The FoxD Trading Platform, explained

1. Overview

FoxD is a multi-chain trading platform built around one idea: the earliest minutes of a token’s life are where the edge is, and capturing that edge safely requires real-time data, instant execution, and automated safety checks working together. FoxD runs its own indexing fleet across six chains, streams new launches to your screen within seconds of on-chain discovery, scores every token for risk, and executes trades through MEV-protected routes — all from a single interface.

The platform is organised into four core products, each documented in its own section below:

• Trading Terminal — discovery, charts, token intelligence, and swap execution for any listed token.
• Smart Sniper — a live three-stage launch feed (New → About to Migrate → Migrated) with one-tap buys.
• Copy Trading — a smart-money leaderboard with per-wallet analytics and one-click following.
• AI Copilot — natural-language token research and market questions, answered from live data.

FoxD is available as a web app at foxd.xyz, and the identical experience runs inside Telegram as a Mini App — one account, unified across both surfaces.

2. Getting Started

2.1 Create your account

Click Sign In in the top-right corner. FoxD supports four ways in:

• Telegram — one tap, no password. Recommended if you also use the FoxD bot; your web and Telegram sessions share one account automatically.
• Web3 wallet — connect MetaMask, Trust Wallet, OKX, Phantom, or 300+ others and sign a message. No gas required for sign-in.
• Google or Twitter/X — standard social login.
• Email — magic-link sign-in.

2.2 Fund your trading wallets

On first sign-in, FoxD provisions dedicated trading wallets for you — one EVM address (used across Ethereum, BNB Chain, Base, Arbitrum, and HyperEVM) and one Solana address. Open Wallet, tap Receive, and send funds from any exchange or self-custody wallet. Balances appear as soon as the deposit confirms on-chain.

2.3 Make your first trade

• Open the Trading Terminal or Smart Sniper.
• Pick a chain with the chain selector, or search any token, wallet, or contract address with Ctrl/⌘ + K.
• Review the token’s FoxScore, safety badges, and liquidity before buying.
• Buy with a preset size (S/M/L/XL) or a custom amount — the exact fee is shown before you confirm.

3. Trading Terminal

The terminal is FoxD’s home for token discovery and execution. The live list ranks tokens by trending momentum, volume, or gains, filterable per chain — every row shows price, 1h/24h change, market cap, liquidity, transactions, holders, and a sparkline at a glance.

3.1 Token page

Every token has a dedicated page combining a live candlestick chart, a real-time trade tape, holder analytics with a bubble map of top wallets, security analysis, and social links. Data updates live over WebSocket — no refresh needed.

3.2 Trade engine

• Buy / Sell panel with preset and custom amounts, quoted before execution.
• Slippage control — preset tiers or a custom basis-point value.
• Priority modes — trade landing speed vs. cost, tunable per trade.
• Native-pair routing — FoxD trades tokens against the chain’s native asset (SOL, ETH, BNB, HYPE) for the deepest, most reliable liquidity.

4. Smart Sniper

The Smart Sniper is a self-refreshing launch feed covering every venue FoxD indexes, organised into three lifecycle columns:

• New — tokens discovered in the last moments, streamed in real time as the indexers see them on-chain.
• About to Migrate — bonding-curve tokens at 70–99.9% of their graduation target: the classic snipe window.
• Migrated — graduated tokens now trading on their destination DEX, ranked by trending momentum.

4.1 One-tap buys

Every card carries a BUY button wired to your snipe size tier — S, M, L, XL, or per-chain custom amounts (configure via the gear icon, alongside slippage). Buys execute in-place: the button live-tracks submission, landing, and fill, and a receipt with your measured execution speed appears on success.

4.2 Filters

• Chain chips — instant client-side switching between all six chains.
• Launchpad filter — every venue gets its own deep feed (pre-loaded in the background, so switching is instant).
• Quick filters — Safe (passes security checks), Liq $5k+, 100+ holders, and active buying pressure.
• Sorting — Smart (FoxD’s ranking), Newest, 1h/24h gain, Volume, Market cap, or Score.

5. Copy Trading

Copy Trading surfaces the wallets actually making money on-chain. FoxD’s indexers reconstruct every wallet’s trade history from raw swap data — no self-reported numbers — and score them on a three-layer composite: wallet quality, token safety of what they trade, and entry timing.

5.1 Leaderboard & wallet pages

The Smart Money Leaderboard ranks wallets by score with realized PnL, average return, win rate, and volume. Click any wallet for a full dossier: equity curve, buy/sell flow, per-token PnL breakdown, and the complete trade tape.

5.2 Following a wallet

Tap Copy on a wallet to mirror its entries automatically. Position sizes are scaled to your own funds — you set the budget, FoxD handles detection and execution. Every copied trade appears in your Wallet history like any other.

