If your CrewAI agent trades or touches Base tokens, one honeypot can drain the run. This guide wires a real on-chain sellability check into the agent as a pre-trade gate — verdict first, buy second.
pip install crewai-true402
# agent.py
from crewai import Agent
from crewai_true402 import true402_tools
# Six tools: true402_token_report, true402_token_safety, true402_address_safety,
# true402_deployer_check, true402_tx_preflight, true402_liquidity_history.
# Reads PAYER_PRIVATE_KEY from env (a Base wallet with USDC).
# Omit the key to use the free daily trial (covers all but deployer-check).
tools = true402_tools()
agent = Agent(
role="Base trader",
goal="Rug-check every token before buying",
backstory="Refuses to buy any token that fails the sellability check.",
tools=tools,
)
# Zero-setup sanity check from a terminal (no install, no key):
# npx @true402.dev/rugcheck 0x<token>
A CrewAI agent that trades on Base is only as safe as the token it buys. The classic trap is the honeypot: a token you can buy but can never sell. Static scanners read the contract source or ABI and guess — but a malicious transfer hook, a hidden blacklist, or a sell tax set to 100% won't always show up in a static read.
true402's rug-check runs a real on-chain buy/sell simulation using a state-override eth_call. It injects a buy-then-sell into a simulated state and measures whether the tokens actually come back out — proving sellability, not just that the code looks fine. On top of that it checks liquidity, ownership and mint authority, and deployer reputation. That combination is what you want gating a trade.
Install the package and hand its tools to your agent. The tool set speaks x402 under the hood — payment happens per call in USDC on Base, and the wallet is the identity, so there is no account to create and no API key to manage.
pip install crewai-true402.true402_tools() — it returns six tools and reads PAYER_PRIVATE_KEY from the environment (a Base wallet holding a little USDC).deployer-check.Agent(tools=...).The full snippet is in the code block above. Before you even install, you can sanity-check any token from a terminal with npx @true402.dev/rugcheck 0x<token> — no install, no key.
The safe pattern is a hard gate: the agent must call the rug-check and read the verdict before any buy tool fires. Encode that in the agent's goal and task so the LLM can't skip it.
The token-report stall returns a composite verdict of avoid, caution, or ok. The rule is simple:
deployer-check).Because the check is a tool the agent calls, you can make it non-optional in the task description: "You must call the token-report tool and only proceed if the verdict is ok." Treat a failed or missing check as avoid — fail closed, never fail open.
true402_tools() returns six tools. Pick by how much depth you need — all are POST endpoints under https://true402.dev/api, each x402-gated (402 → pay in USDC → response):
POST /v1/base/token-report — composite avoid/caution/ok verdict, the best default for a trade gate (~$0.01). Free daily trial.POST /v1/token-safety — structural score 0–100 when you want a raw number (~$0.005). Free daily trial.POST /v1/base/address-safety — screen a counterparty or spender address (~$0.005). Free daily trial.POST /v1/base/deployer-check — deployer reputation, useful on a caution verdict (~$0.008). No free trial — it depends on a keyed third-party explorer API, so it is paid from the first call.POST /v1/base/tx-preflight — the last check before signing: pass the unsigned transaction and get a simulation against current state, the decoded intent (an unlimited approval is judged on the spender), and the counterparty's removal history (~$0.008). It takes no private key and no signature, so it cannot broadcast or front-run. Free daily trial.POST /v1/base/liquidity-history — what has already happened to the token's liquidity: every observed removal with amount, block and transaction hash, plus the other tokens drained in the same transaction (~$0.005). Free daily trial.For most trading agents, token-report alone is the gate; reach for deployer-check only when the composite verdict is ambiguous. Add liquidity-history before a large position — a pool drained last month simulates perfectly today if someone re-seeded it — and tx-preflight immediately before the agent signs. Neither returns a verdict of safe: each answer carries the block range it covers, so none observed is not a claim of safety.
While building, run with no key and lean on the free daily trial on the safety stalls. When you move to production and exceed the trial, fund a Base wallet with a small USDC balance and set PAYER_PRIVATE_KEY — from then on each check settles per call over x402. There is still no account and no API key; payment is authentication.
Read the endpoint details and payment flow in the API docs, and try any token instantly in the browser with the rug-check tool.
No. true402 uses x402, so your Base wallet is your identity — there is no account and no API key. Each safety call settles per-call in USDC. During development you can skip the key entirely and use the free daily trial on the safety stalls.
A static scan reads the contract and guesses. true402 runs a real on-chain buy/sell simulation via state-override eth_call, proving the token can actually be sold — catching honeypots a static read misses. It also checks liquidity, ownership and mint authority, and deployer reputation.
Use POST /v1/base/token-report. It returns a composite avoid, caution, or ok verdict — the natural pre-trade gate. Proceed only on ok, block on avoid, and escalate caution to a deeper check like deployer-check or a human confirmation before sizing the trade.
Each check is pay-per-call in USDC on Base over x402. Indicative prices are around $0.01 for token-report, $0.005 for token-safety, address-safety and liquidity-history, and $0.008 for deployer-check and tx-preflight. Fund a Base wallet with a small USDC balance and set PAYER_PRIVATE_KEY to pay beyond the free trial. Note that deployer-check has no free trial — it needs a keyed third-party explorer API, so it is paid from the first call.
Yes. Run npx @true402.dev/rugcheck 0x<token> from a terminal for a zero-setup check with no install and no key, or open the browser tool at https://true402.dev/check. Both are good for sanity-checking before you wire the CrewAI tool into an agent.