RugCheck: read the evidence beneath the score

The short answer

RugCheck is a Solana-focused token screening service. Its current public API can generate full and summary reports with a score, named risks, token program and type, mint and freeze authorities, Token-2022 extensions and transfer fees, markets and liquidity, lockers, top holders, creator history, insider-network fields, known accounts, verification data, and a detected-rug state.

The score is a weighted summary, not a probability

RugCheck's report schema exposes raw and normalized scores plus an array of named risks with level, description, value, and score contribution. Read the complete risk list. A single aggregate number hides which conditions were detected, how heavily they were weighted, and what the scanner did not know.

Do not translate a score into “chance of rug,” expected return, or safe position size. Automated rules change, reports can be cached, and a token can change after scanning. Preserve the report time and fields, then verify the conditions that would invalidate the trade regardless of the total.

Authorities describe capabilities, not the operator's intention

Mint authority can allow more supply; freeze authority can freeze token accounts. Metadata update authority can change presented token information. Token-2022 adds extensions with their own authorities and behaviors, including transfer fees. RugCheck surfaces these fields so traders can find retained control quickly.

Renounced basic authorities do not make a token safe. The relevant control may sit in a launchpad, liquidity position, upgradeable program, transfer-hook program, delegate, concentrated holder set, or offchain administrator. Open each authority and extension in the explorer and identify exactly what it can still do.

Locked liquidity constrains one exit path under specific terms

RugCheck reports markets, total market and stable liquidity, LP providers, lockers, lock percentages, owners, programs, values, and unlock dates when available. Confirm the pool address and inspect the actual LP token or concentrated-liquidity position. A burn wallet, locker, and time lock are different mechanisms.

A lock does not stop minting, holder dumps, transfer taxes, a malicious token extension, migration to another pool, price manipulation, or liquidity added on unfavorable terms. Displayed USD liquidity is also not guaranteed output. Request a live route for your position size and review liquidity depth.

Address concentration and insider graphs require entity analysis

Top-holder percentages are a starting point. Pools, lockers, burns, exchanges, programs, treasuries, team wallets, and ordinary holders need separate classification. Several addresses can share one controller; one exchange address can represent many users. Raw address counts can understate or overstate economic concentration.

RugCheck's current API includes insider graph and network endpoints and reports a detected-insider count. Treat these as derived connections. Verify funding, transfers, timing, program interactions, and alternative service explanations before assigning common ownership or intent. Use Bubblemaps and explorers as independent views, not as automatic confirmation of the same inference.

Creator history and verification answer narrower questions

The API can return creator token history, rugged-token counts, average launch score, blacklist state, and last activity. That helps identify a repeated deployer address. A creator can change wallets, use a launch service, share an address, or be mislabeled; a new address can have no history at all.

RugCheck also exposes token verification and eligibility fields, including metadata, domain, submitted links, and authority or liquidity criteria. Verification can connect submitted identity data to a mint under defined rules. It is not an audit, endorsement, identity guarantee, or promise that economic controls will stay unchanged.

A report is a time-bounded observation

Authorities can be revoked, transferred, or exercised; holders and liquidity move; lockers expire; metadata changes; new markets open; and a token can be marked rugged after an earlier clean scan. The public API supports cached summary behavior and paid forced regeneration, which makes report freshness a first-class field.

Refresh immediately before a decision, record the result, and compare material fields with current chain state. If an endpoint errors, rate-limits, returns partial data, or does not recognize the token program, fail open only for research—not for the trade.

A safer report workflow

1. Resolve the mint. Ignore names and tickers until the exact Solana address and token program are confirmed.
2. Save the report. Record time, score, every risk, freshness, errors, verification state, and detected program.
3. Audit control. Verify mint, freeze, metadata, extension, hook, delegate, and relevant program authorities.
4. Audit exit liquidity. Match pools and lockers, inspect unlock conditions, and quote the intended sell size.
5. Aggregate entities. Classify holders and rebuild insider, creator, funding, and transfer claims transaction by transaction.
6. Define what remains unknown. Include unsupported programs, offchain control, social identity, wash activity, future changes, and execution risk.

What belongs in the journal

Record mint, token program and type, report URL and time, raw and normalized score, every risk and value, mint/freeze/metadata/extension authorities, transfer fees, pools, liquidity and live quote, lockers and unlocks, top-holder classifications, insider and creator evidence, verification state, errors or missing fields, explorer transactions, and your independent conclusion.

Primary sources