Most token safety APIs — honeypot checkers, rug-pull detectors, scam scanners — return plain JSON. You either trust the response or you don't. There's no way for a downstream consumer, especially another autonomous AI agent, to verify that a result actually came from the service it claims to, or that it hasn't been tampered with in transit or cached somewhere stale.
I just closed that gap for AgentRisk M2M, a pre-trade risk-scoring API for Base tokens, by adding signed risk receipts.
The problem: JSON you have to trust, not verify
When one agent calls another agent's API to check if a token is safe to swap — honeypot detection, rug-pull risk, liquidity lock status — it gets back a JSON blob. If that agent wants to cache the result to avoid paying for a re-scan, or hand the result to a third agent downstream, there's no cryptographic guarantee the data is authentic. It's an honor system in a space that's specifically built around trustless, machine-to-machine transactions via protocols like x402.
The fix: ECDSA-signed attestations
Calling /scan?attest=true now returns the full risk report plus an attestation object:
json
{
"risk_score": 67,
"risk_level": "HIGH_RISK",
"attestation": {
"scan_id": "...",
"risk_score": 67,
"input_digest": "sha256 of the request inputs",
"rulepack_hash": "sha256 of the current scoring logic",
"rulepack_version": "1.0.0",
"chain": "base",
"timestamp": 1788161104,
"signer": "0x963E...",
"signature": "0x..."
}
}
The signature is generated with a dedicated key — separate from the payment wallet — using standard ECDSA signing via eth_account. Anyone can independently recover the signer address from the message and signature and confirm it matches the published signer.
Why rulepack_hash and input_digest matter as much as the signature itself
A bare signature only proves "someone with this key signed something." The useful part is what gets signed:
input_digest ties the receipt to the exact token address and chain that were checked — so a receipt can't be replayed against a different input.
rulepack_hash is a SHA-256 hash of the scoring logic itself. If the detection rules change tomorrow, the hash changes, and any receipt issued before that point is honestly frozen to the rules that were live when it was generated. An agent evaluating an old cached receipt can tell at a glance whether it was scored under current logic or something older.
What this actually enables for agent-to-agent workflows
Caching without re-paying: an agent that already has a valid, recent, signed receipt for a token doesn't need to call /scan (and pay 0.15 USDC via x402) again — it can verify the signature locally and trust the cached result.
Passing results downstream: agent A can hand agent B a receipt as proof of what was checked, without B needing to trust A's word for it.
Detecting staleness or tampering: if a receipt's rulepack_hash doesn't match the currently published hash, or the timestamp is old, an agent can choose to refuse it and request a fresh scan instead of trading on outdated risk data.
Where this fits
AgentRisk M2M is a pre-trade risk API for Base — honeypot detection, deployer wallet freshness, brand impersonation checks, on-chain LP lock verification, and live sell simulation via Uniswap V3's QuoterV2 (catches dynamic honeypots — contracts that behave normally for the first N buys, then block sells — which static bytecode analysis misses). Paid per call via the x402 protocol, 0.15 USDC, no signup, no API keys. Also has a free public web UI (3 free full scans per wallet) at the link below.
Repo: github.com/Neurobyteio/agentrisk
Try it: agentrisk.dev
Top comments (0)