AgentRisk M2M is a pre-trade token risk and honeypot detection API built for autonomous AI trading agents operating on Base. Every AI agent that trades ERC-20 tokens faces the same problem before executing a swap: is this contract a honeypot, a rug pull, or a legitimate token? Doing that check reliably — not just reading a static score, but verifying a token is actually sellable — turns out to be harder than it looks.
The core problem: static safety scores aren't enough
Most token safety checkers return a single boolean or score based on static bytecode analysis. That catches obvious red flags — mint functions, blacklist functions, ownership that was never renounced — but it misses a critical class of scams: contracts that look clean statically but block sells dynamically, through logic that only triggers under specific conditions.
AgentRisk M2M's core differentiator is live sell simulation — instead of trusting a static flag, it actually simulates a sell against the live pool state on-chain, across Uniswap V2, V3, V4, and Aerodrome (both V1 and Slipstream). If the simulated sell reverts, the token is flagged as a honeypot regardless of what the static analysis says.
What the API checks
Honeypot detection (via live sell simulation + GoPlus Security cross-reference)
Buy/sell tax percentage, including hidden tax flags
Ownership: renounced status, hidden owner detection, "can take back ownership" flag
Mint, blacklist, whitelist, pause, and self-destruct function presence
LP lock/burn status and percentage
Holder concentration (top-10 holder %, creator %)
Deployer wallet reputation and freshness
Brand impersonation detection
Exit Liquidity Score — simulated price impact at $100/$1k/$10k sell sizes
The output is a machine-readable riskScore (0–100), a riskLevel (SAFE / CAUTION / HIGH_RISK / CRITICAL_HONEYPOT), and a shouldExecute boolean an agent can act on directly — no natural-language parsing required.
Payment: x402, not API keys
AgentRisk uses the x402 protocol for pay-per-call access — 0.15 USDC per scan on Base, settled directly on-chain. No signup, no API key management, no rate-limit tiers. An agent's wallet signs a payment authorization, the facilitator (Coinbase CDP) verifies and settles it, and the scan result comes back in the same request. A free trial (3 scans per wallet) is available via /scan-trial for testing before committing to paid calls.
This matters specifically for autonomous agents: there's no human in the loop to manage credentials. The agent's wallet is the identity.
Discovery: what actually makes an agent find your API
Here's the part most people skip when writing about x402: shipping an API that accepts x402 payments is not the same as being discoverable by autonomous agents. That requires implementing the x402 Bazaar discovery extension correctly — declaring input/output schemas in your 402 response so a facilitator can catalog your service and agents can find it via semantic search, not just direct URL knowledge.
I found this out the hard way: a builder-code attribution extension I'd added was being merged into the extensions object with a dict-unpack (**declare_builder_code_extension(...)) instead of being nested under its own named key. That silently broke the Bazaar extension's schema validity — the service was accepting payments and returning valid results the whole time, but wasn't properly cataloged for discovery. Fixed by nesting each extension under its constant key (BUILDER_CODE: declare_builder_code_extension(...)) instead of unpacking blindly.
Lesson: if you're building an x402 service, decode your own 402 response and check the extensions object structure against the spec. A working payment flow tells you nothing about discoverability.
Where it's live
API / MCP server: agentrisk.dev
x402 Bazaar: cataloged and discoverable
MCP Registry: io.github.Neurobyteio/agentrisk
Smithery: daniel-arbitr/agentriskm2m
Integrations: MCP server, Python SDK (agentriskm2m), MetaMask Snap, ElizaOS plugin, LangChain tool, Vercel AI SDK tool, Coinbase AgentKit action provider
Live on-chain stats: viewable on x402 Lens — transaction volume and settlement data, publicly verifiable
What's next
Still early — the goal now is getting the API in front of more agent developers building on Base, not adding more features. If you're building a trading agent, an MEV bot, or any autonomous system that needs pre-trade due diligence on Base tokens, I'd genuinely like feedback: github.com/Neurobyteio/agentrisk.
Top comments (0)