6. AI Copilot

The AI Copilot answers market questions in plain language, grounded in FoxD’s live data — not a stale training set. Ask it to analyse a contract address, compare tokens, explain a price move, or find launches matching your criteria. It reads the same indexer, security, and market feeds the terminal uses, so its answers reference real, current numbers.

The copilot is also one keystroke away everywhere: press Shift + / or use the Ask FoxD AI bar at the bottom of any page.

The copilot is a web-terminal feature and is not part of the agent surface. There is no ai.* tool over MCP, the SDK, the CLI or the REST API, and no ai scope to grant. If you are driving FoxD from an agent you already have a model in the loop — ours would be a second one, answering from the same data your own can read directly through market.* and analytics.*. Every number the copilot cites comes from those tools.

7. Wallets & Portfolio

The Wallet view is your operations hub; Profile holds account settings, preferences, and trading stats.

• Portfolio — live holdings across all six chains with USD values, including Solana Token-2022 assets.
• Receive — deposit addresses for your EVM and Solana trading wallets.
• Withdraw — send funds anywhere with zero FoxD withdrawal fee; you pay only the bare network cost.
• Export keys — your trading wallets’ private keys are exportable at any time. Your money remains yours.
• History — every trade, deposit, and withdrawal with explorer links.
• Rent reclaim (Solana) — recover the SOL locked in empty token accounts with one tap.

8. Supported Chains & Venues

Trading is live on six chains: Solana, Ethereum, BNB Chain, Base, Arbitrum, and HyperEVM. Discovery and indexing run natively on each — FoxD does not rely on third-party token lists.

8.1 Launchpads & venues indexed

• Solana — pump.fun & PumpSwap, BONK.fun (Raydium LaunchLab), Believe (Meteora DBC), Moonshot, Bags.fm, daos.fun, MetaDAO, Raydium (AMM/CPMM/CLMM), Orca, Meteora (DLMM/DAMM).
• BNB Chain — Four.Meme (incl. X-mode), Flap.sh, PancakeSwap V2/V3, Biswap, ApeSwap.
• Base — Clanker, Zora, Bankr, Flaunch, Ape.store, Aerodrome, Uniswap V2/V3/V4.
• Ethereum — pump.fun, Uniswap V2/V3/V4, SushiSwap.
• Arbitrum — Camelot, Uniswap V3.
• HyperEVM — alt.fun, Hypurr, HyperSwap V2/V3.

New venues are added continuously; each one is verified with real funds before its buy button goes live.

9. Execution & MEV Protection

Fast quotes mean nothing if your transaction gets sandwiched or stuck. FoxD’s execution layer is engineered per chain:

• Ethereum & BNB Chain — trades are submitted as private bundles to block builders, so they never sit exposed in the public mempool where sandwich bots hunt.
• Base, Arbitrum & HyperEVM — single-transaction smart-account bundles (EIP-7702) make approval + swap land atomically in one transaction.
• Solana — priority-fee tuned transactions broadcast simultaneously across multiple RPC paths for the fastest landing.
• Priority tips — you choose the speed budget per trade; tips are capped so a faster landing never silently costs more than 10% of trade value.
• Slippage enforcement — quotes carry a minimum-out; if the pool moves beyond your tolerance, the transaction reverts rather than filling badly.

10. Token Safety & FoxScore

Every token FoxD lists is screened continuously. The FoxScore (0–100) is a composite of security signals, liquidity depth, holder distribution, and market activity — visible on every card and token page.

• Honeypot detection — buy/sell simulation on EVM chains; RugCheck analysis on Solana. Tokens that can’t be sold are flagged HONEYPOT in red.
• Tax analysis — buy and sell taxes measured and displayed; high-tax tokens carry a warning badge.
• LP status — liquidity lock percentage where detectable.
• Risk level — an aggregate flag (audit ticks on each sniper card) covering ownership, mintability, and blacklist functions.

Badges are informational, not gatekeeping — FoxD shows you the risk and lets you decide. The sniper’s Safe quick-filter hides flagged tokens if you prefer a curated view.

11. Fees & Tips

• Trading fee — a small per-chain platform fee, always displayed on the trade panel before you confirm. What is shown is exactly what is charged.
• Priority tips — optional, per-trade, and capped at 10% of trade value across all chains. Tips buy landing speed; unused budget is never silently kept as a hidden markup.
• Withdrawals — 0% FoxD fee. You pay only the network’s own gas cost.
• Deposits — free.

FoxD’s pricing principle is simple: no invisible spreads, no inflated “network fee” line items, and full key export at any time.

