RyoCryptoGuard

The complete pre-trade safety layer for AI agents — contract security + live market context.

RyoCryptoGuard is a pre-transaction hook for AI coding agents (Claude Code, Codex, Cursor, etc.) that automatically analyzes smart contracts and live market conditions before any crypto transaction is executed. It detects honeypots, blacklist functions, rug pulls, and scam tokens by cross-referencing multiple independent security oracles — and now enriches every analysis with real-time technical data from the RYO market research API.

The Problem

AI agents are increasingly used to execute crypto transactions — swapping tokens, interacting with DeFi protocols, and managing wallets. But they have no built-in safety layer to detect:

• Honeypot tokens — You can buy but never sell
• Blacklist contracts — The owner can freeze your funds after you buy
• Rug pulls — Liquidity can be removed instantly
• Tax manipulation — Fees can be changed to 100% after purchase
• Airdrop scams — Malicious tokens sent to bait interaction
• Overbought entries — Buying into a technically exhausted rally (RSI ≥ 80)

RyoCryptoGuard stops these before a single wei leaves your wallet.

How It Works

You/AI Agent: "swap 1 ETH for TOKEN_X on Uniswap"
                    |
            [CryptoGuard Hook]
                    |
        +-----------+-----------+-----------+
        |           |           |           |
    GoPlus API   Bytecode    Reputation   RYO Market
    Security     Scanner     Aggregator   Research
        |           |           |           |
        |     +-----------+    |        Price, RSI,
        |     | honeypot.is|   |        ATR, Verdict
        |     | TokenSniffer|  |
        |     | De.Fi       |  |
        |     | QuickIntel  |  |
        |     +-----------+    |
        +-----------+-----------+-----------+
                    |
            Risk Score: 0-100
            + Market Context
                    |
          SAFE -> Allow transaction
          HIGH -> BLOCK transaction

Data Sources

CryptoGuard queries 6+ independent sources in parallel:

What It Detects

Quick Start

Install

pip install ryocryptoguard

Install the AI Agent Hook (recommended)

# Automatically installs the Claude Code pre-transaction hook
ryocryptoguard install-hook

# Or with custom risk threshold
ryocryptoguard install-hook --threshold CRITICAL  # Only block critical risks
ryocryptoguard install-hook --threshold MEDIUM    # Block medium and above

One-Line Install

pip install ryocryptoguard && ryocryptoguard install-hook

Manual Check

# Check a token on Ethereum
ryocryptoguard check 0xdAC17F958D2ee523a2206206994597C13D831ec7 --chain ethereum

# Check on BSC
ryocryptoguard check 0x... --chain bsc

# JSON output (for scripts)
ryocryptoguard check 0x... --chain polygon --output json

# Quick check (just risk level, for scripting)
ryocryptoguard check 0x... -q
echo $?  # 0=safe, 1=medium, 2=high/critical

Market Research Commands (requires RYO_MCP_KEY)

Set your RYO builder key once:

export RYO_MCP_KEY="ryo_mcp_your_private_key"

Then use the new market commands:

# Analyze a single token — price, RSI, ATR, market intel
ryocryptoguard market SOL

# Deep analysis — includes catalysts, risks, ATR-based plan, derivatives
ryocryptoguard market SOL --deep

# Compare two to four tokens side-by-side
ryocryptoguard market SOL AVAX BNB --intent swing

# Check 7-day market-wide sentiment shift
ryocryptoguard sentiment

# JSON output for any market command
ryocryptoguard market SOL --output json
ryocryptoguard sentiment --output json

When RYO_MCP_KEY is set, check automatically fetches market context too — the terminal report gains a RYO Market Context panel showing price, 24h change, RSI, and key points. The hook blocking message gains a one-line market headline.

Integration

Claude Code (Automatic)

After ryocryptoguard install-hook, every cast send, swap, approve, and other transaction commands are automatically intercepted and analyzed.

