Build an Ethereum rug-pull alert bot in 20 lines

A rug is a race, and dashboards lose it. By the time you alt-tab to a scanner, paste the address, and read the verdict, the liquidity is already in the deployer's wallet. The only thing that keeps up with a rug is another process - something that watches the chain for you and pings the instant a pool dies or a fresh high-risk contract deploys.

That is what the RektRadar API is for. It is live now: the same pipeline behind the web app - honeypot simulation, bytecode signatures, deployer graphs, liquidity and mempool analysis - exposed as a REST endpoint, a WebSocket stream, and signed webhooks, with an official TypeScript SDK on npm.

This post builds a working rug-pull alert bot in about 20 lines. First the one-call check, then the live stream, then how to wire it to Discord, Telegram, or your own trading bot.

The shape of the API

Three surfaces, one mental model:

• REST - ask about one token, get a verdict. GET /v1/token/<address> returns a 0-100 risk score and the on-chain flags behind it. Targeted lookups are real-time for everyone.
• Stream - subscribe to the firehose. A WebSocket pushes every new deploy, every completed analysis, every rug, as it happens.
• Webhooks - same events, delivered to an HTTPS endpoint you own, HMAC-signed so you can trust them.

There is one rule that shapes the whole thing: real-time is the paywall. Everything is free, but the live flow (the stream and the rug feed) arrives on a ~10 minute delay on a free key and in real time on a paid one. A rug alert that is 10 minutes late is worthless to a trader, so that is exactly where the value - and the price - sits. Targeted /v1/token lookups are real-time for everybody. Every flow response carries an X-Data-Delay-Seconds header so you always know what you are looking at.

Get a key

Grab one from your account - no credit card for the free tier: app.rektradar.io/account#api-keys. Pass it as a Bearer token (or the X-API-Key header). No key at all still works - you just get anonymous, delayed access.

The one-call check

Before the bot, the simplest thing the API does: score a single contract. Here is a real honeypot, live on mainnet:

curl -H "Authorization: Bearer rr_live_xxx" \
  https://app.rektradar.io/v1/token/0x682d9d317a077305d36c1fcc9821734046d4de2b

{
  "address": "0x682d9d317a077305d36c1fcc9821734046d4de2b",
  "score": 80,
  "flags": ["honeypot", "hidden_owner", "low_liquidity", "buy_failed", "sell_failed", "scam_factory_name"],
  "name": "BABY ASTEROID",
  "symbol": "BASTEROID",
  "analyzed_at": "2026-05-27T16:31:46.062Z"
}

Same call through the SDK:

npm install @mik3fly-lab/rektradar-sdk

import { RektRadar } from "@mik3fly-lab/rektradar-sdk";

const rr = new RektRadar({ apiKey: process.env.REKTRADAR_KEY });

const v = await rr.token("0x682d9d317a077305d36c1fcc9821734046d4de2b");
if (v.score >= 70) console.warn("high risk", v.flags);

That is the on-demand half: you have an address, you want a verdict. The interesting half is not asking - it is being told.

The bot

Here is the whole thing. It opens the live stream, listens for two kinds of event - a token that just scored high-risk, and a pool that just got rugged - and fires an alert. About 20 lines:

import { connectStream } from "@mik3fly-lab/rektradar-sdk";
import WebSocket from "ws";

connectStream({
  apiKey: process.env.REKTRADAR_KEY,   // paid key = live; omit it and events arrive ~10 min late
  events: ["token_scored", "rug"],
  WebSocket,                            // Node needs the 'ws' package; browsers use the built-in
  onOpen: () => console.log("watching Ethereum for rugs and high-risk deploys..."),
  onMessage: (e) => {
    if (e.type === "rug") {
      alert(`RUG: ${e.data.symbol ?? e.data.address} - liquidity pulled`);
    } else if (e.type === "token_scored" && e.data.score >= 70) {
      alert(`HIGH RISK (${e.data.score}/100): ${e.data.symbol} - ${e.data.flags?.join(", ")}`);
    }
  },
});

function alert(line) {
  console.log(new Date().toISOString(), line);
  // swap this for a Discord/Telegram webhook, a phone push, or a halt on your trading bot
}

Run it with a paid key and the alerts land in real time - roughly 10-12 events a minute across the whole chain, the moment they happen. Run it with no key, or a free one, and the exact same alerts arrive on a ~10 minute delay, which is fine for a research log and useless for front-running a rug. That difference is the entire pricing model in one apiKey field.

The alert() function is the part you make yours. A fetch to a Discord webhook. A Telegram sendMessage. A push notification. Or, if you run an auto-trading bot, a hard stop that refuses to buy anything the stream just flagged.

No always-on process? Use webhooks

If you would rather not babysit a long-lived WebSocket, register an HTTPS endpoint and RektRadar will POST the same events to it. Every delivery is HMAC-SHA256 signed, and the SDK verifies it for you:

import { verifyWebhook } from "@mik3fly-lab/rektradar-sdk";

app.post("/rektradar", express.raw({ type: "application/json" }), (req, res) => {
  const sig = req.header("X-RektRadar-Signature") ?? "";
  if (!verifyWebhook(req.body.toString(), sig, process.env.HOOK_SECRET)) {
    return res.sendStatus(401); // reject anything we did not sign
  }
  const { event, data } = JSON.parse(req.body.toString());
  if (event === "rug.detected" || event === "token.high_risk") notify(data);
  res.sendStatus(200);
});

Same events, no open socket - perfect for a serverless function.

Plans and limits

API access is included in every plan. The free tier is genuinely useful for research, dashboards, and backtesting; the paid tiers buy you real time and headroom.

Full endpoint reference, the event catalogue, and the SDK source are on the docs: rektradar.io/developers.

The data was always there - 100+ flags across seven analyzers, scoring thousands of Ethereum tokens a day. Now you can build on it. Ship the bot, point alert() at your channel, and let the chain wake you up instead of the other way around.