12. Telegram Bot & Mini App

Open @foxd_trade_bot and tap Open App — the complete FoxD terminal runs inside Telegram as a Mini App: same sniper feed, same one-tap buys, same wallets. Signing in with Telegram on the web automatically unifies both into one account, so positions opened on your phone in Telegram appear on your desktop instantly.

The Mini App is fullscreen-aware (safe areas for notches and Telegram’s toolbar are handled) and optimised for one-hand use with a bottom navigation bar and swipe-friendly trade sheets.

13. Developers & Agents

Everything in the FoxD terminal is available programmatically. One contract defines every capability, and four surfaces are generated from it — so an MCP tool, an SDK method, a CLI command and a REST endpoint always describe the same thing and can never drift apart.

Each surface has its own walkthrough — setup, worked examples and the gotchas specific to it: MCP, SDK, CLI and REST API.

There are currently 87 tools across 13 modules. All of them need an API key. Keys are free during early access, and an agent can issue itself one in a single call — so this is a starting point, not a waiting room:

curl https://foxd.xyz/api/v1/tokens/trending?chain=base&limit=5 \
  -H 'Authorization: Bearer fxk_live_…'

The only endpoints that answer without a key are the five sign-in tools, which cannot require the credential they exist to issue. That is deliberate: an anonymous call belongs to nobody, so it cannot be measured, throttled per account, or cut off if it turns abusive.

13.1 Machine-readable discovery

• /api/v1 — self-describing index listing every tool, its scopes and its route.
• /api/v1/openapi.json — OpenAPI 3.1, generated from the contract on every request.
• /llms.txt — a plain-text summary for agents and crawlers.

13.2 Conventions worth knowing

• Percentages are ratios. priceChange24h: 0.05 means +5%, not +0.05%.
• Amounts are decimal strings. An 18-decimal token amount does not survive a float.
• Errors are structured. Every non-2xx body is { error: { code, message } } with a stable machine-readable code.
• 503 means retry; 500 means stop. Transient backing-service failures return 503 with Retry-After.

14. Authentication

A FoxD account is one account everywhere. Whether it was created in the browser, from the CLI, or by an autonomous agent, it is the same identity with the same custodial EVM and Solana wallets and the same API keys. Signing in with a wallet from a script and later clicking “Login with Google” on a linked identity resolves to one account, not two.

14.1 Wallet signature — fully headless

No browser, no human, no email. An agent holding a keypair goes from nothing to a tradeable account in two calls. Works with EVM (personal_sign) and Solana (ed25519 signMessage).

# 1. Get a challenge
curl -X POST https://foxd.xyz/api/v1/auth/challenge \
  -H 'content-type: application/json' \
  -d '{"address":"0xYourAddress"}'

# → { "nonce": "…", "message": "foxd.xyz wants you to sign in…", "expiresAt": "…" }

# 2. Sign that message EXACTLY as returned, then:
curl -X POST https://foxd.xyz/api/v1/auth/wallet \
  -H 'content-type: application/json' \
  -d '{
        "message": "<the exact message>",
        "signature": "0x…",
        "address": "0xYourAddress",
        "scopes": ["read","wallet:read","trade:read","trade:execute"]
      }'

# → { "apiKey": "fxk_live_…", "userId": "…", "wallets": [...], "isNewAccount": true }

The message must be signed byte for byte as returned — reformatting or trimming it invalidates the signature. The challenge is single-use and expires in ten minutes. The API key is shown once and cannot be recovered.

14.2 Device flow — Google, X, Telegram, email

These are browser sign-ins, so a headless client uses the OAuth 2.0 device authorization grant — the same flow as gh auth login. Your client shows a short code, a human approves it in a browser with whichever provider they prefer, and your client polls until a key appears.

foxd login

  Open  https://foxd.xyz/device?code=WXYZ-1234
  Code  WXYZ-1234

  Sign in with Google, X, Telegram, email or a wallet. Waiting…

Programmatically that is auth.startDeviceLogin followed by auth.pollDeviceLogin at the returned interval. Poll faster than the interval and you will get slow_down; back off by the amount it returns.

14.3 Managing keys

Everything below works from Profile → Settings and from the API, MCP, SDK and CLI equally — the browser uses your session, an agent uses a key with keys:manage.

Editing keeps the secret working. That matters more than it sounds: the alternative is revoke-and-reissue, which forces a redeploy of whatever holds the key — and that friction is exactly why over-scoped keys get left in place. Narrowing one is a single call. Scopes are replaced, not merged, so send the complete set you want the key to end up with.

Full access in one step. allAccess: true on create or update grants every scope — foxd login --all does the same from a cold start, and the web terminal has a one-click button. Over the API it means “everything I am allowed to grant” — it intersects with what the calling key already holds, so the shorthand can never become an escalation: a read-only key asking for everything gets exactly what it had. To get a genuinely full-access key from a script, ask for the scopes at sign-in (auth.verifyWallet takes a scopes array), which is where account ownership is actually proven. Worth being deliberate about — it includes trade:execute, wallet:write, launch:write and keys:manage. Right for your own machine; wrong for anything you hand to someone else.

