A read-only contract scanner for Robinhood Chain (chainId 4663). It reads a token contract before you buy and reports what it can find on-chain — with concrete evidence for every finding. It never asks for a private key, sends no telemetry, and never tells you a token is "safe".
ALEPH MATE (MATE) robinhood chain · 4663
WARNINGS 3 findings
warn contract not verified source not published on Blockscout
warn ownership not renounced owner() = 0x9f3a…c21b
warn mint capability mint(address,uint256) · owner is active
skip sell simulation not run v4 hook pool — see "On honeypots" below
pool uniswap v4 · PoolManager holds 1,240,000 MATE
holders top-10 hold 41.2% · deployer holds 3.1%
origin deployed by 0x9f3a…c21b · 6 days ago
robinhoodchain.blockscout.com/token/0x…
aleph reports what it can read on-chain. absence of findings is not safety.
npm i -g aleph-cli
aleph scan 0x<token>scan and pool are free forever, ungated.
- Identity — bytecode present, Blockscout verification, name/symbol, age
- Deployer power — ownership, upgradeable proxy (EIP-1967 / EIP-1167), mint, mutable fee, blacklist, pause / trading gate
- Liquidity — Uniswap v4 pool existence (via the PoolManager's token balance)
- Distribution & origin — top-holder concentration, deployer share, and the launchpad the token came from
Every finding carries evidence — a function name, a selector, an address, a
number. A check that cannot run is reported skipped, never silently dropped.
The words "safe", "legit", or "verified good" never appear in the output.
Aleph does not currently ship a buy-then-sell honeypot verdict on Robinhood
Chain, and it will tell you so with a skipped finding rather than guess. The
chain's dominant pools are Uniswap v4 with per-token hooks (bonding curves):
the v4 quoter reverts outside a real swap, and transfer history routes through the
hook, so a naïve simulation would mislabel a normal token. Shipping a wrong
"not a honeypot" on a security tool is worse than shipping nothing. A correct
simulator (an atomic buy→sell via state override) is planned; until it lands,
Aleph is honest that the check did not run. Absence of findings is not safety.
| Command | What it does | Gated? |
|---|---|---|
aleph scan <address> |
Read a contract and report findings | Free |
aleph mint <address> |
Scan an NFT mint and prepare the transaction to sign | Free |
aleph lp <address> |
Prepare liquidity-provision steps to sign | Free |
aleph watch … |
Get a webhook when a contract's on-chain state changes | Credits |
aleph credits |
Show your credit balance | Login |
aleph tiers |
Show $ALEPH tiers, free credits, and action costs |
Public |
aleph login / logout / whoami |
Sign in with your wallet | — |
aleph config |
Manage RPC and network settings | — |
aleph agree |
Acknowledge the mint/lp risk terms | — |
mint and lp build a transaction (to / value / data / chainId) from
on-chain data and hand it to you to sign in your own wallet. Aleph never
signs and never sees a private key. mint also works on Ethereum and Base
(--chain eth|base) for NFT mints, and --fast pre-builds a mint transaction
with zero network round-trips for competitive drops.
aleph mint 0x<nft> --qty 2 --json # machine-readable, ready for a signer
aleph mint 0x<nft> --chain base --fast # minimum-latency prepare on Basescan/pool/mint/lp need no account. The optional watch feature — which
re-checks a contract on a schedule and calls your webhook when a signal changes
(ownership transfer/renounce, pause flip, or a proxy upgrade) — runs on the
operator's Cloudflare infrastructure and uses credits.
- Sign in with your wallet (EIP-4361 / Sign-In with Ethereum). You sign a message in your own browser wallet; the CLI receives a short-lived API key on a local callback. Your private key never touches the CLI.
- Your tier is read from your on-chain
$ALEPHbalance server-side — never taken from anything the client sends. Higher tiers get more free monthly credits and cheaper actions.
aleph login
aleph watch add 0x<token> --webhook https://your.url/hook --owner --paused
aleph watch list
aleph creditsThe credit ledger is append-only with a tested invariant: an account's balance always equals the sum of its ledger entries. See worker/ for the access-layer service (a separate project; it is not part of the npm package).
aleph is built for scripts and other agents.
| Code | Meaning |
|---|---|
0 |
no findings |
1 |
warnings present |
2 |
critical findings present |
3 |
scan failed (bad RPC, invalid address, network) |
64 |
usage error (bad command or missing argument) |
--json emits a stable, versioned schema. NO_COLOR is honored.
- Never asks for a private key. Read-only; prepare-and-sign for transactions.
- Zero telemetry. A scanned address is never sent anywhere. The only network calls are your RPC and Blockscout (plus the access service, only if you log in).
- Never says "safe". The language is about findings, not verdicts.
- Evidence or it doesn't ship. Every finding names what it saw; a check that
can't run is marked
skipped, not hidden. - Zero runtime dependencies, including an in-house, test-verified
keccak256.
Aleph ships three Claude Code skills (in skills/) so you can drive it from natural language. Each relays what the CLI produces and never crosses its lines — never says "safe", never signs, never asks for a key:
aleph— "is 0x… safe?" → runsaleph scan --json, reports findings, forwards the disclaimer.aleph-mint— "mint this NFT" → runsaleph mint --json, relays the prepared transaction for you to sign yourself.aleph-lp— "add liquidity for 0x…" → prepares the approve step and is honest that the v4 position-mint step is deferred.
pnpm install
pnpm test # node:test via tsx
pnpm typecheck # tsc --noEmit
pnpm build # compile to dist/
pnpm dev scan 0x<token>See CHANGELOG.md for release history and docs/EXAMPLES.md for real scans.
- TERMS.md — what Aleph is and is not, no-advice / no-warranty terms, who is responsible for a signed transaction, and non-affiliation with Robinhood.
- PRIVACY.md — zero telemetry, and an honest note on what an on-chain read necessarily reveals to your RPC and the block explorer.
MIT