trust_list": true,
  "other_potential_risks": null,
  "note": null,
  "top10HolderPercent": 26.18,
  "lpHolderCount": null,
  "holders": [
    { "address": "0x37305b1cd40574e4c5ce33f8e8306be057fd7341", "tag": null, "is_contract": false, "is_locked": false, "balance": "4146866687.695749", "percent": 0.08352045992744535 }
  ],
  "observedAt": "2026-08-16T10:31:04.207Z",
  "error": null
}
```

The most complete token due-diligence scraper available. It returns every security field the source exposes for each contract, plus a derived `riskScore`, `riskLevel` and human-readable `riskFlags`, across 14 EVM chains, so you can screen tokens for honeypots, hidden taxes and rug-pull controls in one pass.

**📥 [Input](https://apify.com/scrapers_lat/token-security-risk-scraper/input-schema) · 📤 [Output](https://apify.com/scrapers_lat/token-security-risk-scraper/output-schema) · 💰 [Pricing](https://apify.com/scrapers_lat/token-security-risk-scraper/pricing) · ▶️ [Examples](https://apify.com/scrapers_lat/token-security-risk-scraper/examples)**

![Apify](https://img.shields.io/badge/Platform-Apify-1CE1CE?logo=apify\&logoColor=white)
![Coverage](https://img.shields.io/badge/Coverage-14%20EVM%20chains-blue)
![Output](https://img.shields.io/badge/Output-JSON%20%7C%20CSV%20%7C%20Excel-orange)
![Billing](https://img.shields.io/badge/Billing-Pay%20per%20result-brightgreen)

### Table of contents

- [What it does](#what-it-does)
- [Quickstart](#quickstart)
- [Input reference](#input-reference)
- [Output reference](#output-reference)
- [How the risk score works](#how-the-risk-score-works)
- [Run via API and CLI](#run-via-api-and-cli)
- [Fetch results](#fetch-results)
- [Billing and limits](#billing-and-limits)
- [FAQ and troubleshooting](#faq-and-troubleshooting)
- [Related scrapers](#related-scrapers)

### What it does

Give the actor one or more token contract addresses and a chain. For each contract it returns a full security profile: honeypot status, buy/sell/transfer taxes, ownership, mint, blacklist and pause controls, holder concentration, open-source and proxy flags, DEX/CEX listing, and the top holders list. On top of the raw fields it computes a `riskScore` (0 to 100, higher is riskier), a `riskLevel` (low, medium, high, critical) and a `riskFlags` array of plain-English findings such as "Honeypot", "Sell tax 15%" or "Top 10 holders own 96%", so you can sort and filter without parsing the raw booleans yourself.

Source booleans that arrive as `"0"`/`"1"`/`""` are normalized to `true`/`false`/`null`. Large supply and balance numbers are kept as exact strings so no precision is lost. Contracts with no security data available, and invalid addresses, are returned as unbilled rows with an `error` message.

Supported chains: Ethereum, BNB Smart Chain, Polygon, Arbitrum, Optimism, Base, Avalanche, Fantom, Cronos, Gnosis, zkSync Era, Linea, Scroll, Mantle.

### Quickstart

Open the actor, paste this into the input, and press Run. It returns the full risk profile for USDC on Ethereum.