Five live keys per account. Revoked keys do not count, so you can always replace one you think has leaked — the limit never traps you with a compromised credential. It exists to bound the damage from a compromised account and to keep the list something you can actually audit. A sixth request returns 409 key_limit_reached.

14.4 Scopes

Keys carry explicit scopes. Grant an agent the minimum it needs — a read-only research agent and a trading agent should never share a key, because revoking one should not break the other.

14.5 Safety rails

• One wallet per key. A trading key is bound to a single wallet and can never reach your others, so a leak is a bounded loss.
• 24-hour spend cap. Checked before anything is signed. Lower it for untrusted agents.
• No escalation. A key cannot mint another key with scopes it does not itself hold.
• Device flow cannot grant keys:manage. One approval must not become permanent unbounded access.
• Pause or revoke instantly with keys.setStatus or keys.revoke. Keys are free — rotate freely.

15. MCP Server

FoxD is a Model Context Protocol server, so any MCP client gets all 87 tools plus 5 resources and 5 guided prompts from a single endpoint.

https://foxd.xyz/api/mcp

Point any MCP client at that URL and you are done — no install, nothing to keep updated. Add Authorization: Bearer fxk_live_… for the account, wallet, trading and launch tools; public market data works without it. The manual configuration in 15.2 is all most clients need.

15.1 One-command install

npx foxd-mcp --claude        # Claude Desktop
npx foxd-mcp --claude-code   # Claude Code
npx foxd-mcp --cursor        # Cursor
npx foxd-mcp --codex         # Codex
npx foxd-mcp --opencode      # OpenCode
npx foxd-mcp --vscode        # VS Code / GitHub Copilot
npx foxd-mcp --windsurf      # Windsurf
npx foxd-mcp --openclaw      # OpenClaw
npx foxd-mcp --nemoclaw      # NemoClaw

npx foxd-mcp --list          # every supported client

Add --key fxk_live_… to embed a credential, or set FOXD_API_KEY. Existing entries in your config are preserved — only the FoxD block is added.

15.2 Manual configuration

Most clients accept a remote HTTP server directly:

{
  "mcpServers": {
    "foxd": {
      "type": "http",
      "url": "https://foxd.xyz/api/mcp",
      "headers": { "Authorization": "Bearer fxk_live_…" }
    }
  }
}

For clients that only speak stdio, npx -y foxd-mcp runs a thin bridge to the same endpoint:

{
  "mcpServers": {
    "foxd": {
      "command": "npx",
      "args": ["-y", "foxd-mcp"],
      "env": { "FOXD_API_KEY": "fxk_live_…" }
    }
  }
}

The bridge is deliberately a dumb pipe: all protocol logic lives server-side, so new tools appear without you upgrading anything.

15.3 Resources & prompts

15.4 Agent skills

The package ships a SKILL.md describing when to reach for which tool, the safety rules that matter, and a worked token-audit example. Drop it into any skills-aware agent, or read it as a summary of how FoxD expects to be used.

16. SDK & CLI

16.1 TypeScript SDK

npm i foxd-sdk

import { FoxD } from "foxd-sdk";

const foxd = new FoxD({ apiKey: process.env.FOXD_API_KEY });

// Fully typed — chain is a union, not a string
const { tokens } = await foxd.market.trending({ chain: "base", limit: 10 });

// Safety before size
const safety = await foxd.analytics.security({ chain: "base", address: tokens[0].address });
const sim    = await foxd.analytics.simulateHoneypot({ chain: "base", address: tokens[0].address });

if (safety.isHoneypot || sim.canSell === false) throw new Error("not sellable");

Types come straight from the contract, so chain: "dogecoin" is a compile error rather than a runtime surprise, and every response is fully shaped. It runs anywhere fetch does — Node, Bun, Deno, browsers and edge runtimes.

Failures throw a FoxDError carrying status, a stable code and a retryable flag. Read-only calls retry transient failures automatically with exponential backoff; mutating calls never retry, because a timeout does not mean the trade did not land.

16.2 Command line

npm i -g foxd-cli

foxd login                                     # device-flow sign-in
foxd whoami                                    # scopes, tier, spend headroom
foxd market trending --chain base --limit 10
foxd analytics security --chain bsc --address 0xbb4c…
foxd sniper feed --chain solana --stages fresh --limit 20
foxd tools                                     # every command
foxd help analytics.security                   # per-tool reference

Every command accepts --json for clean piping into jq. Commands are generated from the contract, so the CLI covers the whole API and its help text is the same text the models see.

