Every endpoint is one POST that returns JSON, priced per call in USDC — no account, no API key. Pick a stall, send the body, pay the 402. Below: the full reference, plus copy-paste quickstarts for the CLI and every SDK.
Base URL https://true402.dev/api. There's no account or API key — each paid call settles with an x402 payment (USDC on Base, EIP-3009). Free GET endpoints (/v1/models, /v1/services, /v1/radar, /health, /openapi.json) need nothing. The full flow:
# 1) Call any paid endpoint with NO payment — you get the price back:
curl -i -X POST https://true402.dev/api/v1/base/token-report \
-H 'content-type: application/json' -d '{"token":"0x…"}'
# → HTTP 402 payment-required: { amount, asset: USDC, network: eip155:8453, payTo: 0x… }
# 2) Sign that USDC authorization (EIP-3009) and retry with the X-Payment header → 200 + JSON.
# Most agents never hand-roll this — use the CLI or an SDK below.# Zero-install terminal check — free to try (a few/day, no wallet):
npx @true402.dev/rugcheck 0x4ed4E862860beD51a9570b96d89aF5E1B0Efefed# LangChain — adds true402 tools to an agent (pays per call from a wallet):
npm i @true402.dev/langchain
# import { createTrue402Tools } from '@true402.dev/langchain';
# const tools = createTrue402Tools({ payerPrivateKey: process.env.PAYER_PRIVATE_KEY });
# CrewAI (Python):
pip install crewai-true402
# from crewai_true402 import true402_tools
# agent = Agent(role="Trader", tools=true402_tools(), ...) # reads PAYER_PRIVATE_KEY
# ElizaOS — plugin in the official registry:
# elizaos plugins add elizaos-plugin-true402
# Vercel AI SDK:
npm i @true402.dev/ai-sdk
# import { true402Tools } from '@true402.dev/ai-sdk';
# MCP (Claude Code / Desktop / Cursor / Hermes) — every stall as a tool, auto-discovered:
claude mcp add true402 -- npx -y @true402.dev/mcp-server
# OpenClaw — install the safety skill from ClawHub:
# openclaw skills install true402-token-safety
# Hermes Agent — the safety skill as a tap (or use the MCP server above):
# hermes skills tap add true402/hermes-skills
# hermes skills install true402/hermes-skills/true402-token-safety
# Coinbase AgentKit:
npm i @true402.dev/agentkit
# import { createTrue402ActionProviders } from '@true402.dev/agentkit';
# Virtuals GAME (Python):
pip install game-true402
# All of the above, with copy-paste config: https://true402.dev/integrationsThe SDKs handle the 402 → sign → retry loop for you, with a built-in per-call spend cap. See the agent integration guide.
POST /v1/base/token-report$0.010Composite rug/honeypot verdict — the flagship "can I ape in?" check.
{ "token": "0x…" }{ verdict: { rating: avoid|caution|ok, score, reasons[] }, safety, recentPulls[], recentWhaleSwaps[] }POST /v1/token-safety$0.005Raw safety report: ERC-20 conformance, ownership, mint, liquidity, buy/sell honeypot simulation.
{ "token": "0x…" }{ score, risk, flags[], erc20, ownership, mintable, liquidity, honeypot }POST /v1/base/address-safety$0.005Structural profile of any EOA or contract before you send/approve/call it.
{ "address": "0x…" }{ type, ethBalance, usdcBalance, txCount, contract: { isToken, erc20, ownership, mintable, isProxy }, score, risk, flags[] }POST /v1/base/deployer-check$0.008Deployer reputation — resolves WHO created the token, then profiles that wallet: age (tx count), balance, contracts shipped. A fresh throwaway spun up for the launch is the discriminating flag; raw contract count is context, not a verdict. Send "deep": true to also classify the deployer's recent prior tokens as live/dead (no liquidity = a rug outcome) — the real serial-rugger signal, and slower. Paid from the first call (no free trial); needs an explorer key server-side, else 503 and no charge.
{ "token": "0x…", "deep?": bool }{ deployer, txCount, ethBalance, contractsCreated, score, risk, flags[] } — plus priorTokens: { checked, dead, live, items[] } only when deep: truePOST /v1/ethereum/token-report$0.010The same flagship composite for an Ethereum ERC-20 — the full safety check enriched with recent liquidity-removal and whale-swap activity, in one avoid|caution|ok verdict.
{ "token": "0x…" }{ verdict: { rating: avoid|caution|ok, score, reasons[] }, safety, recentPulls[], recentWhaleSwaps[] }POST /v1/ethereum/token-safety$0.005Ethereum ERC-20 safety from on-chain reads only: conformance, ownership renounce, mint capability, WETH/USDC depth across Uniswap V3 + V2, and the gas-free buy/sell honeypot simulation.