```json
{
  "contractAddress": "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48",
  "chain": "ethereum"
}
```

To screen several tokens at once, use `contractAddresses` with a list and set `chain` to the network they live on. All addresses in a run are looked up on the same chain.

### Input reference

| Name | Type | Required | Description | Example |
|------|------|----------|-------------|---------|
| `contractAddress` | string | one of these | A single token contract address (0x + 40 hex). | `0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48` |
| `contractAddresses` | array | one of these | A list of token contract addresses to analyze in one run. | `["0x6982508145454ce325ddbe47a25d4ec3d2311933"]` |
| `chain` | string | no | EVM chain the contracts live on. Default `ethereum`. One of: ethereum, bsc, polygon, arbitrum, optimism, base, avalanche, fantom, cronos, gnosis, zksync, linea, scroll, mantle. | `bsc` |
| `maxTokens` | integer | no | Maximum number of contracts to process this run. Free Apify accounts are capped at 10. | `100` |
| `proxyConfiguration` | object | no | Optional proxy. The source is open, so a proxy is not required. | `{ "useApifyProxy": false }` |

### Output reference

One row per token contract. Booleans are `true`, `false`, or `null` when the source does not report the check.

| Field | Type | Description |
|-------|------|-------------|
| `chain` | string | Chain the token was queried on |
| `chainId` | number | Numeric EVM chain id |
| `contractAddress` | string | Token contract address |
| `token_name` | string | Token name |
| `token_symbol` | string | Token ticker symbol |
| `riskScore` | number | Derived overall risk, 0 to 100 (higher is riskier) |
| `riskLevel` | string | Derived level: low, medium, high, critical |
| `riskFlags` | array | Human-readable risk findings |
| `total_supply` | string | Total supply (exact string) |
| `holder_count` | number | Number of holders |
| `creator_address` | string | Contract creator address |
| `creator_balance` | string | Creator token balance (exact string) |
| `creator_percent` | number | Creator share of supply (percent) |
| `owner_address` | string | Contract owner address |
| `owner_balance` | string | Owner token balance (exact string) |
| `owner_percent` | number | Owner share of supply (percent) |
| `is_open_source` | boolean | Contract source is open/verified |
| `is_proxy` | boolean | Contract is a proxy (upgradeable logic) |
| `is_mintable` | boolean | New supply can be minted |
| `can_take_back_ownership` | boolean | Ownership can be reclaimed after renouncing |
| `owner_change_balance` | boolean | Owner can change holder balances |
| `hidden_owner` | boolean | Hidden owner detected |
| `selfdestruct` | boolean | Contract can self-destruct |
| `external_call` | boolean | Contract makes external calls |
| `is_honeypot` | boolean | Token is a honeypot (cannot be sold) |
| `honeypot_with_same_creator` | boolean | Creator has deployed other honeypots |
| `buy_tax` | number | Buy tax (percent) |
| `sell_tax` | number | Sell tax (percent) |
| `transfer_tax` | number | Transfer tax (percent) |
| `cannot_buy` | boolean | Buying is blocked |
| `cannot_sell_all` | boolean | Selling the full balance is blocked |
| `slippage_modifiable` | boolean | Tax/slippage can be modified by the owner |
| `is_anti_whale` | boolean | Anti-whale max transaction/holding limit exists |
| `anti_whale_modifiable` | boolean | Anti-whale limit can be modified |
| `trading_cooldown` | boolean | Trading cooldown is enforced |
| `personal_slippage_modifiable` | boolean | Per-address slippage/tax can be set |
| `is_blacklisted` | boolean | Blacklist function present |
| `is_whitelisted` | boolean | Whitelist function present |
| `transfer_pausable` | boolean | Transfers can be paused |
| `is_in_dex` | boolean | Token trades on a DEX |
| `is_in_cex` | boolean | Token is listed on a centralized exchange |
| `cex_list` | array | Centralized exchanges where the token is listed |
| `trust_list` | boolean | Token is on the source trusted list |
| `other_potential_risks` | array | Other potential risks flagged |
| `note` | string | Additional note from the source |
| `top10HolderPercent` | number | Combined share held by the top 10 holders (percent) |
| `lpHolderCount` | number | Number of liquidity-pool token holders, if reported |
| `holders` | array | Top holders `[{address, tag, is_contract, is_locked, balance, percent}]` |
| `observedAt` | string | When the record was collected (ISO) |
| `error` | string | Error message, or null on success |

### How the risk score works

The score starts at 0 and adds weighted points for each dangerous property found. The largest weights go to a confirmed honeypot and to "cannot sell all", followed by owner-can-change-balance, self-destruct, hidden owner, high or modifiable taxes, mint and take-back-ownership controls, pausable transfers, closed source, and heavy holder concentration. The total is capped at 100 and mapped to a level: low (0 to 14), medium (15 to 39), high (40 to 69), critical (70 to 100). Each contributing property also produces a plain-English string in `riskFlags`. The score is a screening aid built from the source's on-chain checks, not financial advice.

### Run via API and CLI

Run via the Apify API:

```bash
curl -X POST "https://api.apify.com/v2/acts/scrapers_lat~token-security-risk-scraper/runs?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"contractAddress":"0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48","chain":"ethereum"}'
```

Run via the Apify CLI:

```bash
apify call scrapers_lat/token-security-risk-scraper \
  --input='{"contractAddresses":["0x6982508145454ce325ddbe47a25d4ec3d2311933"],"chain":"ethereum"}'
```

### Fetch results

Download the run's dataset items as JSON:

