# HexScan Token Security Scanner

## Description
Check if a token is safe to buy. Detects honeypots, rug-pulls, malicious taxes, unverified source code, and other ERC-20 security risks. Returns a risk score 0-100.

## When to use
- Before buying or interacting with an unknown token
- To check if a token is a honeypot (can buy but can't sell)
- To verify token buy/sell taxes
- To check if source code is verified
- As pre-trade due diligence on any ERC-20

## How to call
---------
POST https://hexscan.xyz/scan
Content-Type: application/json
{"address": "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48", "chain": "ethereum"}
---------


## Honeypot Check ($0.01)
POST https://hexscan.xyz/honeypot
Content-Type: application/json
{"address": "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48", "chain": "ethereum"}
# Returns 402 + payment-required header
# Add payment-signature header to get 200 + honeypot result
# Price: $0.01 USDC (Base mainnet, EIP-3009, gasless for buyer)
# Response: {"honeypot": false, "canBuy": true, "canSell": true, "buyTax": "0%", "sellTax": "0%", "riskScore": 10}

## Payment
- $0.10 USDC per scan on Base (eip155:8453)
- x402 Payment Protocol (EIP-3009, gasless)
- No API key needed -- use any x402-compatible client

## Response
---------json
{"riskScore": 10, "riskLevel": "MINIMAL", "tokenName": "USD Coin", "tokenSymbol": "USDC", "findings": [{"severity": "LOW", "title": "Proxy contract", "description": "Upgradeable contract", "confidence": 0.7, "source": "goplus"}], "summary": "MINIMAL RISK (score: 10/100). 1 finding(s). Not an audit."}
---------

## Risk levels
- 0-10 MINIMAL | 11-30 LOW | 31-60 MEDIUM | 61-80 HIGH | 81-100 CRITICAL

## Chains
ethereum, base, arbitrum, optimism, polygon, bsc, avalanche

## MCP Server
- URL: https://hexscan.xyz/mcp
- Protocol: JSON-RPC 2.0 over HTTP (Streamable HTTP)
- Tools: scan_token ($0.10), honeypot_check ($0.01)
- Payment via x402 _meta["x402/payment"]
- Unpaid tool call returns PaymentRequired (code 402) with accepts[] and bazaar extension

## Disclaimer
Not a security audit. Automated risk triage only. No warranty.