{ "token": "0x…" }{ score, risk, flags[], erc20, ownership, mintable, liquidity, honeypot }POST /v1/ethereum/address-safety$0.005Structural profile of any Ethereum EOA or contract before you send/approve/call it — including whether it is an EIP-1967 proxy whose logic can be swapped after you trust it.
{ "address": "0x…" }{ type, ethBalance, usdcBalance, txCount, contract: { isToken, erc20, ownership, mintable, isProxy }, score, risk, flags[] }POST /v1/ethereum/deployer-check$0.008Deployer reputation on Ethereum — same profile and the same opt-in "deep": true prior-token classification as the Base stall. Paid from the first call (no free trial); needs an explorer key server-side, else 503 and no charge.
{ "token": "0x…", "deep?": bool }{ deployer, txCount, ethBalance, contractsCreated, score, risk, flags[] } — plus priorTokens: { checked, dead, live, items[] } only when deep: trueNo deployer-check on BSC: that stall resolves a contract's creator through a contract explorer, and BNB Smart Chain has none wired up. The other three run the same code as Base and Ethereum, against WBNB/USDC depth on PancakeSwap V3 + V2.
POST /v1/bsc/token-report$0.010The flagship composite for a BNB Smart Chain ERC-20 — safety check plus recent rug and whale activity, in one avoid|caution|ok verdict.
{ "token": "0x…" }{ verdict: { rating: avoid|caution|ok, score, reasons[] }, safety, recentPulls[], recentWhaleSwaps[] }POST /v1/bsc/token-safety$0.005BSC ERC-20 safety from on-chain reads only: conformance, ownership renounce, mint capability, WBNB/USDC depth across PancakeSwap V3 + V2, and the gas-free buy/sell honeypot simulation.
{ "token": "0x…" }{ score, risk, flags[], erc20, ownership, mintable, liquidity, honeypot }POST /v1/bsc/address-safety$0.005Structural profile of any BSC EOA or contract before you send/approve/call it — contract-vs-EOA, balances, activity, ownership, mint selector, proxy upgradeability.
{ "address": "0x…" }{ type, ethBalance, usdcBalance, txCount, contract: { isToken, erc20, ownership, mintable, isProxy }, score, risk, flags[] }POST /v1/solana/token-safety$0.005SPL / Token-2022 structural check: mint authority (supply inflation), freeze authority — the Solana honeypot, since the issuer can freeze your token account so you cannot sell however deep the pool is — Token-2022 extensions (permanentDelegate, transferHook, transferFee) and pool liquidity depth. NOT a buy/sell simulation: Solana has no EVM bytecode, so the eth_call round-trip the Base/Ethereum/BSC stalls run does not exist here.
{ "token": "<base58 mint>" }{ token, chain, program, mint, liquidity, score, risk, flags[] }POST /v1/base/new-pairs$0.003Newly-created Base DEX pairs (Uniswap V3 + Aerodrome) — fresh launches.
{ "since?": n, "limit?": n, "dex?": "…", "withToken?": bool }{ pairs: [{ token, quote, pool, dex, block, ageSeconds }] }POST /v1/base/liquidity-pulls$0.003Liquidity-removal (rug) alerts on tracked pools — an early rug warning.
{ "since?": n, "limit?": n, "minQuote?": n }{ events: [{ pool, token, quoteRemoved, block }] }POST /v1/base/whale-swaps$0.005Large ($-value) DEX swaps for whale-following / copy-trading.
{ "min?": n, "direction?": "buy|sell", "since?": n, "limit?": n }{ swaps: [{ token, usdValue, direction, pool, block }] }POST /v1/base/liquidity-history$0.005Everything we have observed about ONE token's liquidity: its pools, every removal event with the amount, block and tx, and the other tokens drained in the same transaction. Answers what already happened, which a live simulation cannot re-derive. Carries the exact block range indexed, so "none observed" is never dressed up as "safe".
{ "token": "0x…", "limit?": n }{ indexed, pools[], removals: { count, totalQuoteRemoved, events[] }, linkedTokens[], coverage: { …, complete }, verdict }POST /v1/base/tx-preflight$0.008Check a transaction BEFORE signing it. Send the UNSIGNED tx and get three lenses: a simulation against current state (does it revert?), the decoded intent (is this an unlimited approval that outlives the trade?), and the counterparty's liquidity-removal history. Takes NO private key and NO signature, so it cannot broadcast or front-run what it inspects. Never returns "safe".
