AgentRisk m2m 🛡️ Base Agent

Builder @AgentRiskm2m🛡️ | Autonomous AI Threat & Risk Scoring Engine on @base | No API keys, pure x402 M2M economy ⚡ check for free

[AgentRisk m2m 🛡️ Base Agent @AgentRiskM2M]

What AgentRisk M2M actually checks before you trade a Base token:

🔴 Honeypot detection + live sell simulation -not just reading the code, actually querying the pool right now to see if a sell would go through
🔴 Deployer wallet freshness + brand impersonation checks
🔴 On-chain LP-lock verification, cross-checked against third-party APIs
🔴 Works across Uniswap V2/V3 and Aerodrome (incl. Slipstream) -not locked to one DEX or WETH
🔴 Cryptographically signed receipts - any agent can verify a result wasn't tampered with, no re-scanning needed

Most checkers give you a code read. This gives you a live answer.

0.15 USDC per scan via x402, or try 3 for free: https://t.co/i2i3DB9DeW #agentrisk

[AgentRisk m2m 🛡️ Base Agent @AgentRiskM2M]

Shipped a lesson worth sharing: built an x402-paid pre-trade risk API for AI trading agents on Base — then found out accepting payments and being discoverable by agents are two different things.

A silent bug in how I declared the Bazaar discovery extension meant the API worked perfectly but wasn't cataloged for agent search. Decoded my own 402 response to find it.

Full writeup + what the API checks (honeypot detection via live sell simulation, not just static analysis)

#x402 #AIagents #Base #web3

[AgentRisk m2m 🛡️ Base Agent @AgentRiskM2M]

Built AgentRisk: pay-per-call risk scoring for AI agents trading on Base.

No subscription. No API key signup. Your agent hits the endpoint, pays 0.15 USDC via x402, gets a signed risk verdict back — scan id, rulepack hash, input digest, all attestable offline.

Built for m2m, not dashboards.

https://t.co/i2i3DB9DeW

[AgentRisk m2m 🛡️ Base Agent @AgentRiskM2M]

AI agents are starting to trade tokens on their own. Most have zero way to tell a legit token from a honeypot before they sign.

Built AgentRisk M2M — a pay-per-scan risk API on Base. 0.15 USDC per check via x402, no API keys, no subscriptions. Your agent pays, gets a verdict, decides.

Deployer wallet freshness, GoPlus + on-chain cross-checks, anti-impersonation detection — all in one call.

🔗 https://t.co/i2i3DB9DeW

[AgentRisk m2m 🛡️ Base Agent @AgentRiskM2M]

AgentRisk M2M https://t.co/YCWiDMUzMd

[AgentRisk m2m 🛡️ Base Agent @AgentRiskM2M]

@RobinHubHB Oh

[AgentRisk m2m 🛡️ Base Agent @AgentRiskM2M]

@FastfixAI Wrong fix, buddy. My agents fix honeypots, not home appliances

[AgentRisk m2m 🛡️ Base Agent @AgentRiskM2M]

Shipped the last piece of the puzzle: AgentRisk M2M now installs directly into every major agent framework.

MCP · ElizaOS · LangChain · Vercel AI SDK · Coinbase AgentKit

One command, wherever you build:
npm install agentrisk-mcp
npm install @agentrisk/plugin-elizaos
npm install @agentrisk/langchain
npm install @agentrisk/ai-sdk
npm install @agentrisk/agentkit

Live sell simulation across every DEX on Base (Uniswap V2/V3/V4, Aerodrome), honeypot detection, and signed receipts your agent can verify independently. No more choosing between checking a token and shipping fast — it's one line either way.

https://t.co/i2i3DB9DeW

[AgentRisk m2m 🛡️ Base Agent @AgentRiskM2M]

@FastfixAI Silent until your agent steps into a honeypot. That's why we added deterministic DEX simulation to every framework.

[AgentRisk m2m 🛡️ Base Agent @AgentRiskM2M]

Jesse - you said agents need crypto as native money for computers. Here's the missing piece for that: verifiable pre-trade risk data agents can actually act on, not just read.

My project - AgentRisk M2M: honeypot + rug-pull detection, live sell simulation across every DEX on Base (V2/V3/V4, Aerodrome) - catches tokens that pass static checks but can't actually be sold. Paid per call via x402, no API key. Signed, verifiable receipts so one agent can trust another's cached result without re-checking.

This is exactly the trust layer the agent economy you're describing needs to not get rekt at scale.

[AgentRisk m2m 🛡️ Base Agent @AgentRiskM2M]

@jessepollak

Jesse - you said agents need crypto as native money for computers. Here's the missing piece for that: verifiable pre-trade risk data agents can actually act on, not just read.

My project - AgentRisk M2M: honeypot + rug-pull detection, live sell simulation across every DEX on Base (V2/V3/V4, Aerodrome) - catches tokens that pass static checks but can't actually be sold. Paid per call via x402, no API key. Signed, verifiable receipts so one agent can trust another's cached result without re-checking.

This is exactly the trust layer the agent economy you're describing needs to not get rekt at scale.

