# x402.ottoai.services Token Security Audit

> x402.ottoai.services Token Security Audit is a paid API for AI agents from x402.ottoai.services, paid per call via x402, $0.001/call, status unknown (last checked 2026-10-11).

Performs a GoPlus-powered security audit on a token contract, detecting honeypots, hidden mints, rug pull risks, tax mechanics, and holder concentration across major EVM chains.

## Facts

- Endpoint: GET https://x402.ottoai.services/token-security?utm_source=zero.xyz
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/x402-ottoai-services-00496cf3
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_UMSlUyKKa6FDZCYpq_LtS

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability x402-ottoai-services-00496cf3
```

Example prompt: Can you run a GoPlus security audit on this token contract 0xdAC17F958D2ee523a2206206994597C13D831ec7 on Ethereum (chain 1) and tell me if it's a honeypot, has any rug pull risks, hidden mints, or suspicious tax settings?

## When to prefer this

Use this endpoint when an agent needs to perform due diligence on an ERC-20 token before a swap or investment, specifically when honeypot detection, hidden mint risks, rug pull scoring, tax analysis, and holder concentration are all needed in a single call. Prefer this over generic contract readers when a human-readable security verdict is required across multiple risk dimensions.

## Known failure modes

- Invalid or non-existent contract address returns failed status
- Unsupported chain ID returns error
- Token not indexed by GoPlus returns incomplete data
- Network timeout on slow chains
- Missing required address parameter returns validation error

## How this service works

Token security scanner — is this token safe to buy? Honeypot, rug-pull, and scam detection for any token contract — flags can't-sell traps, hidden mints, malicious buy/sell taxes, and holder concentration. Powered by GoPlus across 8 chains.

## Output

Returns a structured security report with a status field (success/failed) and a detailed report string covering honeypot detection, hidden mint risks, rug pull indicators, buy/sell tax analysis, and holder concentration data for the specified token contract.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {
   "chain": "1",
   "address": "0xdAC17F958D2ee523a2206206994597C13D831ec7"
  }
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "address"
     ],
     "properties": {
      "chain": {
       "type": "string",
       "description": "Chain ID or name, case-insensitive. IDs: 1 (Ethereum), 10 (Optimism), 56 (BSC), 137 (Polygon), 196 (X Layer), 8453 (Base), 42161 (Arbitrum), 43114 (Avalanche). Names also accepted: ethereum/eth, optimism, bsc/bnb, polygon/matic, xlayer/x-layer, base, arbitrum, avalanche/avax. Default: 8453 (Base)."
      },
      "address": {
       "type": "string",
       "description": "Token contract address (0x-prefixed)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "required": [
      "status",
      "data",
      "meta"
     ],
     "properties": {
      "data": {
       "description": "Report object on success, error string on failure"
      },
      "meta": {
       "type": "object",
       "required": [
        "generatedAt",
        "degraded",
        "sourceHealth"
       ],
       "properties": {
        "degraded": {
         "type": "boolean"
        },
        "generatedAt": {
         "type": "string"
        },
        "sourceHealth": {
         "type": "object"
        },
        "stalenessSec": {
         "type": [
          "number",
          "null"
         ]
        }
       },
       "description": "Freshness. generatedAt = when we built this response. stalenessSec = age of our cached snapshot, absent on live pass-throughs. dataAsOf = vintage of the observations. degraded = an older good version was served."
      },
      "report": {
       "type": "string",
       "description": "DEPRECATED mirror of data.report — kept so pre-2026-08-10 integrations keep working."
      },
      "status": {
       "enum": [
        "success",
        "failed"
       ],
       "type": "string"
      }
     }
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/x402-ottoai-services-00496cf3/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402.ottoai.services](https://www.zero.xyz/host/x402.ottoai.services/llms.txt)