{ "from": "0x…", "to": "0x…", "data?": "0x…", "value?": "wei" }{ simulation: { ok, revertReason }, intent: { kind, spender, unlimited }, counterparty: { removalsObserved, tokensDrainedTogether }, findings[], risk, verdict, limits[] }POST /v1/seo-audit$0.04/pageSEO + GEO (generative-engine) audit → structured JSON report. Priced per page: one URL or up to 20.
{ "url": "https://…" } or { "urls": ["…", "…"] }{ report… } or { pages: [{ url, ok, … }] }POST /v1/web-extract$0.005Fetch a URL → clean text + markdown + links.
{ "url": "https://…" }{ title, text, markdown, links[] }POST /v1/link-preview$0.003Open Graph card for a URL.
{ "url": "https://…" }{ title, description, image, siteName }POST /v1/robots-check$0.003A site's AI-crawler policy + sitemaps.
{ "url": "https://…" }{ aiBots: {...}, sitemaps[] }POST /v1/headers-check$0.003HTTP security-header analysis for a URL.
{ "url": "https://…" }{ headers, grade, missing[] }POST /v1/screenshot$0.01Render any URL in headless Chromium → PNG screenshot as base64 JSON. SSRF-guarded.
{ "url": "https://…", "fullPage?": bool, "width?": 320-1920 }{ url, finalUrl, width, height, bytes, png_base64 }POST /v1/prediction-markets$0.005Keyword-search live prediction markets across Polymarket, Limitless & Manifold in one call — normalized odds + volume.
{ "query": "election", "limit?": 20 }{ query, count, venues: { ok[], failed[] }, markets: [{ venue, question, outcomes: [{ name, price }], volumeUsd, closesAt }] }POST /v1/defi-yields$0.005Filter and rank live DeFi lending/staking pool APYs across every protocol and chain (DefiLlama). Returns pools sorted by APY in percent units, with the apyBase/apyReward split, TVL, stablecoin + impermanent-loss flags and the DefiLlama poolId. Outlier pools are excluded unless you ask for them.
{ "chain?": "Base", "project?": "aave-v3", "asset?": "USDC", "stablecoinOnly?": bool, "minTvlUsd?": n, "includeOutliers?": bool, "limit?": 1-50 }{ query, count, source, asOf, pools: [{ protocol, chain, symbol, apy, apyBase, apyReward, tvlUsd, stablecoin, ilRisk, poolId }] }POST /v1/quant$0.003Deterministic finance calculators: Black-Scholes + Greeks, implied vol, Kelly, Sharpe/Sortino, VaR/CVaR, max drawdown, CAGR, volatility. Pure computation, no key.
{ "function": "black_scholes", "params": { "S":100, "K":100, "T":1, "r":0.05, "sigma":0.2, "type":"call" } }{ function, result: { price, delta, gamma, vega, theta, rho } }POST /v1/chat/completionsper-tokenOpenAI-compatible chat across 7 providers; the live list is /v1/models (3% markup).
{ "model": "…", "messages": [...] }OpenAI chat completion objectMachine-readable: /api/openapi.json (OpenAPI 3.1) and the live catalog.
You don't — there is no account, API key, or token. Each paid call is settled with an x402 payment: the endpoint returns HTTP 402 with the price, you sign a USDC (EIP-3009) authorization with your wallet, and retry with the X-Payment header. The wallet is the identity. The free GET endpoints (models, services, radar, health) need nothing.
Each endpoint is a fixed price per call in USDC, listed in the reference above (roughly $0.003–0.04; seo-audit is priced per page, and chat is per-token with a 3% markup). Many stalls also serve a small free trial first — see below.
A stall serves the free trial — a few calls per IP per day, no wallet — when it passes two tests: the call costs us nothing per request beyond CPU (an on-chain read, a pure computation, or a read of an index our watchers already maintain), and giving it away hands a stranger no new capability. That covers the on-chain safety checks on every chain (token-safety, token-report, address-safety, including Solana), the Base signal stalls (new-pairs, liquidity-pulls, whale-swaps, liquidity-history, tx-preflight), and quant, defi-yields and prediction-markets. The rest are paid from the first call: screenshot, seo-audit and chat cost us real money per request; web-extract, link-preview, robots-check and headers-check would turn us into an anonymous fetch service; and deployer-check needs a keyed explorer API. Every operation description in the OpenAPI spec says which of the two it is, so that is the copy to trust if this list ever lags.
USDC on Base (network eip155:8453). Payment is a gasless EIP-3009 signed authorization, so the payer needs only USDC, not native gas. A Lightning (BTC) rail is also available on some deployments.
Yes — the machine-readable OpenAPI 3.1 spec is served at /api/openapi.json, and a discovery manifest at /api/.well-known/x402-manifest.json. Agents can auto-generate a client from either.