# Hermes x402 Token Security Analyzer

> Hermes x402 Token Security Analyzer is a paid API for AI agents from api.zlovev.com, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-18).

Analyzes an ERC-20 token contract on Base or Ethereum for security signals including mintability, pausability, proxy structure, and ownership status.

## Facts

- Endpoint: GET https://api.zlovev.com/api/token/security
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-18
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/hermes-x402-token-security-analyzer-ff7edfa4
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_fMRPiabHRTN3cbaA4ZmI5

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability hermes-x402-token-security-analyzer-ff7edfa4
```

Example prompt: Can you run a security check on the token contract 0x4ed4E862860beD51a9570b96d89aF5E1B0Efefed on Base — I want to know if it's mintable, pausable, whether ownership is renounced, and if it's a proxy contract?

## When to prefer this

Choose this endpoint when you need on-chain smart contract security analysis for ERC-20 tokens on Base or Ethereum mainnet — particularly for detecting mint/pause/proxy risk patterns — without needing an API key or account. It is ideal for AI agents that pay per-call via USDC x402 micropayments. Prefer this over full audit services when you need quick automated signal extraction rather than a human audit report.

## Known failure modes

- Invalid or non-contract address returns an error or is_contract: false
- Address not found on specified chain returns an empty or error response
- Malformed address (not 0x + 40 hex) rejected by input validation
- Rate limiting or payment failure results in 402 response requiring USDC payment on Base
- Unverified or minimal bytecode contracts may yield incomplete selector scan results

## How this service works

Pay-per-call data API for AI agents. No API key, no account, no signup — pay USDC on Base (eip155:8453) per request; free /api/meta lists all 22 endpoints. One call each: web page to LLM-ready text and link previews; China A-share quotes and limit-up pool; Chinese text and pinyin; Base/Ethereum on-chain reads (address, token, ERC-20 balances, tx, blocks, transfer history, gas price in USD); NFT records (collection, owner, and ipfs:// tokenURI resolved through public gateways); full-page screenshots; email verification without sending mail; ENS forward/reverse resolution; smart-contract due diligence (ABI, verified source, proxy); token security facts (owner, renounced ownership, paused, bytecode capability selectors); domain dossier (RDAP, DNS, TLS certificate, HTTP facts, hosting network).

## Output

Returns a JSON object with: ERC-20 metadata (symbol, decimals, total supply), security signals array with severity levels (attention/notice) for features like mintability and pausability, proxy detection results (EIP-1967 implementation address if applicable), ownership info (owner address, whether renounced, whether owner is a contract), a function selector scan summary (how many selectors checked and matched), contract code size, and the network identifier.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "address"
     ],
     "properties": {
      "chain": {
       "enum": [
        "base",
        "eth"
       ],
       "type": "string",
       "description": "base = Base mainnet (eip155:8453), eth = Ethereum mainnet (eip155:1). Default base"
      },
      "address": {
       "type": "string",
       "description": "Token contract address (0x + 40 hex) on the chosen chain"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "erc20": {
   "symbol": "DEGEN",
   "decimals": 18,
   "is_erc20": true,
   "total_supply": "36997000000"
  },
  "pause": {
   "paused": false,
   "can_pause": true
  },
  "proxy": {
   "is_proxy_like": false,
   "eip1967_implementation": null
  },
  "address": "0x4ed4…efed",
  "network": "eip155:8453",
  "signals": [
   {
    "id": "mintable",
    "level": "attention",
    "selectors": [
     "0x40c10f19"
    ]
   },
   {
    "id": "pausable",
    "level": "notice",
    "selectors": [
     "0x8456cb59"
    ]
   }
  ],
  "ownership": {
   "owner": "0x…",
   "renounced": false,
   "owner_source": "owner()",
   "owner_is_contract": false
  },
  "is_contract": true,
  "selector_scan": {
   "checked": 45,
   "matched": 12
  },
  "code_size_bytes": 9999
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/hermes-x402-token-security-analyzer-ff7edfa4/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.zlovev.com](https://www.zero.xyz/host/api.zlovev.com/llms.txt)