# Seneschal Counter-MEV Risk Feed

> Seneschal Counter-MEV Risk Feed is a paid API for AI agents from api.seneschal.space, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-14).

Returns a risk-scored feed of malicious ERC-20 approval spenders, honeypot/bait tokens, and dangling live approvals detected on Ethereum mainnet

## Facts

- Endpoint: GET https://api.seneschal.space/v1/premium/counter-mev
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/seneschal-counter-mev-risk-feed-da7a21cd
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_a_8AGRSC4yMePf5ApVPzb

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability seneschal-counter-mev-risk-feed-da7a21cd
```

Example prompt: Pull the latest counter-MEV risk feed from Seneschal — show me the top 50 highest-risk entries across malicious spenders and honeypot tokens, only those scoring above 70.

## When to prefer this

Use this endpoint when you need real-time, mainnet-sourced threat intelligence specifically about ERC-20 approval exploits, honeypot tokens, and MEV-related wallet-drain patterns. Prefer it over generic token scanners when you need pre-scored, multi-category risk data with granular score factors rather than simple blocklists. Best for DeFi security agents, wallet protection systems, or trading bots that need to screen approvals and tokens before execution.

## Known failure modes

- Payment not provided or insufficient (402 Payment Required)
- Invalid category value returns 400 or empty result
- min_score out of 0-100 range may return 400
- limit exceeding 1000 may be capped or rejected
- Service may return stale data if mainnet scanner is lagging
- Empty arrays returned if no entries meet the min_score threshold

## How this service works

Counter-MEV / approval-risk feed: the full risk-scored set of (1) malicious spenders harvesting ERC-20 approvals to transferFrom-drain them (the JaredFromSubway $7.5M pattern), (2) honeypot/bait tokens — fake fWETH/fUSDC wrappers, fee-on-transfer and sell-revert traps, (3) live dangling approvals at risk. Each row ships its flags + score factors; sourced from our own mainnet scanners. Filters: ?category=spenders|tokens|approvals|bleeding_bots&min_score&limit.

## Output

A JSON object with an as_of_ms timestamp and arrays of risk-scored records per category: malicious_spenders (addresses harvesting ERC-20 approvals), risky_tokens (honeypots, fake wrappers, fee-on-transfer/sell-revert traps), live dangling approvals, and bleeding bots — each row includes its risk score and the contributing score factors.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "properties": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "as_of_ms": 1765532000000,
  "risky_tokens": [
   {
    "flags": [
     "lookalike_symbol",
     "event_balance_mismatch"
    ],
    "symbol": "fWETH",
    "address": "0xf00…",
    "risk_band": "critical",
    "risk_score": 92
   }
  ],
  "malicious_spenders": [
   {
    "flags": [
     "transferfrom_sweeps",
     "drains_bluechips",
     "mass_approvals"
    ],
    "address": "0xbad…",
    "risk_band": "critical",
    "risk_score": 97,
    "distinct_victims": 31
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/seneschal-counter-mev-risk-feed-da7a21cd/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.seneschal.space](https://www.zero.xyz/host/api.seneschal.space/llms.txt)