What Is a Rug Check API? How Automated Security Tools Work Behind the Scenes

From Address to Risk Score in Seconds

When you paste a Solana token address into Hannisol and receive a comprehensive risk assessment in under two seconds, the speed might suggest a simple lookup. The reality is a multi-source data pipeline combining four to six separate API calls, on-chain data parsing, and rule-based scoring logic — all executing in parallel to return a result faster than any manual analysis could achieve.

The Data Sources in a Token Security Pipeline

Solana RPC (Remote Procedure Call) nodes: The foundation of all on-chain analysis. RPC nodes provide real-time access to the blockchain's state — token account balances, mint authority settings, program ownership, transaction history. Hannisol uses Helius RPC for high-throughput reliable access to Solana's blockchain data.

GoPlus Security API: A specialized blockchain security data provider that maintains continuously updated databases of known scam contracts, honeypot patterns, and security risk flags across multiple chains including Solana. GoPlus analyzes token contract code, ownership structures, and historical behavior patterns against its threat database.

RugCheck API: A Solana-specific security scanner that analyzes token program configurations (mint authority, freeze authority, metadata mutability), holder distribution, liquidity status, and flags tokens against known rug pull pattern databases.

DexScreener API: Provides market data — current price, trading volume, liquidity pool depth, market cap, and token age. This data feeds both the risk assessment (thin liquidity = higher risk) and the informational display.

RDAP (Registration Data Access Protocol): For tokens with associated websites, RDAP queries domain registration data to verify website age. A token claiming two years of development but whose website domain was registered last week is a red flag.

How Scores Are Calculated

Each data source contributes signals that are evaluated against a rule set. Examples of what each signal contributes to the composite risk score:

• Mint authority not revoked: High risk — team can print unlimited tokens at any time
• Freeze authority not revoked: Medium-high risk — team can freeze any holder's tokens
• Top 10 holders control >80%: High concentration risk
• Liquidity unlocked: Medium risk — team can pull liquidity at any time
• Token age < 24 hours: Elevated risk — insufficient track record
• No trading volume in 24h: Abandonment risk
• GoPlus honeypot flag: Critical risk — confirmed inability to sell

Individual risk signals are weighted and combined into a composite safety score. Hannisol's scoring system also applies the HASS (Hannisol Advanced Scoring System) which layers contextual judgment on top of raw signal weights to produce more nuanced results than a simple sum.

Why Multiple Sources Beat Any Single Source

No single data source has complete coverage. GoPlus may flag a confirmed scam that RugCheck hasn't indexed yet. RugCheck may catch a Solana-specific program vulnerability that GoPlus doesn't analyze. On-chain RPC data catches real-time changes (like a team revoking mint authority today) that might lag in third-party databases. Combining sources with cross-validation eliminates the blind spots each individual source has.

This is why Hannisol's multi-source approach produces materially more reliable results than any single-API security checker, and why results should still be treated as a starting point for your own judgment rather than an infallible verdict.