16b. The Agent Skill (SKILL.md)

Some runtimes load a skill — a short markdown file with frontmatter that tells a model when to reach for a tool and what the traps are, rather than just listing what exists. A tool list saysanalytics.security is available; a skill says to run itbefore recommending a buy, that it is blind on Arbitrum and HyperEVM, and that simulated: false is not a pass.

curl https://foxd.xyz/skill.md

It also ships inside the foxd-mcp npm package, and the two copies are asserted identical in CI — a skill that disagrees with the published package is worse than none, because whichever one the agent loaded is the one it believes.

You do not need it. Every tool carries its own description, scopes and examples over MCP, so a client that knows nothing about skills works fine. The skill is the judgement that does not fit in a tool description: which of two safety sources to trust on which chain, why a profitable wallet can still be a bad one to copy, and never presenting output as financial advice.

• Claude Code / Claude Desktop — drop it in your skills directory, or let npx foxd-mcp --claude place it.
• Anything else — fetch the URL and prepend it to your system prompt. It is plain markdown with YAML frontmatter; nothing about it is Claude-specific.

17. Recipes — every language

The same call in curl, JavaScript, Python, the typed SDK and the CLI. Pick a tab; the rest of the flow keeps the choice you made. Every snippet on this page is generated from the same contract the server dispatches from, so a renamed field changes all five at once rather than leaving four of them lying.

All of them assume FOXD_API_KEY is set. Recipe 1 is how you get one.

17.1 Sign up and get a key, with no browser

Three calls: ask for a challenge, sign it with a keypair you already have, exchange the signature for a key. This creates the account and provisions an EVM and a Solana custodial wallet in the same step.

curl -X POST 'https://foxd.xyz/api/v1/auth/challenge' \
  -H 'content-type: application/json' \
  -d '{"address":"0xYourWalletAddress"}'

curl -X POST 'https://foxd.xyz/api/v1/auth/wallet' \
  -H 'content-type: application/json' \
  -d '{"message":"<the exact message returned>","signature":"0x<your signature>","address":"0xYourWalletAddress"}'

Sign the message byte for byte as returned — reformatting or trimming it invalidates the signature. The challenge is single-use and expires in ten minutes, and the key is shown once. Prefer Google, X, Telegram or email? Use auth.startDeviceLogin and poll auth.pollDeviceLogin — §14.2.

curl 'https://foxd.xyz/api/v1/account/whoami' \
  -H "Authorization: Bearer $FOXD_API_KEY"

17.2 Find something to look at

curl 'https://foxd.xyz/api/v1/tokens/trending?chain=base&limit=10' \
  -H "Authorization: Bearer $FOXD_API_KEY"

curl 'https://foxd.xyz/api/v1/sniper/feed?chain=solana&stages=fresh&limit=20' \
  -H "Authorization: Bearer $FOXD_API_KEY"

curl 'https://foxd.xyz/api/v1/search?q=0x532f27101965dd16442e59d40670faf5ebb142e4' \
  -H "Authorization: Bearer $FOXD_API_KEY"

17.3 Check it is safe before you touch it

Two different sources, and they are not interchangeable. analytics.security is the provider verdict — broad and cheap, but blind on Arbitrum and HyperEVM. analytics.simulateHoneypot actually simulates a buy and a sell against chain state. Run both.

curl 'https://foxd.xyz/api/v1/tokens/bsc/0xbb4cdb9cbd36b01bd1cbaebf2de08d9173bc095c/security' \
  -H "Authorization: Bearer $FOXD_API_KEY"

curl 'https://foxd.xyz/api/v1/tokens/bsc/0xbb4cdb9cbd36b01bd1cbaebf2de08d9173bc095c/simulate' \
  -H "Authorization: Bearer $FOXD_API_KEY"

simulated: false is not a pass. It means no conclusion was reached — treat it as unknown. Then check concentration: a top-10 float share above roughly 60% means a handful of wallets can end the price whenever they like.

curl 'https://foxd.xyz/api/v1/tokens/bsc/0xbb4cdb9cbd36b01bd1cbaebf2de08d9173bc095c/holders' \
  -H "Authorization: Bearer $FOXD_API_KEY"

17.4 Quote, then trade

Always quote first. The quote names the venue, the expected output and the price impact, and it is the same number the spend cap is checked against.

curl -X POST 'https://foxd.xyz/api/v1/trade/quote' \
  -H "Authorization: Bearer $FOXD_API_KEY" \
  -H 'content-type: application/json' \
  -d '{"chain":"base","tokenIn":"0x0000000000000000000000000000000000000000","tokenOut":"0x532f27101965dd16442e59d40670faf5ebb142e4","amountIn":"10000000000000000","side":"buy"}'

curl -X POST 'https://foxd.xyz/api/v1/trade/execute' \
  -H "Authorization: Bearer $FOXD_API_KEY" \
  -H 'content-type: application/json' \
  -d '{"chain":"base","tokenIn":"0x0000000000000000000000000000000000000000","tokenOut":"0x532f27101965dd16442e59d40670faf5ebb142e4","amountIn":"10000000000000000","side":"buy","slippageBps":100}'

Amounts are base-unit strings — "10000000000000000" is 0.01 ETH. An 18-decimal integer does not survive a JavaScript float, so numbers are refused wherever precision matters. trade:execute additionally needs a bound wallet and stays inside the key's rolling 24-hour spend cap.

