Create an agent. Choose what to share.
Start in Agents to explore published cybersecurity agents, or Coins to find agents associated with a public Solana mint. Open Deploy an agent to create your own. Saving an agent requires sign-in; running a live investigation separately requires verified holder access.
Select Token Guard, Repo Recon, or Tech Discovery. Give your agent a name and the public mint, repository, or research topic it should inspect.
Add a description, optional artwork, and an optional coin association. Review the target and save. Your profile starts private.
Publishing shares the profile, target, associated mint, and latest run’s sanitized logs and evidence. Keep it private if you do not want those details in the public directory.
Verify holder access, then start one bounded investigation. Follow recorded terminal events, open the findings and sources, and review the coverage limits.
The isolated demo uses fictional agents and results. It needs no account, queries no real target, and uploads no artwork.
Start with a real concept, not an empty form.
The protocol explorer explains six parts of the Solana stack: SPL Token, Token-2022, Pump and PumpSwap, Raydium CPMM, Anchor, and Metaplex Token Metadata. Each guide follows the same structure: what it does, how its accounts or components interact, which controls matter, what GudTek can inspect, and where the evidence stops.
These are source-backed reference guides. The public repository snapshot is a separate, bounded observation of an allowlisted GitHub repository. A successful refresh displays its observation time and pinned commit. If the provider is unavailable, the page explains that failure instead of inventing fresh metadata. Public reference material does not launch a holder-only agent or grant access to private workspace records.
A documentation repository, an IDL, an SDK, and an on-chain program are different artifacts. For example, Pump’s public documentation and interfaces do not establish that its complete program implementation was inspected. The guides preserve those distinctions.
When a guide raises a concrete source question, choose Repo Recon with the public repository as its target. To check a particular memecoin’s permissions, choose Token Guard with its verified mint. A protocol’s general documentation is not a security report for every token using it.
Explore the protocolsBalances, eligibility, and identity are different things.
The holder network ranks observed public wallets by their aggregated balance of the configured GudTek token. It shows supply share, the number of observed token accounts, and whether that observed balance meets the configured access threshold. Before the official mint is configured, the live view is explicitly prelaunch; its separate example view uses fictional records.
| Signal | What you can conclude |
|---|---|
| Public wallet balance | The indexed token accounts observed for that address held the displayed amount. Different calls can observe different slots. |
| Balance eligibility | The observed amount meets the configured token threshold, when the snapshot and threshold permit that calculation. |
| Authenticated access | The account must still sign in, prove wallet ownership through Privy, and pass a fresh server-side check before a real launch. |
| Who is behind a wallet | An address does not establish a person’s name, country, intent, or beneficial ownership. Identicons distinguish addresses; they are not verified profiles. |
Search, sort, filter, and open a wallet row to inspect its exact address and observation details. Supply share is based on finalized mint supply; the indexed token accounts may come from different slots. The table labels incomplete coverage and limits ranks to the observed population. It does not convert missing accounts or uncertain data into a complete holder census.
The holder directory does not publish private account IDs, linked email addresses, agent targets, run history, or authentication records. Holding a token is not a public endorsement, identity verification, or a promise about its value.
Open the holder networkThree agents. Explicit boundaries.
| Agent and input | What a real run does |
|---|---|
Token GuardSolana mint address | Reads mainnet mint authorities, selected Token-2022 controls, and available largest-account concentration using the token scanner. The result contains the underlying token report and its unresolved checks. |
Repo Reconowner/repository | Reads a public GitHub repository at a pinned default-branch commit. Inventories bounded paths, samples up to six supported text files, maps declared tooling and entry points, and flags source patterns for review. |
Tech DiscoveryPlain research keywords | Returns up to five public, non-fork, non-archived GitHub candidates ordered by recent updates. This run reads repository metadata only; it does not inspect their source code or assign a trust score. |
Create now, run when eligible
Sign in to save an agent definition, edit its profile, upload artwork, and choose its visibility. These actions do not require a token balance. Run after deploying is optional and available when holder access is verified; otherwise the definition stays ready for a later run.
Each live run checks the authenticated account’s verified linked Solana wallets and finalized holdings for the operator-configured access mint. An entered address or an earlier eligibility badge does not authorize execution. If the mint, minimum holding, or verification services are unavailable, you can still manage your saved agent while live runs stay closed.
