RMI Scanner — 70+ Security Engines Across 16 Chains
Live at rugmunch.io — 70+ security engines across 16 chains. Explainable risk scores, wallet forensics, whale tracking, AI investigation, pay-per-call via x402.
The scanner we needed when $CRM v1 launched. Built from that experience. Live today. Free trials on every tool.
70+ security engines · 16 chains · 835 API routes · pay-per-call from $0.01. No subscription. No API key. Your wallet signature is your account.
Rug Munch Intelligence (RMI) is a suite of products that work together to protect retail crypto investors: a real-time token risk scanner with a live Telegram bot, on-chain visualization tools, a crypto-native AI agent that learns from every scam, and an open payment protocol for autonomous AI-to-API transactions. Every piece is open-source. Every piece is self-hostable. Free daily scans for the community. Premium for power users. Enterprise for teams.
The Crypto AI Agent
RMI ships with a specialized crypto AI agent powered by Retrieval-Augmented Generation (RAG v2) that continuously trains on new scam patterns, honeypot techniques, and rug pull forensics. It gets smarter with every token scanned.
What makes it different from general-purpose AI:
| Feature | Generic AI | RMI Agent |
|---|---|---|
| Training data | Internet text up to a cutoff date | Continuous RAG pipeline ingesting live scam reports, token analyses, and on-chain evidence |
| Token awareness | Zero — hallucinates contract addresses | Queries live on-chain data, knows real addresses and labels |
| Scam detection | Pattern matching on text descriptions | Correlates on-chain behavior (bundles, holder patterns, funding traces) with scam databases |
| Self-improvement | Static model weights until next release | RAG knowledge base grows with every /ragscan and investigation, compounding over time |
| Tool access | None | Native MCP tools: scan tokens, label addresses, check trending, fetch prices, run DD reports |
| Payment | Requires human credit card | Pays for premium API access autonomously via x402 on-chain USDC settlement |
| Interface | Chat only | Telegram bot (25+ commands), REST API, MCP server for other AI agents, web dashboard |
The RAG Pipeline:
- Ingests scam reports from 8+ sources (Scam Sniffer, Honeypot.is, GoPlus, OpenSanctions, CryptoScamDB, ChainAbuse, internal investigations)
- Vectorizes and indexes into Qdrant for semantic search
- Connects to Neo4j wallet relationship graph (169K+ labeled nodes)
- Routes queries to the cheapest available LLM provider (7+ providers, auto-fallback)
- Returns answers with source citations — every claim is traceable
Try it now: rugmunch.io or @rugmunchbot on Telegram — /ask <question> or /ragscan <address>.
How It Works
When you submit a token address, the scanner fires four live HTTP calls in parallel:
| Check | Source | What It Detects |
|---|---|---|
| Market Data | DexScreener API | Price, market cap, FDV, 24h volume, liquidity, price changes (1h/24h/7d), pair address, DEX, social links |
| Safety (EVM) | GoPlus Security API | Honeypot status, buy/sell tax, mintable supply, blacklist capability, ownership renounced, LP lock percentage, top 10 holder concentration |
| Honeypot Fallback | Honeypot.is API | Secondary honeypot check for EVM tokens when GoPlus returns no data |
| Bundle & Depth | RMI Backend | Bundle detection on launch, fresh wallet concentration, deployer address history, connected wallet tracing |
The scanner auto-detects chain type (EVM 0x... vs Solana base58) and applies the appropriate checks. Results return in under 3 seconds.
Risk Scoring
Each threat adds points to a cumulative score, capped at 100:
| Threat | Score | Signal |
|---|---|---|
| Honeypot detected | +40 | You cannot sell. Contract traps tokens. |
| Bundle activity on launch | +20 | Coordinated wallets bought at block zero. |
| Mintable supply | +20 | Owner can create new tokens at any time. |
| Liquidity under 2% of market cap | +20 | Extremely thin pool. One sell can crash it. |
| Contract not verified | +15 | Source code is hidden. Cannot audit. |
| Owner can blacklist addresses | +15 | You can be prevented from selling. |
| High sell tax (over 10%) | +15 | Selling costs you 10%+ of your position. |
| LP lock under 50% (mcap over $10K) | +15 | Liquidity can be pulled without warning. |
| High buy tax (over 10%) | +10 | Entering costs you 10%+ upfront. |
| Ownership not renounced | +10 | Owner retains admin control over contract. |
| Suspicious volume/mcap ratio (over 5x) | +15 | Volume appears manufactured. |
| Fresh wallet concentration (over 50%) | +10 | Most holders are brand-new wallets. |
The safety score is 100 - risk_score. Scores are additive, transparent, and every point is traceable to a specific check.
