# Rug Check - on-chain token safety check for EVM meme coins

Give a token contract and chain, get a GO / CAUTION / DANGER verdict with reasons,
read directly from on-chain state. Built for agents that trade or evaluate new tokens.
Pay-per-call via MPP on Tempo. No API key, no signup.

## Why this exists
Market-data APIs (CoinGecko) tell you a token's price, not whether it is a trap.
New meme coins are not indexed and not vetted. Rug Check reads the contract on-chain
and flags the structural red flags an agent should see before buying.

## What it checks (on-chain, plain RPC)
- ERC-20 validity (is it even a real token interface)
- Ownership renounced or still controlled by an owner
- Upgradeable proxy (EIP-1967): logic can be swapped after deploy
- Mint capability present in bytecode
- LP burn status on the main DEX pair (token vs native)

## What it does NOT check (be honest with the user)
- Honeypot / sellability (needs buy-sell simulation)
- Holder concentration / top holders (needs an indexer)
- Off-chain liquidity locks in third-party lockers
- Team intent or future actions
A GO means no on-chain red flags in the checks performed, NOT "safe".

## Chains
- eth: Ethereum
- bnb: BNB Chain
- base: Base

## Endpoint
POST https://rug-check-iota.vercel.app/api/rugcheck   (price: 0.020000 USD per call, paid via MPP on Tempo)

Request body (JSON):
{ "token": "0x...", "chain": "bnb", "mode": "auto" }
  - token : token contract address (required)
  - chain : eth | bnb | base (required)
  - mode  : auto (default) | new | mature (optional)

## Adaptive scoring (mode)
The same on-chain flags mean different things for a fresh meme coin vs an
established token. So scoring adapts:
- new    : strict. Owner not renounced, mint capability, and unburned LP push hard
           toward DANGER. Best for freshly launched meme coins.
- mature : lenient. Those flags are usually legitimate for established tokens, so
           they cap at CAUTION.
- auto   : picks new or mature from on-chain LIQUIDITY DEPTH (deep liquidity =>
           mature; shallow or unknown => new/strict, the safe default).
A reputable, centrally-controlled token (even a major stablecoin) can still show
CAUTION because it genuinely has on-chain central control.

Response (200, JSON):
{
  "type": "rugcheck",
  "chain": "bnb",
  "token": "0x...",
  "tokenInfo": { "name": "...", "symbol": "...", "decimals": 18, "totalSupply": "..." },
  "verdict": "GO | CAUTION | DANGER",
  "reasons": ["..."],
  "checks": [ { "id": "ownership", "status": "ok|warn|danger|info", "detail": "..." } ],
  "notChecked": ["..."],
  "explorer": "https://bscscan.com/token/0x...",
  "disclaimer": "..."
}

## Payment
Unpaid requests return HTTP 402 with a WWW-Authenticate: Payment challenge
(method="tempo", intent="charge"). Pay with mppx, then retry.
Use: npx mppx https://rug-check-iota.vercel.app/api/rugcheck --method POST -J '{"token":"0x...","chain":"bnb"}'

## Notes
- Source: direct EVM RPC reads via viem. Free, no key. Informational only, never the sole basis for a trade.
- Discovery document: https://rug-check-iota.vercel.app/openapi.json