Publish only what you intend to share
Profiles are private by default. Publishing makes the name, mission, description, artwork, target, associated mint, and latest run’s sanitized terminal events and result visible on the public profile. The directory shows a shorter summary. Your account identifier, linked-wallet records, raw errors, and full run history are excluded. Returning a profile to private removes it from the public views.
Coins groups the mint associations of published agents returned by the directory. It does not create a token, verify project ownership, or establish a relationship between a repository and a mint. Counts cover that returned sample; they are not global holder or market metrics.
Add real artwork
Upload a still PNG, JPEG, or WebP image up to 3 MiB. GudTek validates and converts it to a metadata-free WebP up to 1,600 pixels per side, then stores it in Vercel Blob. The upload is complete only when storage returns a saved asset.
Artwork URLs are public even when the agent profile is private. Use images intended for public viewing. Removing an image from a profile or making the profile private does not delete the stored image. Each account can retain up to 40 images, with three upload attempts per minute; contact the operator to remove unused stored artwork.
A saved agent is a configuration, not a resident process
Each launch queues one bounded background review. The worker has a 45-second execution budget, with no automatic retry or recurring schedule. You can leave the page and return to read the stored state; hosting interruptions can still end a run before a result is saved. One run can be active per account.
Queued and running states show saved lifecycle messages and worker progress, refreshed about every two seconds. The terminal chart plots cumulative recorded events against elapsed seconds; it is not a price chart or security score. A completed run can contain a partial result: the worker finished, but some selected evidence was unavailable. Failed runs include an error, and cancelled runs do not save a final result. Read the result’s own coverage status and limitations, not just its completion label.
Use the cancel control to stop an active run. Cancellation is saved immediately; further work stops at the next checkpoint, so an already issued request may finish first. If a host stops execution without saving a result, the expired run is marked failed on a later status read. Neither cancellation nor a successful run changes a token, repository, or wallet.
Source mapping is not proof of originality
Repo Recon links to the pinned Git commit and sampled files. Architecture notes are inferences from paths, manifests, and supported source patterns. The worker does not compare the repository with other codebases, verify contributor identities, prove provenance, execute code, install packages, run tests, or check vulnerability databases. Possible credential indicators show file and line locations with values withheld.
Tech Discovery results are leads for further research. Stars, repository age, recent activity, descriptions, and a declared language do not establish safety, originality, or innovation. Follow a candidate with Repo Recon and an appropriately scoped independent review.
Agents do not provide continuous monitoring, alerts, automatic fixes, trades, permission changes, or asset recovery. A saved configuration can be launched again when you choose.
Your account supports up to 20 saved agents and 500 stored runs, with a limit of six launch attempts per minute. Delete an unused agent and its history to free storage; cancel its active run before deleting it. The isolated demo uses separate session storage and synthetic fixtures, not account records or live eligibility checks. Visit the agent directory for published profiles, or open the mission guides for each specialist’s scope.
Open your agentsYour plan is a working record.
The project workspace contains 12 tasks grouped into foundation, prelaunch verification, and launch operations. Add the mint address when it is available; a missing mint does not prevent you from planning.
| Stage | Use it when |
|---|---|
| Planning | You are defining custody, token design, distribution, and responsibilities. |
| In review | Your team is checking configuration and evidence, with open questions to resolve. |
| Team ready | Your team has decided its launch plan is ready. This is a self-reported stage, not approval from GudTek. |
Checklist progress measures tasks you have marked complete. It does not inspect supporting documents, verify a liquidity lock, audit a contract, or independently certify the team. Keep evidence in your own review process and export a JSON copy of the plan when you need a dated record.
Open launch projectsScan the mint. Read the permissions.
Token scans support initialized and uninitialized mint accounts owned by the original SPL Token program or the Token-2022 program on Solana mainnet. Paste the mint address, not a wallet, trading-pair address, liquidity pool, or individual token account.
Token configuration
Program ownership, initialization, decimals, raw supply, mint authority, and freeze authority.
Extension controls
Rules for selected Token-2022 extensions, including permanent delegates, transfer hooks, fees, default state, and pausing.
Account concentration
The largest available token accounts as a proportion of raw supply. Accounts are not grouped into unique owners.
Evidence and next steps
Each finding includes its status, severity, observed evidence, and suggested review or remediation.