Wallet Forensics
The wallet scanner traces funding sources, estimates PnL, identifies connected wallets, and flags known scam addresses using RMI’s federated labeling system — ~295k curated labels from 6+ sources queried in parallel with graceful degradation.
@rugmunchbot — Telegram Bot
Status: Live. The full scanning stack runs in chat, backed by the same engines as the platform.
| Command | What It Does |
|---|---|
/start |
Welcome message, referral tracking, quick-access buttons |
/scan <address> |
Full security scan: price, liquidity, taxes, honeypot, bundles, risk score |
/quick <SYMBOL> |
Instant price check from DexScreener |
/rugcheck |
Educational rug-pull red/green flag checklist |
/wallet <address> |
Forensic wallet analysis: PnL, funding source, connected wallets, age |
/ta <address> |
Technical analysis and trading signals |
/compare <a> <b> |
Side-by-side token comparison |
/dd <address> |
Comprehensive due diligence report |
/ask <question> |
AI Copilot — natural language search with source citations |
/buy /sell /swap |
Generate DEX links with referral codes (Jupiter, Hyperliquid, Banana Gun, GMGN, etc.) |
/price /mc /holders |
Quick DexScreener lookups |
/trending |
Hot tokens right now across all tracked chains |
/watch /unwatch /watchlist |
Personal token watchlist with alerts |
/alerts |
Price movement and activity notifications |
/news |
Aggregated crypto news feed |
/ragscan <address> |
AI-powered scam intelligence from RMI’s knowledge base |
/refer /account /pricing /topup |
Referral system with fraud detection, account management, tiered subscriptions |
/scamschool |
Educational content — learn to spot scams before they spot you |
Bot capabilities:
- Inline scanning — paste a contract address anywhere in Telegram, get an instant scan result
- Tiered subscriptions: Free (limited scans/day), Premium (from $29.99/mo)
- Telegram Stars payments for upgrades
- Referral program with anti-fraud detection
- Spam protection with auto-blacklist and scam address checking
- Moderation suite for community groups
RugMaps — On-Chain Visualization
Status: Live at rugmunch.io/rugmaps.
RugMaps visualizes the on-chain relationships that determine whether a token is safe.
Wallet Clustering. Identify coordinated wallet groups that buy tokens together at launch. The scanner traces funding sources to find wallets controlled by the same entity — even when they use fresh addresses.
Fund Flow Tracing. Map exactly where liquidity came from and where it goes. See every hop from CEX withdrawal to deployer wallet to liquidity pool to exit. The full path, visualized.
Deployer History. For any wallet address, see every token it has ever deployed, every contract it has interacted with, and whether those tokens survived or rugged. A reputation graph built from on-chain evidence.
Holder Distribution. Interactive treemap of token holders. Instantly see if the top 10 wallets hold 90% of supply. Click any wallet to trace its history.
Label Propagation. RMI maintains ~295k curated address labels across Ethereum, BSC, Arbitrum, Polygon, and Solana. Known exchange wallets, known scam addresses, MEV bots, bridge contracts, DeFi protocols — all labeled. Labels propagate through Neo4j graph relationships to surface hidden connections.
RugCharts — Market Analytics
Status: Live at rugmunch.io/rugcharts.
RugCharts provides the market context the scanner needs to assess risk — and the charts the community needs to make informed decisions.
What It Will Do
Token Analytics. Price, volume, liquidity, holder count, and transaction history for any token. Time-series data with customizable date ranges.
Trending Discovery. What’s moving right now? Sort by volume, price change, new holders, or social engagement. The scanner uses this data to prioritize which tokens to flag.
