--- name: foxd description: Multi-chain token discovery, safety analysis, trading and launching across Solana, Ethereum, BNB Chain, Base, Arbitrum and HyperEVM. Use when the user asks about a token or contract address, wants to find new or trending launches, check whether a token is a honeypot or a rug, research a wallet's trading record, set up copy trading, or trade and launch tokens. Also covers signing up for a FoxD account and obtaining an API key without a browser. --- # FoxD FoxD indexes six chains from raw on-chain data — Solana, Ethereum, BNB Chain, Base, Arbitrum and HyperEVM — and exposes discovery, safety, analytics, trading and token launching through one API. ## Getting connected The tools reach FoxD over MCP at `https://foxd.xyz/api/mcp`, or over REST at `https://foxd.xyz/api/v1`. Both are live and need nothing installed. **Every tool requires an API key.** Keys are free during early access, and an agent can issue itself one without a human — so this is a first step, not a blocker. Get one: - **Headless (no human):** `auth.challenge` → sign the returned message exactly as given → `auth.verifyWallet`. Works with an EVM or a Solana keypair. This creates the account, provisions one EVM and one Solana custodial wallet, and returns a key. The key is shown once. - **With a human:** `auth.startDeviceLogin`, show them the code and URL, then poll `auth.pollDeviceLogin`. They can use Google, X, Telegram, email or a wallet — the same account either way. After signing up, call `account.wallets` for the addresses to fund and `account.whoami` to see which scopes the key actually holds. ## Rules that matter **Always check safety before recommending or executing a buy.** Two different sources, and they are not interchangeable: - `analytics.security` — the provider verdict (honeypot.is on Ethereum/BSC/Base, RugCheck on Solana). Broad and cheap, but blind on Arbitrum and HyperEVM. - `analytics.simulateHoneypot` — an actual buy-then-sell simulated against chain state. Ground truth, and the only source that covers HyperEVM. `simulated: false` is **not** a pass. It means no conclusion was reached. **Percentages are ratios, not percents.** `priceChange24h: 0.05` is +5%. **Never present output as financial advice.** Report what the data says, name the risks, and let the user decide. Fresh launches are extremely high risk and most go to zero. **Respect the spend cap.** A key bound to a wallet has a rolling 24-hour USD ceiling. Check `account.whoami` before attempting size. ## Choosing the right tool | If the user wants… | Use | | --- | --- | | "what is this contract address" | `market.search` or `market.resolve`, then `market.token` | | "is this safe / is it a rug" | `analytics.security` **and** `analytics.simulateHoneypot` | | "why is this token scored badly" | `analytics.score` — returns the weighted breakdown | | "what's trending" | `market.trending` | | "what just launched" | `sniper.feed` (stage-bucketed) or `market.newTokens` (raw recency) | | "what's about to graduate" | `sniper.graduating` | | "is this wallet worth copying" | `copyIntel.leaderboard`, then `copyIntel.trader` | | "how concentrated are the holders" | `market.holders` — top-10 share is of FREE FLOAT, not total supply | | technical indicators, RSI, volatility | `analytics.token` with the sections you need | | chart data | `market.candles` (5m buckets, 72h) | ## Acting, not just reading Reading is most of the surface, but not all of it. Everything below moves real money, so each is gated by its own scope, by the wallet the key is bound to, and by a rolling 24-hour USD spend cap. | To… | Use | | --- | --- | | price a swap before committing | `trade.quote`, then `trade.execute` | | see the exact fee first | `trade.feePreview` — what is shown is what is charged | | buy or sell later, at a price | `automation.placeLimit` | | protect a position | `automation.placeTakeProfit`, `placeStopLoss`, `placeTrailingStop` | | accumulate on a schedule | `automation.placeDca` | | find out whether an order fired | `automation.orders` with `status: "filled"` — or subscribe to `order_filled` | | mirror a wallet automatically | `copyExec.subscribe`, after vetting with `copyIntel.trader` and `copyIntel.backtest` | | fund or move money | `account.wallets` for addresses, `wallet.send` to move it out | | launch a token across launchpads | `launch.quote`, then `launch.create` | | be told instead of polling | `alerts.subscribe` | **Quote before you execute, and read the quote.** Price impact and slippage are in it. `trade.execute` re-quotes and refuses anything that cannot be priced, because an unpriceable trade cannot be capped. **A copy subscription keeps trading without asking again.** It is the single most consequential thing here. Set `maxPerTradeIn`, and fund the `follower` address the response returns — that is the wallet every mirrored trade spends from. ## Worked example — auditing a token 1. `market.resolve` if you only have an address and no chain. 2. `analytics.security` — stop here if it is a confirmed honeypot. 3. `analytics.simulateHoneypot` on EVM to confirm it is genuinely sellable. 4. `market.holders` — top-10 float share above roughly 60% is concentrated. 5. `analytics.score` — the composite plus the reasons behind it. 6. `market.token` — liquidity and volume; thin liquidity means heavy slippage regardless of how safe the contract is. Report the specific numbers that drove your conclusion, and say plainly when something was unavailable rather than glossing over the gap. ## Cost and limits Everything is free during early access, but quotas are enforced. Tools carry a weighted cost — a cached read is 1 unit, an LLM turn 50, a trade 100. Check `account.usage` before a long-running job. On a 429, back off; the response carries `Retry-After`. Prefer a webhook to a polling loop. `alerts.subscribe` costs one call and then nothing; re-reading `sniper.feed` every few seconds spends quota to learn nothing most of the time. Five events are delivered: `new_token`, `migration`, `price_alert`, `order_filled` and `wallet_activity`. Each POST carries an `x-foxd-signature` header — HMAC-SHA256 of `"."` under the secret returned once at subscribe time. Verify it before trusting the payload, and deduplicate on `eventId`, because delivery is at-least-once. ## Where to read more - Worked examples in curl, JavaScript, Python, the SDK and the CLI: - Every endpoint with its scopes and schemas: and - This file, always current: