@sperax/tool-protocol-risk

Deep protocol risk analysis: smart contract security, governance centralization, economic sustainability, audit history, and rug pull probability scoring

Protocol Risk Scorer is an agent tool from SperaxOS, packaged headless so you can call it from any agent framework. It ships two things: the manifest — a JSON-Schema function definition a model can call — and the executor that runs the call against the real API.

There is no UI layer and no framework lock-in. It works anywhere TypeScript runs.

Install

npm install @sperax/tool-protocol-risk

Usage

Call it directly

import { protocolRiskExecutor } from '@sperax/tool-protocol-risk';

const result = await protocolRiskExecutor.invoke('scoreProtocol', {"chain":"<chain>","detailed":"<detailed>"}, {
  messageId: 'msg-1',
});

console.log(result.content); // prose summary written for the model to read
console.log(result.state);   // typed data payload for your own UI

Give it to a model

import Anthropic from '@anthropic-ai/sdk';
import { ProtocolRiskManifest, protocolRiskExecutor } from '@sperax/tool-protocol-risk';

const client = new Anthropic();

const response = await client.messages.create({
  model: 'claude-opus-4-8',
  max_tokens: 1024,
  messages: [{ role: 'user', content: 'Ask something this tool can answer' }],
  tools: ProtocolRiskManifest.api.map((api) => ({
    name: api.name,
    description: api.description,
    input_schema: api.parameters,
  })),
});

for (const block of response.content) {
  if (block.type !== 'tool_use') continue;
  const result = await protocolRiskExecutor.invoke(block.name, block.input, { messageId: response.id });
  console.log(result.content);
}

ProtocolRiskManifest.api is already in JSON-Schema form, so it maps onto any tool-calling API — Anthropic, OpenAI, the Vercel AI SDK, or an MCP server — without translation.

Every executor returns a BuiltinToolResult — { success, content, state }. content is prose written for the model to read; state is the typed data payload for your own code. Executors never throw: a failed call comes back as { success: false, content: '<reason>' }, so a network blip degrades the answer instead of crashing the agent loop.

Configuration — required

This tool needs a backend you control. It will not work on a bare npm install alone.

The upstream API requires a secret key. That key is deliberately not bundled here — shipping it in an npm package would leak it to every consumer. Instead the executor calls a SperaxOS /webapi/* route, which holds the key server-side and injects it. That route is session-authenticated, so the public deployment at https://chat.sperax.io (the default origin) answers 401 to anonymous callers.

To use this tool you need one of:

• a SperaxOS deployment of your own, or
• any HTTP endpoint that implements the same request shape and supplies the key.

Point the package at it before importing the tool — the URL is resolved once, when the module first loads:

SPERAX_API_BASE_URL=https://my-speraxos.example.com

or in code:

import { configureSperaxApi } from '@sperax/agent-tools-core';

configureSperaxApi({ baseUrl: 'https://my-speraxos.example.com' });

// import the tool only after configuring, so the path resolves against your origin
const { protocolRiskExecutor } = await import('@sperax/tool-protocol-risk');

Inside a browser that already serves those routes at its own origin, requests stay same-origin and no configuration is needed.

If you want a tool that runs with zero setup, use one of the standalone tools — those call public APIs directly and need no key, no origin, and no backend.

Tool identifier

sperax-protocol-risk

API reference

scoreProtocol

Get a comprehensive risk score for a DeFi protocol. Analyzes smart contract security, economic risks, governance, oracle dependencies, and more. Returns a letter grade (A-F) with detailed breakdown.

| Parameter | Type | Required | Description | | --- | --- | --- | --- | | chain | string | no | Specific chain to analyze. Omit to score across all chains. | | detailed | boolean | no | Include detailed sub-score breakdown. Default: true. | | protocol | string | yes | Protocol name or slug (e.g. "aave", "uniswap", "curve"). |

getContractRisk

Analyze smart contract security for a DeFi protocol. Checks verification, upgradeability, admin controls, audit history, known vulnerabilities, and code complexity.

| Parameter | Type | Required | Description | | --- | --- | --- | --- | | chain | string | yes | Chain where the contract is deployed. | | contractAddress | string | no | Specific contract address. Omit to analyze main protocol contracts. | | protocol | string | yes | Protocol name. |

analyzeGovernance

Analyze governance decentralization. Token distribution, voting participation, proposal activity, admin controls, and centralization risk score.

| Parameter | Type | Required | Description | | --- | --- | --- | --- | | includeHolderAnalysis | boolean | no | Include top token holder analysis. Default: true. | | protocol | string | yes | Protocol name. |

getEconomicSecurity

Assess economic security: TVL sustainability, tokenomics, whale concentration, revenue model, insurance coverage, and rug pull probability.

| Parameter | Type | Required | Description | | --- | --- | --- | --- | | chain | string | no | Chain to analyze. | | includeInsurance | boolean | no | Include insurance coverage options. Default: true. | | protocol | string | yes | Protocol name. |

compareProtocols

Compare risk scores across multiple protocols side-by-side. Ranks protocols and shows best-in-category for each risk dimension.

| Parameter | Type | Required | Description | | --- | --- | --- | --- | | dimensions | array | no | Dimensions to compare: "smart_contract", "economic", "governance", "operational", or "all". | | protocols | array | yes | Protocol names to compare (2-5 protocols). |

Types

Shared types come from @sperax/agent-tools-core: BuiltinToolManifest, BuiltinToolResult, BuiltinToolContext, and the BaseExecutor class every tool executor extends.

Related

• @sperax/agent-tools-core — the tool contract
• All SperaxOS agent tools — tool-protocol-risk is one of many
• SperaxOS — the agent workspace these tools were built for

License

Apache-2.0