```bash
curl "https://api.apify.com/v2/datasets/DATASET_ID/items?token=YOUR_APIFY_TOKEN&format=json"
```

Add `format=csv` or `format=xlsx` for spreadsheet formats. The dataset id is returned in the run response as `defaultDatasetId`.

### Billing and limits

This actor is billed pay per result. You are charged once for each token that returns a full risk profile (the `result` event). Rows with an `error` (invalid address, or no security data available for the contract) are never charged. Free Apify accounts are capped at 10 tokens per run; upgrade for higher volumes. A run also stops emitting billable rows once your configured maximum spend for the run is reached, so you never pay beyond your limit.

### FAQ and troubleshooting

**Which chains are supported?** Ethereum, BNB Smart Chain, Polygon, Arbitrum, Optimism, Base, Avalanche, Fantom, Cronos, Gnosis, zkSync Era, Linea, Scroll and Mantle. Set the `chain` input to the network your contracts live on.

**Why did a contract come back with "No security data available"?** The source has no security analysis for that address on the selected chain. This is common for very new contracts, non-token contracts, or an address on the wrong chain. These rows are unbilled.

**Are the tax numbers percentages?** Yes. `buy_tax`, `sell_tax` and `transfer_tax` are returned as numeric percents, so `0.15` from the source becomes `15`.

**Why are some fields null?** The source only reports checks that apply to a given contract. A field is `null` when the check was not evaluated or does not apply (for example, `owner_address` on a renounced contract).

**Does a low risk score mean a token is safe?** No. The score is a screening signal from on-chain checks. Always combine it with your own research. This is not financial advice.

**Can I screen many tokens at once?** Yes. Pass a list in `contractAddresses`. Each contract is looked up individually to make sure none are dropped, so large lists take longer.

### Related scrapers

- [EVM Wallet Intelligence & Token Portfolio Scraper](https://apify.com/scrapers_lat/evm-wallet-intelligence-scraper)
- [Bitcoin Address Intelligence Scraper](https://apify.com/scrapers_lat/bitcoin-address-intelligence-scraper)
- [Crypto Token Unlocks Scraper](https://apify.com/scrapers_lat/crypto-token-unlocks-scraper)

More scrapers at [scrapers.lat](https://scrapers.lat).

# Actor input Schema

## `contractAddress` (type: `string`):

A single token contract address (0x followed by 40 hex characters), for example 0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48 (USDC). Use the Contract Addresses field for multiple.

## `contractAddresses` (type: `array`):

A list of token contract addresses to analyze in one run. Each contract returns one full risk-profile record.

## `chain` (type: `string`):

Which EVM chain the contracts live on. All addresses in a run are looked up on this chain.

## `maxTokens` (type: `integer`):

Maximum number of token contracts to process in this run. Free Apify accounts are capped at 10 per run.

## `withOwnerCheck` (type: `boolean`):

Optional paid add-on. Runs an extra GoPlus address-security lookup on the token's creator and owner addresses and returns malicious-address flags (honeypot-related, phishing, blacklist doubt, stealing attack, sanctioned, and more). Billed at $0.012 per token only when the check returns usable data. Disabled for free Apify accounts.

## `withAiRisk` (type: `boolean`):

Optional paid add-on that uses AI (OpenAI gpt-4o-mini) to turn the security flags into a concise plain-English rug-pull/scam risk verdict, summary and recommendation for a token buyer. Billed at $0.012 per token only when a usable verdict is produced. Disabled for free Apify accounts.

## `proxyConfiguration` (type: `object`):

Optional proxy settings. The data source is open, so a proxy is not required, but a residential proxy can improve reliability under heavy load.

## Actor input object example

```json
{
  "contractAddress": "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48",
  "chain": "ethereum",
  "maxTokens": 100,
  "withOwnerCheck": false,
  "withAiRisk": false,
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "contractAddress": "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48",
    "maxTokens": 100
};

// Run the Actor and wait for it to finish
const run = await client.actor("scrapers_lat/token-security-risk-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "contractAddress": "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48",
    "maxTokens": 100,
}

# Run the Actor and wait for it to finish
run = client.actor("scrapers_lat/token-security-risk-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "contractAddress": "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48",
  "maxTokens": 100
}' |
apify call scrapers_lat/token-security-risk-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,scrapers_lat/token-security-risk-scraper"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/b8hwXbNjcP4oBT2Fh/builds/ZhLZ1dV47iHkgap1e/openapi.json