Hive Intelligence home
Hive Intelligence
GitHub

Pre-signing token risk checks from Windsurf

Windsurf is Codeium's AI-native IDE with the Cascade agent and native MCP support. Once Hive is registered in Windsurf's MCP config, Cascade can call get_token_security and detect_rugpull on any contract address before recommending a swap or generating transaction code. This is a pre-signing risk check — the agent grounds its advice in GoPlus + on-chain state instead of training-cutoff knowledge that may be months stale. Windsurf's strength here is its agentic coding workflow: you can instruct it to inspect token-risk evidence first and block transaction-code generation when the token fails your security policy.

Client: Windsurf · Workflow: Token security

Hive tools used

  • get_token_security: GoPlus security report — honeypot, taxes, owner permissions, transfer restrictions.
  • detect_rugpull: Aggregated rugpull risk score with structured signal flags.
  • check_malicious_address: Address-level security context for counterparties and contracts.

Steps

  1. Register Hive in ~/.codeium/windsurf/mcp_config.json

    Open Windsurf Settings -> Cascade -> MCP, or directly edit the config file. Use the remote serverUrl config from the Windsurf install guide so Cascade connects to Hive without a local Node wrapper.

    {
  "mcpServers": {
    "hive": {
      "serverUrl": "https://mcp.hiveintelligence.xyz/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_HIVE_API_KEY"
      }
    }
  }
}
  2. Confirm Cascade sees Hive tools

    Open the Cascade panel (Cmd-Shift-L) and type "list available Hive tools." Cascade should see Hive's compact discovery tools; use search_tools or hive://tools for the wider catalog. If Hive is missing entirely, check the config file syntax and reload.

  3. Make security gating part of your prompts

    When asking Cascade to write transaction code for a new token, include "first inspect token-risk evidence with Hive security tools and return pass, block, or escalate." Cascade will call get_token_security before generating any transaction-signing code.

  4. Refuse on red flags

    If is_honeypot is true, owner_change_balance is true, or rugpull_risk_score is over 70, Cascade should refuse to write the code and explain why. Tune your project rules in Windsurf to enforce this — the rule lives in .windsurf-rules at the project root.

  5. Make the audit trail visible

    Have Cascade log receipt_id/receipt_version, provider, and runtime status for each security call. fetched_at, observed_at, and cache_age_ms record Hive's retrieval/cache timeline; provider block or timestamp fields record the source-evidence timeline the agent used at decision time.

Example prompt

I want to swap ETH for token 0x...xyz on Base. Write the transaction code, but first inspect token-risk evidence with Hive and return pass, block, or escalate. Refuse if it's a honeypot or has high rugpull risk.

Example output shape

Example output shape (illustrative values; run the tools for live data):

Before writing swap code I checked token-risk evidence with Hive security tools, retained receipt_id/receipt_version, recorded fetched_at/observed_at/cache_age_ms as Hive's retrieval/cache timeline, and inspected the provider block or timestamp for source recency.

- is_honeypot: false
- buy_tax: 0%, sell_tax: 0%
- transfer_pausable: false
- owner_change_balance: false
- can_take_back_ownership: false
- rugpull_risk_score: 18/100 (low risk in this example)

The example token passes the configured security policy, so the agent can generate transaction code with an explicit amount cap, slippage limit, deadline, and a comment recording the runtime receipt and evidence time. If the live check returns red flags, the agent should refuse to generate signing code.

Related glossary terms

Related recipes

See also