17.5 Set the exit before you need it

Take-profit, stop-loss and trailing stops are server-side; they keep working when your process is not.

curl -X POST 'https://foxd.xyz/api/v1/orders/take-profit' \
  -H "Authorization: Bearer $FOXD_API_KEY" \
  -H 'content-type: application/json' \
  -d '{"chain":"base","tokenAddress":"0x532f27101965dd16442e59d40670faf5ebb142e4","amount":"1000000000000000000","targetPriceUsd":0.01}'

curl -X POST 'https://foxd.xyz/api/v1/orders/trailing-stop' \
  -H "Authorization: Bearer $FOXD_API_KEY" \
  -H 'content-type: application/json' \
  -d '{"chain":"base","tokenAddress":"0x532f27101965dd16442e59d40670faf5ebb142e4","amount":"1000000000000000000","trailPercent":15}'

Triggers evaluate against a refreshed market price, so a fill can land away from the trigger; the gap is bounded by the order's slippage tolerance and capped at 10% — see §13.3.

17.6 Research a wallet before copying it

curl 'https://foxd.xyz/api/v1/copy/leaderboard?chain=solana&sort=pnl&limit=20' \
  -H "Authorization: Bearer $FOXD_API_KEY"

curl 'https://foxd.xyz/api/v1/copy/trader/0xae2fc483527b8ef99eb5d9b44875f005ba1fae13/backtest?windowDays=30&ticketUsd=100' \
  -H "Authorization: Bearer $FOXD_API_KEY"

A wallet can be highly profitable and still be a poor thing to copy, because a mirror fills seconds behind and sizes differently. The backtest is a simulation over past trades and says nothing about future performance — present it that way.

17.7 Watch your own position

curl 'https://foxd.xyz/api/v1/wallet/balances' \
  -H "Authorization: Bearer $FOXD_API_KEY"

curl 'https://foxd.xyz/api/v1/wallet/portfolio' \
  -H "Authorization: Bearer $FOXD_API_KEY"

17.8 Be told, instead of polling

A webhook costs one call to register and then nothing. Polling sniper.feed every few seconds burns your quota to learn nothing most of the time.

curl -X POST 'https://foxd.xyz/api/v1/webhooks' \
  -H "Authorization: Bearer $FOXD_API_KEY" \
  -H 'content-type: application/json' \
  -d '{"url":"https://your-service.example/foxd","event":"new_token","filters":{"chain":"base","platform":"pumpfun"}}'

Deliveries are signed — verify the HMAC before trusting a payload (§21). Registration rejects anything that is not https, and any loopback or private address.

17.9 Launch a token across several pads

curl -X POST 'https://foxd.xyz/api/v1/launch/quote' \
  -H "Authorization: Bearer $FOXD_API_KEY" \
  -H 'content-type: application/json' \
  -d '{"pads":["pumpfun","bonkfun"]}'

curl -X POST 'https://foxd.xyz/api/v1/launch/create' \
  -H "Authorization: Bearer $FOXD_API_KEY" \
  -H 'content-type: application/json' \
  -d '{"name":"Fox Coin","symbol":"FOX","imageBase64":"iVBORw0KGgoAAAANSUhEUg…","pads":["pumpfun","bonkfun"]}'

This spends real funds on every pad selected and mints permanent on-chain metadata. It returns as soon as the launch is recorded, with variants queued — poll launch.variants until they are live. Full caveats in §20.1.

18. Trading from an Agent

An API key can execute real trades. Three independent gates stand between a key and a fill, and all three must pass:

• The trade:execute scope. A read-only key can quote but never fill.
• A bound wallet. Each key is tied to exactly one wallet. A leaked key reaches that wallet and no other — not the rest of the account.
• A rolling 24-hour USD spend cap. Checked before anything is signed, never after.

17.1 Always quote first

A quote costs nothing and is the only way to see price impact and the USD notional the cap is measured against. trade.execute quotes internally regardless — a trade that cannot be priced is refused rather than executed uncapped.

