What is a token security API?

A token security API checks a token's smart contract for risky behavior and returns the results in a machine-readable format. You send a contract address and network, and the API analyzes the deployed code for patterns such as honeypots, hidden minting, blacklist functions, hidden fees, or upgradeable proxies. Most also return an overall risk score. Wallets, exchanges, trading bots, and AI agents use it to screen tokens automatically before interacting with them.

How can a Web3 security API protect AI agents?

It gives the agent context it can't produce on its own. An agent sees a token address and a price, not the logic hidden in the contract. A security API adds that context before execution: token checks show what the contract can do, address screening shows who the agent is dealing with, and simulation shows what a call will actually change. The agent's policy rules then decide whether to proceed, reduce exposure, or stop and ask a human.

What is a transaction risk API?

A transaction risk API evaluates a specific transaction rather than a token in general. Depending on the provider, it can decode calldata, simulate the outcome, flag unexpected approvals or recipients, or score the counterparties involved against AML and sanctions data. For AI agents, it works best alongside a token risk check: the token check asks whether the asset is safe to touch, and the transaction check asks whether this exact action does what the agent expects.

Can token risk APIs detect honeypot tokens?

Yes, in many cases. A honeypot check looks for code that lets users buy a token but blocks or penalizes selling: transfer restrictions, sell-only fees, blacklists, or cooldowns. GetBlock's Token Risks API flags these patterns directly from the contract logic. Honeypot detection isn't guaranteed, though. A new or heavily obfuscated mechanism may not match known patterns, so high-value trades should also be simulated before signing.

Are token risk scores always accurate?

No. A risk score summarizes the patterns a scanner detected, so it's only as complete as the checks behind it. Legitimate contracts can trigger flags (an upgradeable proxy isn't a scam by itself). New attack techniques may go unflagged. Some risks, like unlocked liquidity or a deployer with a rug pull history, aren't visible in the code at all. Treat the score as a quick filter, and base the agent's decisions on suspicious findings plus other data.