Most rugs happen after you checked.

A safety check is a photograph; a rug is a movie. Liquidity gets pulled hours after launch, clawback gets switched on, an issuer quietly un-blackholes itself and re-mints supply. This watches the chain continuously against the baseline captured when you registered, and queues an alert the moment any of it changes. Registration is refused for tokens that are already compromised — those need a verdict now, not monitoring later.

MCP tool: watch_token Price: $0.02 / call

Parameters

ParamDescription
issuerXRPL issuer address (r...)
currency3-char code or 40-char hex
subscriber_keyexisting key, to group watches on one queue (optional)
duration_hoursmonitoring window, max 168 (default 168 = 7 days)
drain_threshold_pctliquidity drop that warns you (default 50)
rebaselineon renewal, measure from today instead (default false)

Example

Call (MCP tools/call arguments):

{
  "issuer": "rsoLo2S1kiGeCcn6hCUXVrCpGMWLrRrLZz",
  "currency": "534F4C4F00000000000000000000000000000000",
  "drain_threshold_pct": 40
}

Result:

{
  "ok": true,
  "watch_id": "w_84a45dffc2d0cf1e",
  "subscriber_key": "cbk_\u2026store this, it is shown once",
  "expires_at": "2026-07-31T04:08:40Z",
  "drain_threshold_pct": 40.0,
  "baseline": {
    "pool_status": "present",
    "pool_xrp": 40064.25,
    "blackholed": true,
    "clawback_enabled": false,
    "global_freeze": false,
    "blocklisted": false
  },
  "next_step": "Store subscriber_key, then call check_alerts \u2014 it is FREE."
}

FAQ

How do I get alerted about an XRPL rug pull?

Register a watch on the token, then poll check_alerts. The ledger is polled every couple of minutes and compared against the state captured when you registered; a destroyed AMM pool, a liquidity drain past your threshold, newly enabled clawback, a global freeze, or an issuer that stops being blackholed each raise an alert.

Why does an MCP server need polling instead of webhooks?

MCP is a request/response protocol — a server cannot push to an agent. So the alert queue is durable on the server side and the agent drains it with check_alerts, which is free precisely so polling is never discouraged. Webhook delivery is on the roadmap.

Can a node outage cause a false rug alert?

No. An unreadable probe is recorded as no information rather than as change, so nothing is ever compared against a null. A vanished pool additionally has to be confirmed on consecutive polls, and only a definitive ledger 'not found' counts, before the terminal alert fires.

What does it cost to monitor a token?

$0.020 USDC buys a monitoring window of up to 7 days for one token, and calling watch_token again renews it. Collecting alerts with check_alerts is free and unlimited — you are never charged more for checking during a rug in progress.

Connect via MCP at https://cerberusindex.com/mcp — see the quickstart. Payment is automatic for x402-aware clients. Verdicts are informational risk signals, not financial advice.