Every agent result should explain what was observed, how it was interpreted, and what still needs review.
Deterministic checksPublic sourcesRead-only
01 / SCOPE
A bounded review, at a point in time.
GudTek agents read selected public Solana or GitHub data and apply deterministic rules. The current workers do not use an AI model or execute target code. They do not trade tokens, exploit applications, alter permissions, write to repositories, or sign transactions.
Token Guard uses the same mainnet rules as the direct token scanner. Repo Recon samples a pinned public source snapshot. Tech Discovery produces a metadata shortlist. Each result states the observations it supports and the evidence it did not inspect.
ObserveRead bounded public data.
→
EvaluateApply documented rules.
→
ExplainShow sources and gaps.
02 / AGENT EXECUTION
The limits are part of the result.
Holder eligibility authorizes creation and launch; it says nothing about the safety of the target. The server verifies linked Solana wallets and the configured access-token balance for each eligible request. If the mint, positive minimum holding, or verification services are not configured, real agent creation and launch remain closed.
Worker
Evidence and bounds
Token Guard
One finalized-mainnet token review using the rules below. It preserves the token report’s unknown checks and coverage limits.
Repo Recon
Public GitHub metadata, one verified default-branch commit and tree, up to 4,000 tree entries, and at most six supported text files of 48 KB each. Regular file blobs are sampled; symlinks, submodules, dependency directories, and build artifacts are not followed.
Tech Discovery
Up to five public, non-fork, non-archived repository search matches ordered by recent updates. Metadata only: no source files, contributors, deployment, or commit history are inspected.
Each real launch starts one background execution with a 45-second worker budget. There is no recurring schedule or automatic retry. Logs reflect execution phases rather than a timed visual simulation. Cancellation prevents a final result from being saved and stops further work at the next checkpoint; an in-flight request may finish before that checkpoint.
A completed execution may save a partial result. Repo Recon marks partial coverage for a truncated tree, an unavailable selected file, or no supported files within its limits. Tech Discovery preserves GitHub’s incomplete-search indicator. Token Guard marks a partial result when its numeric configuration score cannot be produced. A failed or interrupted run is not a passing result.
What repository findings mean
Manifests identify declared dependency and script names. File paths suggest possible entry points and application structure. Pattern checks highlight installation hooks, credential-shaped material, dynamic execution, transaction or signing calls, and authorization checks in sampled source. They do not prove reachability, exploitability, malicious intent, or correctness.
Credential indicators contain file and line locations with matched values withheld. Repository source text is treated as data; no instructions in it are followed. No package is installed, script run, binary executed, test suite invoked, or active target probed. There is no full data-flow analysis or dependency vulnerability lookup.
Source links pin Repo Recon evidence to the inspected commit. This is reproducible source mapping, not originality detection, contributor verification, a provenance guarantee, or proof that deployed code matches the repository. Discovery candidates have no security score; their informational findings remain unknown.
03 / THE TOKEN RULES
What the token scanner checks.
Control
Interpretation
Mint initialization
An uninitialized mint is flagged. An initialized mint passes this account-state check.
Mint authority
An active authority is a high-severity flag because it can create additional supply. A null authority passes this rule.
Freeze authority
An active authority is a high-severity flag because it can freeze token accounts. Revocation does not rule out extension-based restrictions.
Permanent delegate
An active delegate is critical because it can transfer or burn holders’ tokens under the token program’s rules. Missing or malformed configuration is unknown.
Transfer hook
An active hook program or an authority capable of enabling one requires high-severity review. The custom hook program itself is not audited.
Transfer fees
Current and scheduled fee basis points are inspected. A fee of at least 1,000 basis points (10%) is high; lower values are medium review findings. Authority and cap evidence are included.
Default account state
A frozen default is a high-severity flag. An initialized default passes the specific state check.
Non-transferable token
Critical for a token intended to be freely tradable. The extension prevents ordinary transfers.
Pause control
A reported pause is flagged at high severity; a pause capability requires review.
Other supported extensions
Close authorities, metadata and group pointers, update authorities, and display-amount controls receive targeted rules. Confidential or unrecognized behavior requires further review.
These rules assume common expectations for a freely tradable memecoin. Some retained authorities and transfer controls are intentional. A flag describes a capability and its potential impact; it does not prove abuse or malicious intent.
04 / SUPPLY CONTEXT
Accounts are not people.
The scanner requests up to 20 largest token accounts, validates their amounts against raw mint supply, sorts them, and calculates the share held in the largest ten returned accounts. A share of at least 50% produces a high-severity review finding.
TOP-ACCOUNT SHAREsum(largest 10 account amounts) ÷ raw supply × 100
This is token-account concentration, not unique-holder or insider concentration. Liquidity vaults, centralized exchanges, treasury accounts, and vesting accounts are not labeled or excluded. Multiple accounts can belong to one entity. A lower percentage is not proof of a fair distribution.
A zero supply, failed query, duplicate account, mismatched decimal count, or inconsistent amount makes the concentration check unknown. The scanner does not silently substitute an empty list for a passing result.
05 / TOKEN SCORING
A number with a defined scope.
The configuration score begins at 100 and subtracts a severity weight for each automated finding with a warning or failure status. The minimum is zero. Passing findings do not subtract points. If any automated rule is unknown, the numeric score is withheld.
CRITICAL−40
HIGH−20
MEDIUM−10
LOW−4
INFO0
A 100 score is not “100% safe.”
It means the available automated rules did not subtract points. Liquidity, custom programs, off-chain systems, and team security can still be unresolved.
The overall token risk label preserves an observed critical or high finding even when other automated data is incomplete. Without a critical or high finding, incomplete automated coverage produces an unknown label. With complete automated data, the label is the highest flagged severity, or low if nothing is flagged. This summarizes automated configuration findings only.
Coverage is reported as findings with known status divided by all findings. Separate out-of-scope findings—liquidity, team controls, and project review—are retained as unknown. They reduce coverage, but they do not automatically suppress the configuration score. Read both together.
Wallet inspections have no numeric score and always report unknown overall risk. Public account properties are insufficient to assess key custody, approvals, identity, or trustworthiness.
06 / THE UNKNOWNS
What this review cannot establish.
Liquidity safety: pool identification, LP burns, lock-provider validity, withdrawal rights, lock expiration, and exit liquidity.
Sellability: successful buys or sells on any trading venue, transfer-hook behavior, or future execution conditions.
Code security: whole-program correctness, repository originality, program upgrades, resolved dependency vulnerabilities, or application penetration-test results. Repo Recon’s selected source patterns do not establish these properties.
Identity and intent: team authenticity, beneficial ownership, fraud, sanctions status, or whether a project is a suitable investment.
Future state: later supply changes, configuration changes, treasury activity, liquidity movements, or incidents after the scan.
No scan is an independent audit or certification. Before a consequential launch decision, resolve unknowns through the relevant on-chain evidence, program review, operational checks, and independent expertise.
07 / REPRODUCIBILITY
Keep the observation with the conclusion.
Token reports include the address, network, UTC timestamp, source account slot when available, findings, rule statuses, evidence, remediation, and limitations. Agent results add execution times, phase logs, source links, and coverage; repository reviews include the pinned commit and sampled file links. Export JSON to preserve the entire result rather than sharing only its score.
RPC queries use finalized commitment, but separate calls are not one atomic snapshot. The provider can be unavailable or return inconsistent data. Missing critical account fields stop the scan; incomplete secondary checks remain unknown. Rerun after remediation or whenever the underlying state may have changed.