The hook adds this to your ~/.claude/settings.json:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hook": "python -m cryptoguard.hook"
      }
    ]
  }
}

OpenAI Codex / Other Agents

Use CryptoGuard as a pre-exec wrapper:

# Wrap any command
ryocryptoguard check 0xTOKEN_ADDRESS --chain ethereum -q && cast send 0xTOKEN_ADDRESS ...

Python API

from cryptoguard import analyze

result = analyze("0xdAC17F958D2ee523a2206206994597C13D831ec7", chain="ethereum")

print(f"Risk: {result.risk_level.value} ({result.risk_score}/100)")
print(f"Safe: {result.is_safe}")
print(f"Should block: {result.should_block}")

for finding in result.findings:
    print(f"  [{finding.severity.value}] {finding.title}")

# RYO market data (present when RYO_MCP_KEY is set)
if result.ryo_market:
    print(result.ryo_market["summary"]["headline"])

MCP Server

Add to your Claude Code MCP config or any MCP-compatible client:

{
  "mcpServers": {
    "ryocryptoguard": {
      "command": "python",
      "args": ["-m", "cryptoguard.mcp_server"]
    }
  }
}

Three tools are exposed:

An AI agent can now do the full pre-trade workflow through one MCP server:

cryptoguard_check("0xABC...")       → is the contract safe?
ryo_market_context("CAKE")          → is the market timing sensible?
ryo_compare_tokens("SOL, AVAX")     → which asset looks stronger?

Remote RYO MCP (direct)

If you prefer to call RYO's own MCP endpoint directly from a client:

{
  "mcpServers": {
    "ryo": {
      "url": "https://app-ryochan.com/api/mcp",
      "headers": { "Authorization": "Bearer ${RYO_MCP_KEY}" }
    }
  }
}

Configuration

Environment Variables

Copy .env.example to .env and fill in your values. Never commit a populated .env.

Supported Chains

Ethereum, BSC, Polygon, Arbitrum, Base, Optimism, Avalanche, Fantom, zkSync Era, Linea, Scroll, Mantle, Blast

Architecture

cryptoguard/              # Python package (pip install ryocryptoguard)
  __init__.py       # Public API
  cli.py            # Click CLI (ryocryptoguard / cryptoguard commands)
  hook.py           # AI agent pre-transaction hook
  analyzer.py       # Core analysis engine + risk scoring
  scanner.py        # EVM bytecode pattern analysis
  goplus.py         # GoPlus Security API client
  reputation.py     # Multi-source reputation aggregator
  ryo.py            # RYO market research REST client (NEW in v0.2)
  report.py         # Terminal report formatter (Rich)
  mcp_server.py     # MCP server for tool-based integration
  constants.py      # Chains, selectors, weights

Risk Scoring

Risk score is 0–100, computed from weighted findings with diminishing returns within categories:

RYO market findings are capped at LOW severity — they never change the BLOCK decision. Market context is informational enrichment only.

Development

git clone https://github.com/yabig/CryptoGuard.git
cd CryptoGuard
pip install -e ".[dev]"

# Run tests
pytest

# Lint
python -m ruff check cryptoguard/

# Build distribution
pip install build
python -m build

# Upload to PyPI
pip install twine
twine upload dist/*

FAQ

Does this slow down my transactions? Analysis takes 2–5 seconds (parallel API calls). Market enrichment runs in the same parallel pool — it adds no extra wall-clock time when RYO_MCP_KEY is set.

Does it need API keys? No keys required for the safety layer. GoPlus, Honeypot.is, TokenSniffer, De.Fi, and QuickIntel all have free public tiers. RYO_MCP_KEY is only needed for market research commands.

Can it detect all scams? No tool can guarantee 100% detection. CryptoGuard significantly reduces risk by cross-referencing multiple independent sources, but novel scam techniques may bypass detection. Always DYOR.

Does it work with hardware wallets? CryptoGuard analyzes the contract, not the wallet. It works regardless of how you sign transactions.

Can I use it without an AI agent? Yes. The CLI works standalone:

ryocryptoguard check 0x... --chain ethereum
ryocryptoguard market SOL

Does RYO market data affect the BLOCK decision? No. RYO findings are LOW/INFO severity only. The blocking threshold is driven entirely by contract security findings. This boundary is intentional and will not change.

License

MIT

Credits

Built by yabig. Security data powered by GoPlus, Honeypot.is, TokenSniffer, De.Fi, and QuickIntel. Market research powered by RYO.

PyPI: pypi.org/project/ryocryptoguard

If this tool saves you from a scam, star the repo and share it. Every star helps protect more people.