Most rugs happen after you checked.
A safety check is a photograph; a rug is a movie. Liquidity gets pulled hours after launch, clawback gets switched on, an issuer quietly un-blackholes itself and re-mints supply. This watches the chain continuously against the baseline captured when you registered, and queues an alert the moment any of it changes. Registration is refused for tokens that are already compromised — those need a verdict now, not monitoring later.
MCP tool: watch_token Price: from $0.005 / window
A watch runs while you sleep — and while your agent moves on.
Register
Open a watch on a token you hold and pick a window. The current on-chain state is captured as the baseline.
Cerberus watches
Every ~2 minutes the live ledger is diffed against that baseline — liquidity, issuer flags, LP lock, blocklist.
Something changes
A drain, a freeze, clawback switched on, the pool destroyed — it is classified by severity and queued.
You act
Drain the queue with check_alerts (free) and exit, rebalance,
or notify — before the position is worthless.
For an autonomous agent
An agent that bought a token registers a watch in the same run, then polls
check_alerts on its loop. A critical alert becomes a
sell/exit action with no human in the loop — the guardrail on an irreversible
position it can't otherwise babysit.
For you
Holding an XRPL memecoin you can't stare at all day? Put a 30-day watch on it and let the alert queue be your dead-man's switch. One call tells you if the liquidity moved while you were away — no dashboard to watch, no node to run.
pool liquidity collapsed 88.0% — 120.00 XRP left of 1,000.00 XRP at baseline. Exit slippage is severe and the remainder can be pulled in a single transaction.
A watch never fabricates this: an unreadable probe counts as no information, and a destroyed pool must be confirmed on consecutive polls before the terminal alert fires.
Parameters
| Param | Description |
|---|---|
issuer | XRPL issuer address (r...) |
currency | 3-char code or 40-char hex |
subscriber_key | existing key, to group watches on one queue (optional) |
duration_days | monitoring window: 1, 3, 7, 14, 21 or 30 (default 7) |
drain_threshold_pct | liquidity drop that warns you (default 50) |
rebaseline | on renewal, measure from today instead (default false) |
Packages
Pick a monitoring window — longer windows cost less per day. Under the paywall the x402 payment demand lists every tier; your agent pays the one it wants and the watch length is set by what it pays. Renewing extends the window.
| Window | Price (USDC) | Per day |
|---|---|---|
| 1 day | $0.005 | 0.50¢/day |
| 3 days | $0.012 | 0.40¢/day |
| 7 days | $0.02 | 0.29¢/day |
| 14 days | $0.035 | 0.25¢/day |
| 21 days | $0.048 | 0.23¢/day |
| 30 days | $0.06 | 0.20¢/day |
Example
Call (MCP tools/call arguments):
{
"issuer": "rsoLo2S1kiGeCcn6hCUXVrCpGMWLrRrLZz",
"currency": "534F4C4F00000000000000000000000000000000",
"duration_days": 14,
"drain_threshold_pct": 40
}Result:
{
"ok": true,
"watch_id": "w_84a45dffc2d0cf1e",
"subscriber_key": "cbk_\u2026store this, it is shown once",
"duration_days": 14,
"price_usdc": 0.035,
"expires_at": "2026-08-07T04:08:40Z",
"drain_threshold_pct": 40.0,
"baseline": {
"pool_status": "present",
"pool_xrp": 40064.25,
"blackholed": true,
"clawback_enabled": false,
"global_freeze": false,
"blocklisted": false
},
"next_step": "Store subscriber_key, then call check_alerts \u2014 it is FREE."
}FAQ
How do I get alerted about an XRPL rug pull?
Register a watch on the token, then poll check_alerts. The ledger is polled every couple of minutes and compared against the state captured when you registered; a destroyed AMM pool, a liquidity drain past your threshold, newly enabled clawback, a global freeze, or an issuer that stops being blackholed each raise an alert.
How much does monitoring cost, and how do the packages work?
You buy a monitoring window as a package: 1 day for $0.005 up to 30 days for $0.060 USDC, with a lower per-day rate the longer the window. Under the paywall the x402 payment demand lists every tier and your agent pays the one it wants; the watch length is set by what it pays. Renewing extends it. Collecting alerts with check_alerts is always free and unlimited — you are never charged more for checking during a rug in progress.
Why does an MCP server need polling instead of webhooks?
MCP is a request/response protocol — a server cannot push to an agent. So the alert queue is durable on the server side and the agent drains it with check_alerts, which is free precisely so polling is never discouraged. Webhook delivery is on the roadmap.
Can a node outage cause a false rug alert?
No. An unreadable probe is recorded as no information rather than as change, so nothing is ever compared against a null. A vanished pool additionally has to be confirmed on consecutive polls, and only a definitive ledger 'not found' counts, before the terminal alert fires.
Related tools
https://cerberusindex.com/mcp — see
the quickstart. Payment is automatic for x402-aware clients.
Verdicts are informational risk signals, not financial advice.