Docs

Solana RPC

RPC_MAINNET / NEXT_PUBLIC_RPC_MAINNET (default api.mainnet-beta.solana.com). With HELIUS_API_KEY set, the Helius RPC and getAsset are used.

DexScreener

tokens/v1, token-pairs/v1, latest/dex/search, latest/dex/pairs and token-boosts/latest/v1. No key.

Jupiter

lite-api.jup.ag: tokens/v2/search, price/v3, swap/v1/quote. JUPITER_API_KEY switches to api.jup.ag.

RugCheck

api.rugcheck.xyz /v1/tokens/<mint>/report/summary. Optional cross-check, shown separately; failure never blocks a report.

All calls are server-side with a 10s timeout, a 30–60s in-memory cache and a per-IP rate limit. Server keys are never sent to the browser.

F1 AUTH

getAccountInfo (jsonParsed) on the mint gives supply, decimals, mint and freeze authority and Token-2022 extensions (transfer fee, permanent delegate, transfer hook, non-transferable, default frozen state, pausable). Metaplex metadata is read from the PDA and decoded manually; Token-2022 uses the on-chain tokenMetadata extension.

F2 HOLDERS

getTokenLargestAccounts (top 20), owners resolved with getMultipleAccounts. Known pool programs, DexScreener pair addresses, bonding curves and burn addresses are labelled and excluded from top-1/top-10. Funding clusters: for each of the top 10 holders, the oldest signatures (up to 3 pages of 1000) are inspected for the first incoming SOL transfer; holders sharing a funder form a cluster.

F3 BUNDLE

The mint address signatures are paginated (up to 10 pages) to the oldest transaction. The creation block (and the next 2) is fetched with getBlock and pre/post token balances of this mint are compared. Wallets (System-owned) whose balance increased are launch buyers; current balances come from getTokenAccountsByOwner. Flag: ≥3 wallets in the creation slot or >10% of supply.

F4 DEV

Creator = fee payer of the creation transaction. SOL balance, current holding, and net outflow (launch-slot allocation vs now). Prior launches: recent signatures of the creator are scanned for InitializeMint instructions; prior mints are checked on DexScreener and called dead with no pair or liquidity below $1k. Serial launcher: more than 5 prior mints and more than 80% dead.

F5 LIQ

All DexScreener pairs. For Raydium AMM, Raydium CPMM and PumpSwap pools the LP mint is read from the pool account and the share of LP supply sitting in the burn address is computed. Other pool types are reported as not determinable. Pump.fun bonding-curve progress is derived from the curve account when readable.

F6 SELL

For 0.5, 1, 5, 10 and 25 SOL: a real SOL→token Jupiter quote sizes the position, then the received tokens are quoted back to SOL (slippage 300 bps). Price impact is Jupiter priceImpactPct. If no buy route exists the position is sized by price. No sell route for 1 SOL is reported as a honeypot warning.

F7 SCORE

Deterministic, no hidden weights. See the formula below.

score = max(0, 100 + sum of applied penalties). Penalties: mint authority active -25, freeze authority active -20, mutable metadata -5, top10 holders (ex-pools) >30% -15, funding cluster >15% -10, bundled launch -15, serial launcher -15, liquidity <$10k -10, 1 SOL sell impact >10% or no sell route -15, risky Token-2022 extension -20. Verdict: >=75 CLEAN, 45-74 CAUTION, <45 HIGH RISK. A factor whose data could not be fetched is marked unavailable and contributes 0.

• The public Solana RPC rate-limits heavily and does not index deep history. Bundle, dev and funding checks can be incomplete; they say so when they are.
• If the creation block is beyond 10 pages of signatures, F3 and F4 report "Creation block beyond scan depth" instead of guessing.
• LP burn status is only determinable for some pool types. Locked (not burned) LP is not detected.
• Pool and curve labels cover well-known programs. Unlabelled program-owned accounts stay in the concentration figures.
• Funding clusters rely on the first SOL transfer; exchanges or shared funders can produce false clusters.
• Jupiter quotes are a snapshot; impact can change within seconds. Token-2022 transfer fees may not be reflected in quotes.
• Heuristics can be wrong. Data, not advice. Signals can be wrong; verify the linked evidence.

• GET /api/token/[mint]/auth | holders | bundle | dev | liquidity | sell | score | external | meta
• GET /api/token/[mint]/score?light=1 (light refresh used by the watchlist)
• GET /api/search?q= (mint, link or ticker)
• GET /api/trending
• GET /api/wallet/[address]
• GET /api/prices?ids=a,b,c
• GET /api/rpc-status

Inputs are validated with Zod; errors return JSON { "error": string } with an appropriate status.