● AVAILABLE NOW · $29 in SOL (ONE-TIME · 3 REBINDS)

Cross-Chain Token RugScore & Honeypot Scanner — One 0–100 number before you buy the token.

Audit any Solana SPL / Token-2022 mint or Ethereum, Base, or Arbitrum token contract and get a deterministic RugScore from 0 to 100 with a risk tier and the exact rules that fired: mint and freeze authority, dangerous Token-2022 extensions, holder concentration, upgradeable-proxy admins, SELFDESTRUCT and DELEGATECALL opcode traps, source verification and DEX liquidity depth. Every run ends with an audit_sha256 so you can re-run and compare.

SKU: token-rugscore · Skills: token-rugscore-setup + token-rugscore · Runtime: /runtime/token_rugscore.py · Also included in defi-wallet-security-pack ($59) and pro-trader-perps-suite ($69)

⚡ Works in Grok Bot + Cursor + Claude Code + Any Terminal (Zero-Dep Python 3 CLI Included)

See Sample Output View in Homepage Catalog

What It Does

Solana rules RS-SOL-01..05: active mint authority (RS-SOL-01), active freeze authority (RS-SOL-02), Token-2022 extension traps such as PermanentDelegate, TransferHook, TransferFeeConfig and frozen DefaultAccountState (RS-SOL-03), top-holder concentration (RS-SOL-04) and DEX liquidity depth and pair age (RS-SOL-05).
EVM rules RS-EVM-01..04 on Ethereum (eth), Base (base) and Arbitrum One (arb): upgradeable-proxy admin and EOA control over EIP-1967 / EIP-1822 / EIP-1167 slots (RS-EVM-01), SELFDESTRUCT and unexpected DELEGATECALL opcode traps (RS-EVM-02), unverified source via Sourcify (RS-EVM-03) and thin liquidity (RS-EVM-04).
Deterministic scoring: fixed rule weights are summed and capped at 100, then mapped to LOW / MODERATE / HIGH / CRITICAL. Same input and same chain data give the same score and the same audit_sha256.
Built for pipelines: --json / --markdown output, risk-tier exit codes for CI/CD gating, and 1200x675 PNG audit receipts. 100% Python stdlib.

Live output (`token_rugscore.py`: Solana Token-2022 mint + Base contract)

Sample disclosure: this is a representative sample, not a customer report. It was produced against fictional test targets; addresses, balances and hashes are illustrative placeholders, and no private keys, seed phrases or secrets are ever shown. Your own report will differ in content and length.

snapshot   2026-10-28 09:14:22 UTC | tool=token_rugscore v1.0 | sample=fictional

target    sol:RugDemo7Qk2mVxN4pLwT8cYhB5eJ3aRsZf9uXoGd1HtKq  (fictional test mint)
program   Token-2022 (TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb)
supply    1,000,000,000.000000  decimals=6
mint.auth   Fz3p...Q8xA [ACTIVE]
freeze.auth none [REVOKED]
extensions  TransferHook(program=Hk4m...n2Wd) TransferFeeConfig(250 bps) MetadataPointer
holders     top1=18.4% top10=62.7% top20=74.1% (excl. LP/burn)
liquidity   $8,420 (Raydium CPMM, 24h vol $1,930) pair_age=3d
rules
  [HIGH    ] RS-SOL-01 +25  MINT_AUTHORITY_ACTIVE: issuer can mint unlimited supply
  [INFO    ] RS-SOL-02  +0  FREEZE_AUTHORITY_REVOKED
  [MEDIUM  ] RS-SOL-03 +20  TOKEN2022_TRANSFER_HOOK: custom program runs on every transfer (sellability not provable from account data)
  [MEDIUM  ] RS-SOL-04 +15  HOLDER_CONCENTRATION: top10 hold 62.7% of circulating supply
  [MEDIUM  ] RS-SOL-05 +12  THIN_LIQUIDITY: $8,420 pool depth, pair younger than 7d
RugScore  72/100  tier=HIGH  rules_fired=4/5

target    base:0x4fA1c9e07B2d83Ae5C6f10D9b3E7a42c88D5e0b1  (fictional test contract)
bytecode  2411 bytes  proxy=EIP-1967
impl      0x9Be3d1A06c47F2e85a0b3C1D7e49fA82b6D0c5E3 (11874 bytes, verified=yes, Sourcify exact_match)
admin     0x2c7D...91aF [EOA]
opcodes   impl: SELFDESTRUCT=yes DELEGATECALL=no
liquidity $412,880 (Uniswap v3 WETH/TKN 0.3%)
rules
  [HIGH    ] RS-EVM-01 +20  PROXY_EOA_ADMIN: one key can replace the implementation
  [MEDIUM  ] RS-EVM-02 +10  OPCODE_SELFDESTRUCT: implementation contains SELFDESTRUCT (heuristic)
  [INFO    ] RS-EVM-03  +0  SOURCE_VERIFIED
  [INFO    ] RS-EVM-04  +0  LIQUIDITY_ADEQUATE
RugScore  30/100  tier=MODERATE  rules_fired=2/4