Scans request finalized RPC data. Separate RPC calls can observe different finalized slots. The report records the account query’s slot when supplied by the provider and a UTC check time.
Pool ownership, liquidity locks, sellability, source code, website security, team identity, and key custody are not verified by the mint scanner. They remain separate review work.
A wallet snapshot, with context.
Choose Wallet in the scanner to inspect a public account’s owner, executable flag, native SOL balance, and up to 20 recent transaction signatures. An address owned by a program is identified as such rather than assumed to be a conventional wallet.
A wallet inspection always has an unknown overall risk and no configuration score. A balance, a successful transaction, or a clean recent history does not establish trust. This view does not enumerate token approvals, detect a leaked seed phrase, identify beneficial owners, or perform sanctions screening.
Use the transaction links to review activity in the explorer, reconcile it with your own records, and investigate unfamiliar actions independently. Connecting a wallet for sign-in does not authorize GudTek to move funds.
Read the evidence before the number.
| Status | What it means |
|---|---|
| Pass | The observed data satisfied this specific rule. Other controls may still create risk. |
| Review | A capability or condition needs interpretation against the project’s intended design. |
| Flagged | A rule found a configuration that conflicts with common freely tradable, fixed-supply launch expectations. |
| Unknown | The check is unsupported, unavailable, incomplete, or outside what public account data can establish. |
Severity describes the rule’s potential impact. Status describes the observation. For example, a high-severity authority rule can pass when the corresponding authority is revoked. A warning is not an accusation that a project is malicious.
The token configuration score is a transparent heuristic over the automated rules. It is not a safety percentage, investment recommendation, audit grade, or prediction of future behavior. Unresolved automated data makes the score unavailable. Out-of-scope controls remain unknown even when a numeric score is available.
Report exports include the address, network, time, slot, findings, evidence, remediation, and coverage limitations. Example reports are labeled as fictional; they do not come from an on-chain request.
Understand scoring and coverageKnow where your work is saved.
| Information | Where it lives |
|---|---|
| Guest launch projects | Browser local storage on this device. Clearing site data can remove them. |
| Signed-in launch projects | The application database, associated with your authenticated account. A storage failure is shown as an error. |
| Agent profiles and run history | The account database. Explicitly published profiles expose their public fields and sanitized latest-run evidence. Deleting an agent removes its stored run history. |
| Uploaded agent artwork | Public Vercel Blob storage, with an owner-scoped asset record in the database. Profile privacy and image URL visibility are separate. Removing a profile does not delete its uploaded image. |
| Recent direct scan reports | Browser local storage. Export a JSON copy for records you need to retain. |
| Demo work | Separate browser session storage with synthetic fixtures. It is not merged into guest or signed-in workspaces. |
| Downloaded plans and reports | The location chosen by your browser. You control subsequent storage and sharing. |
Signing in does not automatically import your guest projects. Guest and account project workspaces are separate. On a shared device, review locally saved information before leaving and use your browser’s site-data controls when appropriate.
Read the data-use noticePublic discovery and account APIs.
Public reference endpoints GET /api/holders and GET /api/protocols/:id return only configured public token observations and allowlisted protocol repository snapshots. Public agent discovery uses GET /api/agents/directory and GET /api/agents/directory/:id. Only explicitly published profiles and their allowed latest-run evidence are returned; private or missing profiles return 404. The directory returns at most 100 profiles with coverage information. These endpoints do not start runs. The account endpoints below back the authenticated application. Use a current Privy access token issued for this deployment in the Authorization: Bearer <access_token> header. A wallet address alone is not authentication. Never embed an app secret in client code.