# 1. quote
curl -X POST https://foxd.xyz/api/v1/trade/quote   -H "authorization: Bearer $FOXD_API_KEY"   -H 'content-type: application/json'   -d '{"chain":"base","tokenIn":"0x0000000000000000000000000000000000000000",
       "tokenOut":"0x532f…","amountIn":"10000000000000000","side":"buy"}'

# 2. execute, refusing thin-liquidity fills
curl -X POST https://foxd.xyz/api/v1/trade/execute   -H "authorization: Bearer $FOXD_API_KEY"   -H 'content-type: application/json'   -d '{"chain":"base","tokenIn":"0x0000000000000000000000000000000000000000",
       "tokenOut":"0x532f…","amountIn":"10000000000000000","side":"buy",
       "slippageBps":150,"maxPriceImpactBps":500}'

Amounts are base units as strings — wei on EVM, lamports on Solana. 0.01 ETH is "10000000000000000", never 0.01. An 18-decimal amount does not survive a float, and silently truncating a trade size is not an acceptable failure.

17.2 Check safety before you buy

Two sources, and they are not interchangeable. analytics.security is the provider verdict — broad and cheap, but blind on Arbitrum and HyperEVM. analytics.simulateHoneypot simulates a real buy and sell against chain state; it is ground truth and the only source covering HyperEVM. A simulated: false result is not a pass — it means no conclusion was reached.

19. Wallets & Automation

An account holds up to five custodial wallets, each carrying an EVM and a Solana address. Give each agent its own wallet and its own key: a key binds to one wallet, so a misbehaving bot cannot reach the others.

18.1 Exporting a key

wallet.export returns a private key so you can move funds off FoxD — your money is never locked in. Understand what that means in an API context: a private key is not bounded by scopes, the spend cap, or revocation. Anyone holding it controls that wallet permanently, and revoking the API key you used to fetch it changes nothing. Hand it to its owner; never store it, log it, or pass it to another service.

18.2 Automated orders

A trailing stop left unarmed trails from placement (a trailing stop-loss); given activateAboveUsd it waits until that price before it starts trailing (a trailing take-profit). See 13.3 for how triggers fire and the tolerance that applies.

18.3 Copy trading

copyExec.subscribe is the most consequential thing an agent can set up here, because it keeps spending without further approval for as long as it stays enabled. Vet a leader with copyIntel.trader first, run copyIntel.backtest to see what copying them would actually have returned, and always set maxPerTradeUsd. Mirrors land a few seconds behind the leader, so a fast entry fills at a different price than they got.

20. Launching & the Multiverse

The Meme Multiverse deploys one token concept across several launchpads at once, then tracks them together so the market picks the winner.

• launch.create — deploy the token across every pad you select. Spends real funds; see below.
• launch.explore — every FoxD multiverse launch, newest first.
• launch.pads — which launchpads are available and what each costs.
• launch.quote — itemised cost across a chosen set of pads.
• launch.variants — every variant of one launch with price, liquidity and curve progress: the “which one is winning” view.
• launch.studio — your own launches, combined metrics and claimable creator fees.
• launch.claimFees — sweep creator fees. Each pad is attempted independently, so read the per-attempt outcomes rather than assuming overall success.
• launch.migrate — rotate a position from one variant into another.

Migration is not atomic. It is two legs: the sell can land and the buy fail, leaving you holding native coin rather than either token. The response reports which legs completed so a partial migration can be retried from where it stopped.

20.1 Deploying from an agent

launch.create needs launch:write and a bound wallet. It runs the same code path as the web terminal — the browser form is a multipart adapter over it — so an agent cannot reach looser validation than a person can.

POST /api/v1/launch/create
{
  "name": "Fox Coin",
  "symbol": "FOX",
  "description": "A coin about a fox.",
  "imageBase64": "iVBORw0KGgoAAAANSUhEUg…",
  "imageMimeType": "image/png",
  "pads": ["pumpfun", "bonkfun"],
  "devBuys": { "pumpfun": "100000000" }
}

→ { "id": "…", "slug": "FOX-4821", "url": "https://foxd.xyz/multiverse/FOX-4821",
    "platforms": ["pumpfun","bonkfun"], "status": "deploying" }

Five things about it are worth knowing before you call it:

• It spends real funds on every pad selected, and the flat FoxD launch fee once. Call launch.quote first.
• Nothing it writes can be undone. Name, symbol, image, description and any four.meme tax are baked into on-chain metadata permanently.
• The image is base64, not a URL. Fetching a caller-supplied URL server-side would be an SSRF hole, so there is no URL form. A data: URI works as well as a bare payload.
• It returns before the tokens exist. Status comes back as deploying with the variants queued; poll launch.variants until they are live. A variant that fails reports why rather than disappearing.
• Every chain is checked for funds in its own currency first. Selecting a Base pad with an empty ETH balance is refused up front, rather than failing after the metadata is already pinned and the slug permanently minted.

