Three small crypto alert scripts that first check if a token can be sold

An alert that says "a wallet got a new token" or "someone posted a contract" leaves the first question open: can this token even be sold?

We built three small open-source scripts that add that check. Each one is a single Python file with no packages to install, MIT licensed, and each ran on real tokens before we published it. This post shows what each one does, how to run it in a minute, and where it stops being the right tool.

All three ask the same safety check, the CyberWareX oracle (/risk/explain). It simulates a real buy and sell on the token's pool, reads who can mint, pause, blacklist or upgrade the contract, and looks up the deployer's earlier tokens. The answer is one word (ALLOW, LIMIT, RECHECK or BLOCK), a grade from A to F, a 0 to 100 risk score and reason codes.

1. wallet-alert: a new token lands in a wallet you watch

Repo: https://github.com/cyberwareX/wallet-alert

You give it Base wallets. Every time a token shows up in one of them for the first time, it prints an alert, or sends it to Telegram, with the rug check attached.

git clone https://github.com/cyberwarex/wallet-alert && cd wallet-alert
python3 wallet_alert.py --wallet 0xYourWallet=me --wallet 0xSomeWhale=whale

This is a real alert from a run on 2026-11-06. The coin was new, and its deployer had already rugged an earlier token:

trader-1 received 768,861 GM
Rug check: CAUTION (LIMIT, grade C, risk 35/100)
Why: material risk found; trade small or skip: deployer_prior_rug, no_effective_controllers, scam_signals_incomplete
Flags: DEPLOYER_PRIOR_RUG, DEPLOYER_REPUTATION_FLOOR, NO_EFFECTIVE_CONTROLLERS, SCAM_SIGNALS_INCOMPLETE

It polls a public Base RPC every 30 seconds, caches each verdict for 24 hours so a busy wallet does not burn checks, and has --hide-blocked to fold junk airdrops into one line. --once runs a single poll, which fits cron.

2. token-check-bot: someone pastes a contract in your group

Repo: https://github.com/cyberwareX/token-check-bot

A Telegram bot. When anyone in the group pastes a token address or an explorer link, it replies with the check. You can try it in the terminal before you make a bot:

git clone https://github.com/cyberwarex/token-check-bot && cd token-check-bot
python3 token_check_bot.py --stdin

We ran it again today, 2026-11-07, with three messages:

> is this safe? https://basescan.org/token/0xb1001f05dfe2edeab6eff92f3a4c1d631c65aace
Base 0xb100...aace
Rug check: DANGER (BLOCK, grade F, risk 99/100)
Why: sells revert in a live simulation: you cannot exit
Flags: HONEYPOT_CONFIRMED

> when moon
(no token address in that message)

> bsc 0x0e09fabb73bd3ade0a17ecc321fd13a19e81ce82
BSC 0x0e09...ce82
Rug check: OK (ALLOW, grade B, risk 5/100)
Why: trade simulation passed and no rug signal found
Flags: CLEAN

The first one is a honeypot: buying works, selling fails. The chain comes from the explorer link or a word like bsc in the message. It reads at most 3 addresses per message and has caps (20 new checks per chat per hour, 200 a day). Use --allow-chat so a stranger who adds your bot to their group cannot spend your checks.

3. daily-token-report: what got riskier since yesterday

Repo: https://github.com/cyberwareX/daily-token-report

You keep a list of tokens you hold or follow. Once a day it checks each one again, appends a row to history.csv and writes report.md with any change on top: a grade that dropped, a new flag such as the owner gaining mint rights, a pool that is gone. Quiet days stay quiet.

git clone https://github.com/cyberwarex/daily-token-report && cd daily-token-report
python3 daily_token_report.py watchlist.txt

The watchlist is one token per line:

base 0x940181a94a35a4569e4529a3cdfb74e38fd98631 AERO
bsc  0x0e09fabb73bd3ade0a17ecc321fd13a19e81ce82 CAKE

You do not need a server for this one. Fork the repo, edit the watchlist and turn on Actions: the included workflow runs at 06:17 UTC on GitHub's free runners and commits the report back. The repo runs it on its own list, so data/report.md there is a live example. With --telegram it messages you only on days when something changed or could not be checked. A second run on the same day does nothing unless you pass --force, so a cron mistake cannot spend checks twice.

What it costs

• 3 checks per IP per day are free. No account, no key.
• After that each check is 0.005 USDC, paid on Base with any x402 client, or from a prepaid key: POST https://safe.cyberwarex.com/subscribe?usd=3 gives a key with 3.30 USDC of credit, about 660 checks. Set it as CWX_KEY.
• When the free checks are used up and there is no key, the scripts say NOT CHECKED ... treat as unknown, not safe. None of them shows a token as safe without a real check.

Limits, said plainly

• wallet-alert watches Base only. The bot and the daily report also cover BSC, Ethereum, Polygon and Arbitrum.
• The check is automated heuristics, not financial advice. A token that passes today can change tomorrow, which is why the daily report exists. We saw the risk score for the same token move by a point between two runs minutes apart; the scripts report what the check says.
• On GitHub Actions your fork shares runner IPs with others, so the free 3 a day can already be used up there. The report then says NOT CHECKED instead of guessing.
• The bot handles one check at a time. A slow check, up to about 90 seconds, delays the next reply.
• Each repo has offline tests with every network call stubbed: python3 -m unittest -v.

Use something else when

• You want a free token security lookup with no per-call price. GoPlus Security has a public token security API that answered our test call without a key, and honeypot.is has a free honeypot check API. The call to our check is one function, check_token, in each file, so you can swap in another source and map its fields to the alert.
• You need alerts across many chains, NFTs or native coin transfers. wallet-alert is ERC-20 on Base only.
• You want a hosted dashboard with history across thousands of tokens. These are small scripts you run yourself, not a product with a UI.
• You need sub-second alerts for trading. A 30 second poll and a check that can take a minute are too slow for that.

Want one of these hosted or changed for your case?

We are testing whether people want these as a hosted service, for example your wallets and your Telegram, plus actions such as a sell alert or an auto-revoke. Nothing is promised yet. If you would use it, open a build request issue on any of the three repos with what you need and a rough budget, or leave a contact and budget on the short form at https://cyberwarex.com/gigs?src=devto. We count the requests to decide what to build.