# Automaton Colony

> Automated security screening of smart contracts and native tokens on Base (chain 8453).
> Reports are paid in USDC through a public on-chain escrow that holds the money until the
> report is delivered, and refunds automatically if the deadline passes without delivery.

Two things separate this from a scanner. Every report states what it could **not** verify,
as open items with the reason, instead of folding uncertainty into a score. And the hash of
each report is anchored on Base at the moment of purchase, so the copy a buyer holds can be
checked against the chain and shown to be the one that was issued.

There is a free check that needs no wallet and no account. It returns observed data with no
verdict and no score: verified source status, proxy detection, admin function selectors,
holder concentration, and for B20 native tokens the issuer powers read from the chain. The
paid report is what interprets that evidence.

## Pages

- [Free check and store](https://automatoncolony.xyz/app/en/): paste a Base address, see what
  the chain says about it, then buy a full screening if the data warrants it.
- [B20 on Base is 0xef](https://automatoncolony.xyz/app/en/b20/): why a contract scanner reports
  "unverified, no admin functions" for a B20 token, what the issuer can still do (mint, burn,
  burnBlocked, seize, pause, transfer policies, metadata), and how to read one before buying.
- [Honeypot checks on Base](https://automatoncolony.xyz/app/en/guides/honeypot-check-base/):
  the six mechanisms that stop you selling and which checks catch each one.
- [Audit or screening](https://automatoncolony.xyz/app/en/guides/audit-vs-screening/): what a
  human audit buys that an automated screening does not.
- [Limits of automated screening](https://automatoncolony.xyz/app/en/guides/screening-limits/):
  what no point-in-time check can tell you, upgradeable logic above all.
- [Verifying a report](https://automatoncolony.xyz/app/en/guides/verify-report-hash/): how to
  check a report was not edited after it was issued.
- [Security evidence](https://automatoncolony.xyz/app/en/guides/security-evidence/): what can be
  checked about the service itself (verified non-upgradeable contracts, tests, static analysis,
  pinned frontend, anchored reports) and what has not been done. Also in Spanish:
  https://automatoncolony.xyz/app/es/guides/security-evidence/
- [Glossary](https://automatoncolony.xyz/app/en/glossary/): the terms the reports use, defined once
  (honeypot, unbounded mint, upgradeable proxy, admin keys, timelock, renounced ownership, holder
  concentration, anchored hash, escrow, x402, B20). One page per language under each store, e.g.
  https://automatoncolony.xyz/app/es/glossary/

- [About](https://automatoncolony.xyz/app/en/about/): who operates the service (an independent
  developer in Spain), what it does not promise, how the escrow works, how to contact support.
  One page per language under each store, e.g. https://automatoncolony.xyz/app/es/about/
- Legal texts, binding in Spanish and anchored by hash: [Terms of Service](https://automatoncolony.xyz/terms),
  [Privacy Policy](https://automatoncolony.xyz/privacy), [index](https://automatoncolony.xyz/legal).
  Vulnerability reports: https://automatoncolony.xyz/.well-known/security.txt

## For agents

The Flash Report can be bought over the x402 protocol with an EIP-3009 authorization, in USDC on
Base, with no browser and no account. The endpoint answers 402 with the payment terms, accepts
the signed authorization, settles on chain and returns the report.

Single on-chain facts are also sold one call at a time, from 0.0049 USDC, and those come back IN
THE SAME RESPONSE: there is no order to poll. Each answer carries the Base block it was read at and
that block's hash, so it can be re-read against the chain, and it states how long it stays valid.

- `/api/v1/x402/datos/codigo-verificado` — 0.0099 — verified source status and the deployed runtime
  code hash.
- `/api/v1/x402/datos/proxy-implementacion` — 0.0099 — whether it is an upgradeable proxy, and the
  implementation it points at.
- `/api/v1/x402/datos/poderes-admin` — 0.0099 — the dangerous selectors found (mint, pause,
  blacklist, upgradeTo and the rest).
- `/api/v1/x402/datos/estado-cadena` — 0.0049 — the anchor block, its hash and its timestamp.
- `/api/v1/x402/datos/concentracion-tenedores` — 0.0399 — what share of supply the largest holder
  has, and whether it is a wallet that can dump or a contract that cannot.
- `/api/v1/x402/datos/poderes-emisor-b20` — 0.0399 — issuer powers of a Base native B20 token:
  mint, burn, seize, pause and transfer policies.
- `/api/v1/x402/datos/cribado-completo` — 0.0699 — all of the above in one call.

- [x402 on Base](https://automatoncolony.xyz/app/en/x402/): the endpoint, the three responses, the
  fields an agent has to sign, and the failure modes worth handling.
- MCP server (Streamable HTTP, JSON-RPC 2.0 by POST): https://automatoncolony.xyz/mcp — tools
  `check_contract_free`, `flash_audit_terms`, `buy_flash_audit` (paid over x402: the PaymentPayload
  travels in `_meta["x402/payment"]`, as in the official `@x402/mcp` client), `collect_flash_audit`,
  `contract_data_catalog` (free: what single facts are for sale and at what price) and
  `buy_contract_data` (paid, answered in the same call).
- OpenAPI 3.1 with `x-payment-info`: https://automatoncolony.xyz/openapi.json
- ERC-8004 agent registration file: https://automatoncolony.xyz/.well-known/agent-registration.json
  (agent 84609 on Base, owned by the treasury that receives the payments).

## What this is not

Automated screening, not a professional audit reviewed by a person. Not financial advice, and
not a guarantee that a contract is safe: the absence of a signal means the signal was not
observed, never that the risk is absent. Reports are generated by a large language model
combined with deterministic rules, disclosed under Article 50 of the EU AI Act.