Per-pad options are only read for the pad that has them — mayhem for pump.fun, taxPercent for four.meme. An option sent to a pad with no such mode is ignored rather than applied, and a malformed one produces a plain token rather than a guessed default.

21. Webhooks

Register an endpoint and be told when something happens instead of polling for it.

order_filled and wallet_activity describe one account and are delivered only to webhooks on that account. The other three are market-wide, so filter them: unfiltered new_token is every launch on every chain.

curl -X POST https://foxd.xyz/api/v1/webhooks   -H "authorization: Bearer $FOXD_API_KEY"   -H 'content-type: application/json'   -d '{"url":"https://you.example/hook","event":"new_token",
       "filters":{"chain":"solana","platform":"pumpfun"}}'

# → { "id": "…", "secret": "whsec_…" }   ← shown ONCE

21.1 Verify every delivery

An unverified webhook endpoint accepts forged events from anyone who guesses the URL. Every delivery carries these headers:

import crypto from "node:crypto";

app.post("/hook", express.raw({ type: "application/json" }), (req, res) => {
  const ts  = req.header("x-foxd-timestamp");
  const sig = req.header("x-foxd-signature");
  const raw = req.body.toString("utf8");

  // The timestamp is INSIDE the signature, so a captured delivery
  // cannot be replayed forever.
  const expected = crypto
    .createHmac("sha256", process.env.FOXD_WEBHOOK_SECRET)
    .update(ts + "." + raw)          // NOTE the dot separator
    .digest("hex");

  const ok =
    sig?.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected)) &&
    Date.now() - Number(ts) < 5 * 60_000;

  if (!ok) return res.status(400).end();
  res.status(200).end();          // ack fast, then process
});

21.2 Rules that apply

• https only, and the host must be publicly routable. Loopback, link-local and private ranges are refused at registration — a webhook makes our servers call an address you choose.
• At-least-once delivery. The same event can arrive twice. Deduplicate on x-foxd-event-id.
• Ten consecutive failures pauses the subscription rather than retrying a dead endpoint forever. Check status with alerts.list.
• Revoking the key that created a webhook stops its deliveries, so a leaked credential cannot keep exfiltrating events.
• Filter aggressively. Unfiltered new_token means every launch on every chain.

22. REST API Reference

Base URL https://foxd.xyz/api/v1. Authenticate with Authorization: Bearer fxk_live_…. Public tools work without it.

The complete machine-readable specification, including every request and response schema, is at /api/v1/openapi.json.

23. Rate Limits & Quotas

Programmatic access is free during early access. Quotas are real and enforced, but generous — the point is attracting builders, not rationing them.

22.1 Cost units

Call counts alone are a poor limit: a cached trending read and a multi-chain portfolio rebuild differ by orders of magnitude in what they cost to serve. Every tool declares a weighted cost, and that is what the monthly unit quota measures.

22.2 Handling limits

• Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset.
• A 429 carries Retry-After in seconds. Honour it — the SDK does automatically.
• Anonymous callers share a much lower per-IP ceiling. An API key raises it substantially and costs nothing.
• Account creation is rate-limited hard per IP. Sign up once and cache the key.
• Check account.usage before a long backfill rather than discovering the limit mid-job.

24. FAQ

Is FoxD custodial?

Your trading wallets are provisioned by FoxD for execution speed, but you can export the private keys at any time from the Wallet view and withdrawals are never gated or fee’d. Sign-in wallets (MetaMask, Phantom, …) are never custodied — they only sign an authentication message.

Which chain should I start on?

Solana and BNB Chain have the highest launch velocity; Base leads for social/creator coins. The sniper’s All-Chains view is the easiest way to see where the action is right now.

Why did my snipe fail?

The most common causes are insufficient balance for the size tier (top up or lower the tier), slippage exceeded (the pool moved — raise slippage for volatile launches), or the token’s curve migrating mid-trade (retry on the destination DEX). Failures are instant and explained on the buy button — you never wait on a hung transaction.

Does FoxD have an API?

Yes — a REST API, a typed TypeScript SDK, a CLI and an MCP server, all free during early access. Public market data needs no key at all. See Developers & Agents to start, or point any MCP client at https://foxd.xyz/api/mcp.

Can an AI agent sign up on its own?

Yes. An agent holding a keypair calls auth.challenge, signs the returned message, and calls auth.verifyWallet — that creates the account, provisions its EVM and Solana wallets and returns an API key, with no browser and no human. For Google, X, Telegram or email, the device flow puts a person in the loop for one approval. See Authentication.

Where do I report an issue?

The fastest route is the community Telegram. For security reports, contact the team privately via 0xfox.org.