Cross-Chain View. Ethereum, BSC, Arbitrum, Polygon, Solana — all in one dashboard. Compare activity across chains. Spot capital rotation in real time.
News & Sentiment Overlay. Market data overlaid with news mentions, social volume, and sentiment scoring from RMI’s intelligence feed. See not just what’s moving, but why.
API Access. All chart data available through the same REST API. Build your own dashboards. Integrate into your own tools. MIT licensed.
x402 MCP — AI Agent Payments
Status: Live at mcp.rugmunch.io.
x402 is an open payment protocol that lets AI agents pay for API access using on-chain settlement. RMI implements x402 as its native monetization layer — every API call, every premium scan, every intelligence report flows through x402.
What It Does
HTTP 402 Payment Required. When an AI agent (or human) hits a paid RMI endpoint, they receive an HTTP 402 response with a payment invoice. The agent pays on-chain, presents the transaction hash, and the gateway verifies and serves the response. All in one request cycle.
MCP Server Integration. RMI exposes its entire scanner, labeler, and intelligence feed as MCP tools. AI agents (Claude, Hermes, Cursor, opencode) can call rmi_scan_token, rmi_label_address, rmi_trending_tokens, rmi_news_feed and more. Paid tools automatically trigger x402 invoices when the free tier is exhausted.
Supported Chains for Settlement. USDC on Solana, Base, Arbitrum, and Ethereum. Settlement finality in under 2 seconds on Solana, under 15 seconds on EVM L2s.
Free Tier. Every API key gets 100 free scans per day. Sufficient for individual use. Power users and AI agents upgrade through x402 credits.
Transparency. All payments are on-chain. All invoices are signed. Anyone can audit the payment flow. No trust required.
MCP Tools Available:
rmi_scan_token— Full risk scan with all checksrmi_wallet_scan— Forensic wallet analysisrmi_label_address— Address label lookup (~295k curated labels)rmi_trending_tokens— Hot tokens across all tracked chainsrmi_token_price— Live price from DexScreenerrmi_news_feed— Aggregated crypto newsrmi_due_diligence— Comprehensive DD reportrmi_compare_tokens— Side-by-side comparisonrmi_ask_rag— AI-powered scam intelligence query
Architecture
All four products share the same backend. One codebase. One API. One deployment.
Data Sources (10+ external providers, queried in parallel):
- DexScreener — market data, pairs, social links
- GoPlus Security — contract safety, taxes, honeypot detection
- Honeypot.is — secondary honeypot verification
- Helius — Solana transaction parsing, bundle detection
- Etherscan/Blockscout — contract verification, source code
- CoinGecko — historical prices, market caps
- Jupiter — Solana liquidity and quote simulation
- Birdeye — Solana token metadata
- 6 label sources — ~295k curated address labels across 5 chains
Database Layer:
- Postgres — primary storage, user accounts, scan history
- Redis — cache layer, rate limiting, Celery queue
- Neo4j — wallet relationship graph (169K+ labeled nodes)
- ClickHouse — analytics, ~295k curated address labels, time-series data
- DuckDB — embedded Parquet querying for label CSVs
- Qdrant — vector embeddings for RAG-powered scam intelligence
AI Integration:
- RAG v2 — semantic search over scam reports, token analyses, and on-chain evidence
- AI Copilot — natural language queries with source citations
- MCP server — exposes scanner tools to external AI agents
- LLM provider routing — auto-selects cheapest available AI provider
The Investigation
When RMI ships, it includes the full investigation into $CRM v1. Every wallet. Every transaction. The on-chain evidence that proves exactly how the manipulation occurred — delivered by the same scanner that would have caught it in real time.
The proof of the tool is the investigation. The investigation proves the claim.
For Developers
git clone https://git.rugmunch.io/RugMunchMedia/rmi-backend.git
cd rmi-backend
docker compose up -d
# POST /scanner/scan with a token address
# Full docs: https://docs.rugmunch.ioThe scanner API is fully open. Self-host it. Audit it. Build on it. All 290+ Python files, all 4 database backends, all 10+ external provider integrations — documented, containerized, and licensed MIT.