audit_sha256 272f48c9ed521065954a0aba7759ef54a6489bb86008a6400bd4197469d2c39a
exit_code 2
SCOPE_NOTE: Read-only on-chain and public-API inspection. No private keys, seed phrases or signing; no transaction is built or broadcast. A RugScore is a deterministic sum of fixed rules, not a verdict: a low score does not mean a token is safe, and a high score is not proof of fraud. Not financial, investment or security-certification advice.

What It Does Not Do

Strictly read-only: never asks for private keys or seed phrases, and never builds, signs, or broadcasts transactions.
Never labels a token 'safe', 'audited', or 'rug-proof'; a low RugScore only means none of the listed rules fired.
No price prediction and no buy or sell advice. Opcode and extension checks are heuristics, not formal verification or a substitute for a source audit.

Licensing & Setup

One-time license, up to 3 workspace-reset rebinds. On Turn 1 the token-rugscore-setup skill verifies your agent key, binds your wcl_... code through the read-only license helper, and confirms the bot files are installed. The license code is never printed in chat. Also included at no extra cost in the DeFi & Multi-Chain Wallet Security Pack ($59) and the Pro Trader & Perps Risk Suite ($69).

One wcl_... key, two runtimes. Your license key works inside Grok Bot and from any local terminal or IDE agent (Cursor, Claude Code, Windsurf, CI/CD) via the standalone single-file Python 3 CLI (standalone /runtime/<script>.py CLI) — Python 3.10+ standard library only, zero pip install dependencies, with --json / --markdown output.

Frequently Asked Questions — Cross-Chain Token RugScore & Honeypot Scanner

How does the Cross-Chain Token RugScore calculate a 0–100 risk score for Solana and EVM tokens?

Each rule is a fixed-weight check, and the weights of the rules that fire are summed and capped at 100. Solana mints are scored by RS-SOL-01..05 (active mint authority, active freeze authority, dangerous Token-2022 extensions, top-holder concentration, DEX liquidity depth); Ethereum, Base and Arbitrum contracts by RS-EVM-01..04 (upgradeable-proxy admin, honeypot-style opcode traps, unverified source, liquidity). The score maps to a risk tier (0–24 LOW, 25–49 MODERATE, 50–74 HIGH, 75–100 CRITICAL). There is no model and no randomness: the same input and the same chain data produce the same score and the same audit_sha256, so you can re-run an audit and compare.

Which Solana Token-2022 extensions and EVM proxy or opcode traps does RugScore flag?

On Solana it reads the mint account and flags an active mint authority and freeze authority, plus the Token-2022 extensions that let an issuer move or tax your balance: PermanentDelegate, TransferHook, TransferFeeConfig, DefaultAccountState (frozen) and a mutable metadata pointer. On Ethereum, Base and Arbitrum it resolves EIP-1967, EIP-1822 UUPS and EIP-1167 proxy slots, reports whether the upgrade admin is a single EOA, and scans runtime bytecode (CBOR metadata stripped, PUSH immediates skipped) for SELFDESTRUCT and unexpected DELEGATECALL, then checks Sourcify for verified source. These are byte-level and account-level heuristics with cited evidence, not a formal audit.

Can I run token_rugscore.py locally in Cursor, Claude Code, or CI/CD and generate 1200x675 PNG audit receipts?

Yes. One wcl_... license unlocks both the 1-Click Grok Bot and the standalone single-file token_rugscore.py CLI from /runtime/token_rugscore.py. It needs Python 3.10+ and the standard library only, with no pip install, and it runs in Cursor, Claude Code, Windsurf, any terminal or a CI/CD job. It emits text, --json or --markdown, returns a non-zero exit code by risk tier so a pipeline can gate on it, and can render a 1200x675 PNG audit receipt showing the score, tier, fired rule IDs and audit_sha256.

What safety and refusal boundaries does the Cross-Chain Token RugScore scanner enforce?

It is strictly read-only: it never asks for private keys or seed phrases and never builds, signs or broadcasts a transaction. It never labels a token 'safe', 'audited' or 'rug-proof', because a low RugScore only means none of the listed rules fired, not that the token is trustworthy. It does not predict price, give buy or sell advice, or certify a contract; output is factual, with evidence for every rule, and is not financial or security-certification advice.