A safety check for agents

GET /api/v1/check/{address} — CORS is open, so it can be called directly from a browser or an agent runtime. Results are cached for 2 minutes. A cold scan still running after 18 seconds answers 202 with {"status":"scanning","retry_after":5} and a Retry-After header: wait that many seconds and repeat the same GET until it returns 200. The scan keeps running on the server and its result is cached, so a poll usually returns at once.

Request

curl https://hoodrugcheck.com/api/v1/check/0x1234...abcd \
  -H "Authorization: Bearer hrc_live_..."

Response (200, evidence truncated)

{
  "version": "1",
  "address": "0x1234...abcd",
  "name": "Example Token",
  "symbol": "EX",
  "score": 78,
  "raw_score": 78,
  "status": "tradeable",
  "verdict": "Some concerns worth reading",
  "checks": [
    {
      "id": "liquidity",
      "label": "Liquidity",
      "result": "pass",
      "evidence": [
        "Sellable on Uniswap V4 (WETH pool)",
        "$142,000 in the deepest pool",
        "Deployer holds no LP position"
      ]
    }
  ],
  "evidence_locked": false,
  "report_url": "https://hoodrugcheck.com/token/0x1234...abcd",
  "scanned_at": "2026-09-25T14:02:11.000Z",
  "disclaimer": "Informational only, not financial advice. Verify independently before trading or recommending this token."
}

status is one of tradeable, UNTRADEABLE (every venue was searched and none can sell it), no supported venue, or incomplete. An incomplete response means pool discovery failed or could not finish, so liquidity and sellability are unverified: score and raw_score are null, and verdict says so. Retry shortly; don't treat it as a clean or a failed token.

score, status, verdict, and every check's id / label / result are always in the response, key or no key. The evidence bullets behind each check follow the same line as the website: anonymous requests, and requests from a key whose account isn't currently Pro, get evidence_locked: true with every check's evidence emptied and an upgrade_url pointing at /pricing. A Pro account's key gets evidence_locked: false and full evidence.

Locked shape (no key, or a non-Pro key)

{
  "id": "liquidity",
  "label": "Liquidity",
  "result": "pass",
  "evidence": []
}
// ...
"evidence_locked": true,
"upgrade_url": "https://hoodrugcheck.com/pricing"

• 200 — scan complete, body above.
• 202 — still scanning after 18 seconds; wait retry_after seconds (also the Retry-After header) and repeat the same GET.
• 400 — invalid address, wrong chain, or not a token contract. code is one of INVALID_ADDRESS, WRONG_CHAIN, NOT_A_CONTRACT, NOT_A_TOKEN.
• 401 — an API key was sent but is malformed, unknown, or revoked; code is INVALID_API_KEY. Send a valid key, or no key for anonymous access.
• 429 — rate limit exceeded.
• 502 — the chain did not answer in time; safe to retry.

• No key: 10 requests/hour per IP.
• With a key: 120 requests/hour, sent as Authorization: Bearer <key> or X-API-Key. Full evidence too, as long as the key's account is currently Pro.
• Every response carries X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset.
• Pro accounts generate one key on /account. Keys are shown once, at creation.

GET /api/v1/wallet/{address} — what the chain shows about a wallet: the tokens it deployed, its verified removals, who funded it and who it funded (every link with its transaction hashes), linked wallets within 2 hops, and the case file when one exists. Documented on-chain links only: exchanges, bridges, contracts and wallets that fund bot swarms are returned as hubs — context, never a link between two wallets — and a wallet funded through an internal transfer has funder_status: "unknown", never a guess. It states what the chain shows, not anyone's intent. Same keys, tiers and hourly allowance as the check endpoint. Web version: /wallet/{address}.

• /openapi.json — OpenAPI 3.1 description of this endpoint.
• /mcp — the same check as an MCP tool, check_token, for MCP-native agents, plus check_wallet for the wallet profile. Streamable HTTP, stateless.