@sperax/tool-goplus-security

Enterprise-grade Web3 security intelligence powered by GoPlus Security — token risk scanning, address profiling, approval auditing, NFT security, dApp verification, and phishing detection.

GoPlus Security is an agent tool from SperaxOS, packaged headless so you can call it from any agent framework. It ships two things: the manifest — a JSON-Schema function definition a model can call — and the executor that runs the call against the real API.

There is no UI layer and no framework lock-in. It works anywhere TypeScript runs.

Install

npm install @sperax/tool-goplus-security

Usage

Call it directly

import { goPlusSecurityExecutor } from '@sperax/tool-goplus-security';

const result = await goPlusSecurityExecutor.invoke('checkTokenSecurity', {"chainId":"<chainId>","contractAddress":"<contractAddress>"}, {
  messageId: 'msg-1',
});

console.log(result.content); // prose summary written for the model to read
console.log(result.state);   // typed data payload for your own UI

Give it to a model

import Anthropic from '@anthropic-ai/sdk';
import { GoPlusSecurityManifest, goPlusSecurityExecutor } from '@sperax/tool-goplus-security';

const client = new Anthropic();

const response = await client.messages.create({
  model: 'claude-opus-4-8',
  max_tokens: 1024,
  messages: [{ role: 'user', content: 'Ask something this tool can answer' }],
  tools: GoPlusSecurityManifest.api.map((api) => ({
    name: api.name,
    description: api.description,
    input_schema: api.parameters,
  })),
});

for (const block of response.content) {
  if (block.type !== 'tool_use') continue;
  const result = await goPlusSecurityExecutor.invoke(block.name, block.input, { messageId: response.id });
  console.log(result.content);
}

GoPlusSecurityManifest.api is already in JSON-Schema form, so it maps onto any tool-calling API — Anthropic, OpenAI, the Vercel AI SDK, or an MCP server — without translation.

Every executor returns a BuiltinToolResult — { success, content, state }. content is prose written for the model to read; state is the typed data payload for your own code. Executors never throw: a failed call comes back as { success: false, content: '<reason>' }, so a network blip degrades the answer instead of crashing the agent loop.

Configuration — required

This tool needs a backend you control. It will not work on a bare npm install alone.

The upstream API requires a secret key. That key is deliberately not bundled here — shipping it in an npm package would leak it to every consumer. Instead the executor calls a SperaxOS /webapi/* route, which holds the key server-side and injects it. That route is session-authenticated, so the public deployment at https://chat.sperax.io (the default origin) answers 401 to anonymous callers.

To use this tool you need one of:

• a SperaxOS deployment of your own, or
• any HTTP endpoint that implements the same request shape and supplies the key.

Point the package at it before importing the tool — the URL is resolved once, when the module first loads:

SPERAX_API_BASE_URL=https://my-speraxos.example.com

or in code:

import { configureSperaxApi } from '@sperax/agent-tools-core';

configureSperaxApi({ baseUrl: 'https://my-speraxos.example.com' });

// import the tool only after configuring, so the path resolves against your origin
const { goPlusSecurityExecutor } = await import('@sperax/tool-goplus-security');

Inside a browser that already serves those routes at its own origin, requests stay same-origin and no configuration is needed.

If you want a tool that runs with zero setup, use one of the standalone tools — those call public APIs directly and need no key, no origin, and no backend.

Tool identifier

sperax-goplus-security

API reference

checkTokenSecurity

Run a deep token contract risk check via GoPlus Security (honeypot behavior, transfer restrictions, owner controls, blacklisting, proxy and source verification signals).

| Parameter | Type | Required | Description | | --- | --- | --- | --- | | chainId | string | no | EVM chain ID as string (default: 42161 for Arbitrum). | | contractAddress | string | yes | Token contract address to analyze (0x...). |

checkAddressSecurity

Analyze an EVM wallet/contract address risk profile via GoPlus Security (phishing, sanctions, suspicious activity indicators).

| Parameter | Type | Required | Description | | --- | --- | --- | --- | | address | string | yes | Address to analyze (EOA or contract). | | chainId | string | no | EVM chain ID as string (default: 42161 for Arbitrum). |

checkMaliciousAddress

Check whether an address appears in GoPlus malicious address intelligence and summarize the threat signals.

| Parameter | Type | Required | Description | | --- | --- | --- | --- | | address | string | yes | Address to check. |

batchCheckTokenSecurity

Batch token risk scanning for multiple contracts on the same chain, useful before watchlist additions or trade shortlisting.

| Parameter | Type | Required | Description | | --- | --- | --- | --- | | chainId | string | no | EVM chain ID as string (default: 42161 for Arbitrum). | | contractAddresses | array | yes | Array of token contract addresses (max 20 recommended per request). |

checkApprovalSecurity

Scan a wallet's ERC-20/ERC-721 token approvals for risky spenders. Identifies unlimited approvals, revoked-but-still-active allowances, and known malicious spender addresses.

| Parameter | Type | Required | Description | | --- | --- | --- | --- | | address | string | yes | Wallet address to scan approvals for. | | chainId | string | no | EVM chain ID as string (default: 42161 for Arbitrum). |

checkNFTSecurity

Analyze an NFT contract for security risks — privilege escalation, unrestricted minting, hidden transfer abilities, self-destruct, and metadata manipulation.

| Parameter | Type | Required | Description | | --- | --- | --- | --- | | chainId | string | no | EVM chain ID (default: 1 for Ethereum). | | contractAddress | string | yes | NFT contract address to analyze (0x...). |

checkDAppSecurity

Check a dApp URL against GoPlus's threat intelligence database — identifies phishing sites, malicious contract interactions, impersonation, and known scam domains.

| Parameter | Type | Required | Description | | --- | --- | --- | --- | | url | string | yes | dApp URL to check (e.g. "https://app.uniswap.org"). |

detectPhishingUrl

Detect phishing URLs using GoPlus real-time threat feeds. Checks against known phishing domains, typosquatting patterns, and suspicious URL structures.

| Parameter | Type | Required | Description | | --- | --- | --- | --- | | url | string | yes | URL to check for phishing indicators. |

Types

Shared types come from @sperax/agent-tools-core: BuiltinToolManifest, BuiltinToolResult, BuiltinToolContext, and the BaseExecutor class every tool executor extends.

Related

• @sperax/agent-tools-core — the tool contract
• All SperaxOS agent tools — tool-goplus-security is one of many
• SperaxOS — the agent workspace these tools were built for

License

Apache-2.0