# Rug Check

> Solana token safety diligence: mint/freeze authority, LP lock/burn, top-holder concentration, RugCheck score. Read-only — run before swapping into or launching alongside any token.

- **Type:** Skill
- **Install:** `agentstack add skill-clawpump-agents-skills-rug-check`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Clawpump](https://agentstack.voostack.com/s/clawpump)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Clawpump](https://github.com/Clawpump)
- **Source:** https://github.com/Clawpump/agents-skills/tree/main/skills/rug-check

## Install

```sh
agentstack add skill-clawpump-agents-skills-rug-check
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# rug-check — Solana Token Safety

Read-only safety diligence for any Solana token mint. **Never signs anything.**
It pairs with the ClawPump MCP trade/launch tools (`swap_execute`,
`launch_token_gasless`, …) as the pre-flight that decides whether a token is
safe to touch.

Two independent sources, cross-checked:
1. **On-chain (authoritative):** Solana JSON-RPC for mint/freeze authority and
   real top-holder concentration — facts, not opinions.
2. **RugCheck (heuristic):** a community risk score + flagged risks.

Helper: `scripts/rugcheck.py`. Endpoint reference: `references/api-endpoints.md`.

## When to Use

- **Before any `swap_execute`** into an unfamiliar token.
- A user pastes a mint and asks "is this safe / is it a rug / can I ape this?"
- Before launching or buying alongside an existing token.
- Vetting a token a tracked wallet/whale just bought.

## Quick Check (do this first)

```bash
python3 ~/.hermes/skills/crypto/rug-check/scripts/rugcheck.py check 
```

This prints a consolidated verdict: authority status, top-10 concentration,
RugCheck score, and a `CLEAN / CAUTION / RUGGABLE` line with the reasons.

## Key Concepts

- **Mint authority** — if NOT revoked (non-null), the team can mint unlimited
  new supply and dilute you. Revoked (null) is the safe state.
- **Freeze authority** — if NOT revoked, the team can freeze *your* tokens so
  you can't sell. Revoked (null) is safe.
- **LP locked vs burned** — liquidity that's burned/locked can't be pulled
  (the classic "rug"). Unlocked LP is a red flag.
- **Top-holder concentration** — a few wallets holding most of the supply can
  dump on everyone. >30% top-10 is elevated, >60% is dangerous. (Some large
  holders are locked LP / CEX / vesting — verify owners before concluding.)
- **RugCheck score** — heuristic, not a guarantee. Use it as a signal, not a verdict.

## Individual Commands

```bash
# RPC authority cross-check (mint can't be inflated / frozen?)
python3 scripts/rugcheck.py authority 

# Holder concentration from on-chain largest accounts
python3 scripts/rugcheck.py holders  --top 10

# RugCheck quick summary (+ risk flags) / full report
python3 scripts/rugcheck.py summary 
python3 scripts/rugcheck.py report  
```

Raw curl equivalents (no key needed) are in `references/api-endpoints.md`.

## Presenting Results

Lead with the verdict line, then the evidence:

> ⚠️ **CAUTION** — mint authority is still ACTIVE (supply can be inflated) and
> the top 10 wallets hold 41%. RugCheck score 1,800.
> Mint/freeze: mint ACTIVE 🔴 / freeze revoked ✅. I'd size small or skip.

Always show percentages and the score band. Never auto-execute a trade off a
"clean" result — **confirm with the user** (and follow the ClawPump
confirmation rules) before any `swap_execute` / launch.

## Rate Limits & Keys

- RugCheck public endpoints are rate-limited (best-effort; brand-new tokens may
  have no report yet — fall back to the on-chain authority/holder check).
- Solana RPC: defaults to the public `api.mainnet-beta.solana.com`. For heavier
  use, set `SOLANA_RPC_URL` or `HELIUS_API_KEY` (free at dev.helius.xyz) — the
  script picks them up automatically.

## Pitfalls

- A "clean" mint can still dump — LP unlocked, insider wallets, or social
  manipulation aren't fully captured here. This is risk *reduction*, not a guarantee.
- `getTokenLargestAccounts` returns token *accounts*; a big one may be locked
  LP, a CEX, or a vesting contract — note that rather than calling it a whale.
- RugCheck score is heuristic and can disagree with the on-chain facts — trust
  the on-chain authority check over the score when they conflict.
- This is **not financial advice** and never a reason to skip user confirmation.

## Notes for Hermes

- Use the `terminal` tool with `python3`/`curl` (not web_extract).
- `HELIUS_API_KEY` / `SOLANA_RPC_URL` flow from `~/.hermes/.env` automatically.
- Read-only: this skill complements — never replaces — the ClawPump MCP
  (`mcp_clawpump_*`) trade and launch tools.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Clawpump](https://github.com/Clawpump)
- **Source:** [Clawpump/agents-skills](https://github.com/Clawpump/agents-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-clawpump-agents-skills-rug-check
- Seller: https://agentstack.voostack.com/s/clawpump
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.