Use cases
The check takes a couple of seconds and costs 5 credits. It is meant to sit in the moment before a decision, not in a report somebody reads next week.
An agent negotiating a job, buying data, or paying an invoice gets an address from something it does not control. One x402 call, no account and no key, and it knows whether that address is on the OFAC list, whether it is a wallet or code, and whether the token it is being offered takes a cut of every transfer.
The caller here is already a wallet holding USDC on Base, which makes this the one endpoint whose audience is exactly its payment method.
A finance script that pays vendors on-chain runs each new address once and files the response. Sanctions membership, account type, and — when the vendor wants paying in a token — whether that token has a pauser who could freeze the balance after it lands.
Every signal carries the observation it came from, so the record you file is evidence rather than a number somebody has to trust.
Show the user what they are about to interact with: unverified source, an upgradeable proxy whose code can be swapped tomorrow, a named blacklister, a transfer that delivers less than it promises. Each with a sentence explaining what was actually observed.
And show the gaps. A warning UI that hides what it could not check teaches people that a quiet screen means safe.
Before a token appears in a picker, a pool, or a payment option, run the contract check. Metadata that actually reads, source that matches the bytecode, no implementation pointer in the standard proxy slots, and a simulated transfer that delivers in full.
None of that is a safety guarantee, and the response says so. It is the set of things you can establish cheaply and should not skip.
Every check persists with its signals, their weights, their evidence and the list of what was not checked. Re-reading a check you already paid for is free forever, so the audit trail costs nothing to keep or to hand to somebody else.
The band is a pure function of the signals, so a reviewer can recompute it rather than take it on faith.
Which powers exist over this token, and who holds them? The role sweep names the accounts a contract itself admits to — an owner, a pauser, a blacklister, a master minter — read from the contract's own getters.
It will never tell you a token has none of those. That is not modesty; it is the one thing these reads structurally cannot establish.
5 credits an address, 8 a token contract, from the same Ounie wallet as every other Ounie app.