| Method and path | Purpose |
|---|---|
GET /api/agents | List owned agent configurations and their latest runs. |
GET /api/agents/access | Perform the current account’s server-side holder check. |
POST /api/agents | Sign in and save an agent definition. Holder verification is not required to create it. |
PATCH /api/agents/:id | Update an inactive owned agent’s description, publication choice, stored image, or permitted coin association. |
POST /api/uploads | Upload one still image in the multipart file field; returns its saved asset ID, URL, width, and height. |
GET /api/agents/:id | Read an owned agent and its latest 20 runs. |
DELETE /api/agents/:id | Remove an owned, inactive agent and its stored history. |
POST /api/agents/:id/runs | Recheck eligibility and queue one background run. Returns HTTP 202 with the run record. |
GET /api/agent-runs/:id | Read an owned run’s state, logs, and result. |
POST /api/agent-runs/:id/cancel | Cancel an owned queued or running review. |
POST /api/scan | Run a direct read-only token or wallet check. |
GET /api/projects | List projects owned by the current account. |
POST /api/projects | Create a project with validated fields. |
GET /api/projects/:id | Read an owned project. |
PATCH /api/projects/:id | Update fields on an owned project. |
DELETE /api/projects/:id | Delete an owned project. |
GET /api/status | Read configuration indicators. This is not a provider uptime check. |
{
"name": "Launch repository review",
"type": "repo_recon",
"target": "owner/repository"
}Agent configuration bodies are limited to 4,096 bytes. Supported types are token_guard, repo_recon, and tech_discovery. Saving a configuration and starting its run are separate API actions. Account mutations require authentication; only starting a live run additionally requires current holder eligibility. Optional creation fields are description, coinMint, imageAssetId, and published, which defaults to false. Images must reference a ready upload belonging to the same account; arbitrary image URLs are not accepted.
{
"address": "<solana-mainnet-public-key>",
"kind": "token"
}A successful scan returns { "report": { ... } }. Errors contain a readable error; scan errors also include a machine-readable code when available. Requests are limited to six scans per account per minute. A 429 response includes Retry-After in seconds.
The scan endpoint accepts JSON bodies up to 2,048 bytes. The application supports up to 100 cloud projects per account. Project writes are scoped to the authenticated owner; supplying another account’s project ID does not grant access.
Resolve the blocker, preserve the uncertainty.
Agent access says it is not configured.
You can sign in and save an agent. Live runs open only after the operator configures the access mint, positive minimum holding, and verification services. An entered wallet address or browser balance does not bypass that check. Use the isolated demo to explore a completed investigation.
My artwork upload failed.
Use a still PNG, JPEG, or WebP within 3 MiB. A damaged file, unsupported animation, oversized dimensions, upload limit, or unavailable storage can reject the request. Your existing profile image stays in place until a replacement is successfully uploaded and saved.
My agent is missing from the public directory.
Profiles start private. Open its Details tab, review what publishing shares, and save the publication setting. Public discovery returns a bounded sample, so a profile may also fall outside the first 100 entries. Its direct public link works only while the profile is published.
I hold the token but verification did not succeed.
Use a verified Solana wallet linked to your signed-in account. A missing wallet, insufficient holdings, an unavailable provider, or inconsistent finalized balance snapshots can block access. Read the specific message and retry when the cause is resolved. A successful earlier check does not guarantee eligibility for a later launch.
My run completed, but its result is partial.
Completion means execution ended and saved a result. Partial coverage means some evidence remained unavailable or outside the selected sample. A truncated repository tree, unreadable source files, or unknown token checks can cause this. Read the coverage details before drawing a conclusion.
My run stopped or was cancelled.
Runs have a bounded execution window and do not retry automatically. Cancellation stops further work at the next checkpoint. A timed-out, interrupted, or failed run does not imply the target passed. Start a new run when ready.
“This address is not a supported SPL token mint.”
Check the address against the project’s verified mint. Wallets, pool accounts, token accounts, and executable programs cannot be scanned as mints. Choose Wallet for an account snapshot.
“No account exists at this address on mainnet.”
Confirm the network and address. A planned token or a devnet mint has no matching mainnet mint to inspect. Continue with the prelaunch checklist until the mainnet account exists.
The score is unavailable or a check is unknown.
Unknown is an intentional result. Provider data may be missing or inconsistent, the mint may have zero supply, or an extension may require specialist review. Read the finding, resolve the cause, and rerun. An incomplete check is never converted into a pass.
I cannot sign in or run a live scan.
Privy must be configured for the deployment and its allowed origins. Live scans also require a configured RPC provider and database-backed rate limits. Expired sessions require signing in again; configuration or provider errors are displayed separately.
My project could not be saved.
An account project is only saved when the database write succeeds. Retry after the service recovers. Guest projects require browser storage; private-browsing or storage restrictions can prevent a local save. Export important work when available.
Does my saved project keep checking itself?
No. Saving a project or an agent does not create a recurring schedule. An explicitly launched agent runs once in the background; it does not monitor continuously or send alerts. Launch another review when you need a fresh observation.