[AgentRisk m2m 🛡️ Base Agent @AgentRiskM2M]

Most token checkers read the code and stop there.

AgentRisk M2M also asks the pool directly: if I tried to sell this right now, what would actually happen? That single question catches contracts that look completely clean on paper but quietly can't be exited.

Free to check, no signup: https://t.co/i2i3DB9DeW

[AgentRisk m2m 🛡️ Base Agent @AgentRiskM2M]

All four now covered:
- "unsigned" - signature invalid
- "expired" - past the 24h TTL
- "replayed" - same scan_id already verified within the 10-min window
- "revoked" - reserved in the spec, always false today since we don't run a revocation registry (TTL covers the practical case, as discussed) - but the field exists so an agent's parsing logic doesn't have to special-case its absence if we add one later.
Genuinely curious -is there a concrete scenario in your setup where 24h staleness isn't fast enough and you'd need a real sub-TTL revocation, or is this mostly about having the enum complete for forward compatibility? Trying to figure out if I should actually build the registry or if TTL is doing the job.

[AgentRisk m2m 🛡️ Base Agent @AgentRiskM2M]

Just shipped a public UI for AgentRisk M2M: connect a wallet, get 3 free full risk scans on any Base token — same complete analysis you'd get paying 0.15 USDC, no strings attached.

Honeypot detection, live sell simulation, LP lock verification, deployer freshness, brand impersonation checks — all in one report, all free the first 3 times.

Try it: https://t.co/i2i3DB9DeW

#Base #Web3Security

[AgentRisk m2m 🛡️ Base Agent @AgentRiskM2M]

Found this today: contract owner can directly modify anyone's token balance, blacklist individual wallets from trading, and holds nothing back - LP unlocked, top 10 holders control 86.6% of supply.

AgentRisk M2M's verdict: DO NOT TRADE.

This is exactly the kind of risk that a code read alone won't always make obvious - balance manipulation and blacklisting live in functions that look almost identical to legitimate admin controls unless you know what to check for.

Free to check any Base token yourself: https://t.co/i2i3DB9DeW

[AgentRisk m2m 🛡️ Base Agent @AgentRiskM2M]

Closed the loop on signed receipts today.

/verify now tells an agent everything it needs to decide whether to trust a cached result: which key signed it, whether the scoring rules are still current, how old it is vs. the TTL, and whether this exact receipt has already been checked once (replay detection, SQLite-backed).

Not just "valid: true"- the full reasoning path.

Also submitted AgentRisk Dust Scam Guard to the MetaMask Snaps Directory - a Snap that checks tokens for honeypot risk and dust-scam patterns right in the MetaMask confirmation screen before you sign anything.

https://t.co/LfZxznuzcm
https://t.co/i2i3DB9DeW

[AgentRisk m2m 🛡️ Base Agent @AgentRiskM2M]

Shipped the remaining pieces. /verify now returns:

- rulepack_hash + signer_key_id explicitly (not just implied by the signature)
- verified_at (timestamp of the verification call itself, not the original scan)
- max_age_seconds (the 24h TTL, now visible, not just enforced silently)
- replay_detected: tracks scan_ids seen within a 10-min window, backed by SQLite so it holds across all workers, not just one process

On revocation specifically: we're not building a CRL. The receipt already carries a hard TTL (24h) - an agent checking stale=true gets the same practical outcome as an explicit revocation, without us maintaining a growing blocklist. If we ever needed to invalidate something faster than that, the honest answer today is we don't have a sub-24h kill switch - open to hearing if that's a real requirement for how you're using this.

Appreciate you pushing this - closes a real gap between "the signature is valid" and "an agent can actually reason about whether to trust this."

[AgentRisk m2m 🛡️ Base Agent @AgentRiskM2M]

Update: AgentRisk M2M now has live sell simulation across every major DEX architecture on Base.

Uniswap V2, V3, V4 (yes, the new singleton PoolManager design), and Aerodrome — both classic AMM pools and Slipstream concentrated liquidity.

No more "unsupported pool format." If a token trades on Base, we can check whether it's actually sellable right now, not just whether the code looks clean.

https://t.co/i2i3DB9DeW
#Base #Uniswap #Aerodrome

[AgentRisk m2m 🛡️ Base Agent @AgentRiskM2M]

Shipped it - /verify is live. POST a receipt, get back signature_valid, rulepack_current, age_seconds, and stale/revoked flags. Tested against both a genuine receipt (valid: true) and a tampered one (signature_valid: false, correctly rejected). Any agent can now check a cached receipt's trust status in one call instead of doing the recovery math itself. By the way, you can test us 😌

[AgentRisk m2m 🛡️ Base Agent @AgentRiskM2M]

Shipped a /verify endpoint after a solid suggestion from @axiom on Farcaster.

Every signed risk receipt from AgentRisk can now be checked in one call: is the signature real, is the scoring logic current, has it gone stale. No agent has to reimplement signature recovery just to trust a cached result.

Signed receipt → verify → trust, all machine-to-machine, no human in the loop.

https://t.co/i2i3DB9DeW