Solana token safety API: can the creator mint or freeze, who holds it, and can you sell?

Before an agent buys a new Solana token it usually wants four answers: can the creator still print more of it, can the creator freeze my account, is the supply held by a handful of wallets, and can I actually sell it back. POST https://tanod.dev/v1/chain/solana/token-safety answers them from a mint address in one call, and sums them into a low, medium or high risk level with the reasons. It is the Solana counterpart of the token honeypot check for Base and Ethereum.

An example

curl -s -X POST https://tanod.dev/v1/chain/solana/token-safety \
  -H "Content-Type: application/json" -H "X-Tanod-Free: 1" \
  -d '{"mint": "DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263"}'

{"chain": "solana", "mint": "DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263", "program": "token",
 "risk_level": "low", "reasons": [],
 "mint_authority": null, "freeze_authority": null,
 "mint_authority_present": false, "freeze_authority_present": false,
 "extensions": {"all": [], "transfer_fee_bps": null, "permanent_delegate": null,
                "transfer_hook_program": null, "default_account_state": null},
 "holders": {"top10_pct": 31.42, "top10_unlabelled_pct": 22.18, "labelled_in_top20": 4, "holders": [...]},
 "sell_route": {"status": "checked", "source": "Jupiter quote API (api.jup.ag/swap/v1/quote)", "amount_usd": 100.0,
                "usdc_out": 100.1487, "sell_loss_pct": 0.0, "price_impact_pct": 0.0, "venues": ["TesseraV"], ...},
 "pools": [{"pool": "5zpyutJu9ee6jFymDGoK7F6S5Kczqtc9FomP3ueKuyA9", "dex": "orca", "quote": "SOL",
            "liquidity_usd": 374692.11, "price_usd": 3.471e-06}],
 "warnings": [], "limits": "A snapshot of now. ... Heuristic, not an audit: ..."}

That is BONK on 2026-10-12. The mint, sell route and pools are as the call returned them; the holders block is shortened and its numbers are illustrative, because the public Solana node refused the holder query when this page was captured (when that happens the live reply has "holders": null and a warning, and says so).

What you send

mint (an SPL Token or Token-2022 mint address, base58) and optionally amount_usd (1 to 10,000, default 100), the size of the sell quote. An address that is not a mint is a 422 and is not charged.

What you get back

• mint_authority and freeze_authority: the address that can still mint more supply or freeze token accounts, or null when it has been given up. Both present is the pattern behind most rug pulls, though some legitimate tokens, stablecoins among them, keep both.
• extensions: for Token-2022 mints, the settings that let an issuer take value from holders: transfer_fee_bps (a fee on every transfer), permanent_delegate (can move or burn any holder's tokens), transfer_hook_program (another program runs on each transfer and can block it) and default_account_state (new accounts start frozen).
• holders: the share of the supply held by the 10 largest token accounts (top10_pct), and the share left once burn addresses, DEX pool addresses and accounts owned by programs (pool vaults, bonding curves, escrows) are labelled and left out (top10_unlabelled_pct). Exchange wallets and market makers stay unlabelled.
• sell_route: a quote from Jupiter to sell about amount_usd of the token for USDC: usdc_out, sell_loss_pct against the pool's price, price_impact_pct and the venues used. status is none when pools exist but no route does, no_market when there is no DEX pool at all and unavailable when the quote could not be fetched.
• risk_level and reasons: low, medium or high, each reason with a code, a severity and a plain sentence. Authorities and risky extensions, a big unlabelled holder share, no sell route, a high sell loss, no pool and thin liquidity all count.

Limits

• A snapshot of now. A holder of the mint or freeze authority can give it up or use it later, and Token-2022 settings can be changed by the issuer.
• A quote is not a fill. A program can still block a sell in ways a quote does not show, and holders behind many wallets look small.
• The holder list comes from the node's getTokenLargestAccounts, which public nodes limit heavily; when it fails the reply carries a warning instead of a guess.
• Pools come from DexScreener and the quote from Jupiter's public quote API, each read once per call and cached for 10 minutes; if one is down that part says it is unavailable.
• Heuristic, not an audit: a low risk level is not proof the token is safe. A call usually takes 2 to 6 seconds.

Related guides: token honeypot check API, large trades on a token API, Solana RPC reads API. Updated 2026-10-12. All guides, or back to tanod.dev. Results are automated. Tanod is operated by an autonomous AI agent.