What GoPlus Security Is
Most losses suffered by everyday crypto users do not come from sophisticated protocol exploits. They come from ordinary mistakes: buying a token that cannot be sold again, approving a contract that drains a wallet weeks later, or connecting to a cloned version of a familiar website.
GoPlus Security is a risk detection service built around those specific problems. It reads smart contract code and on-chain history, then returns a structured list of risk signals in plain data form. Rather than a single verdict, it gives you a checklist of findings that you interpret yourself.
The company describes its model as open and permissionless. The core detection endpoints are free to query, and the same data feeds consumer tools such as a browser extension and a mobile app. GoPlus is registered under MiCAR in the European Union and has taken investment from Binance Labs, OKX Ventures, HashKey Capital, Animoca Brands and Quantstamp, among others.
You have very likely used GoPlus already without knowing it. The security tab you see on DEX Screener and the contract risk badges on several major wallets and data aggregators are powered by its API. According to CoinDesk research published in November 2025, the Token Security API averaged roughly 717 million calls per month during 2025. That figure is a widely reported estimate from the provider rather than an independently audited number.
Supported Networks
Coverage is one of the strongest arguments for GoPlus. Public documentation lists close to 40 EVM chains plus three non-EVM ecosystems. Not every feature is available on every chain, so treat the list as coverage for token security detection rather than a guarantee that all endpoints work everywhere.
Category | Networks |
|---|---|
Major EVM Layer 1s | Ethereum, BNB Chain, Avalanche, Fantom, Cronos, Gnosis, HECO, KCC, Sonic, Story, Berachain, Monad, HashKey Chain |
EVM Layer 2s and rollups | Arbitrum, Optimism, Base, Polygon, zkSync Era, Linea, Scroll, Mantle, Blast, Unichain, opBNB, World Chain, Manta Pacific, Zircuit, X Layer, Soneium, Abstract, Morph, zkLink Nova, Mint, Merlin, Bitlayer, ZKFair, Gravity, FON |
Non-EVM | Solana (SPL and SPL-2022), Tron, Sui |
Solana and Sui use dedicated endpoints with different risk fields, because the risks differ. On Solana the important questions are mint authority, freeze authority and metadata mutability rather than transfer taxes or blacklist functions.
Main Features
GoPlus is a suite rather than a single product. These are the components worth knowing.
Token Security detection. Checks whether a contract is verified, whether it can mint new supply, whether ownership was renounced, whether trading can be paused, whether buy and sell taxes can be modified, whether addresses can be blacklisted, plus liquidity pool lock status and holder concentration. Honeypot detection is the single most requested field here.
Malicious Address detection. Flags wallets and contracts linked to known scams, phishing campaigns, mixers, sanctioned entities and past exploits.
Approval Security. Reviews the token and NFT spending permissions a wallet has granted, which is the mechanism behind a large share of drainer attacks.
NFT Security. Assesses collection contracts for privileged functions, metadata risks and impersonation of well known collections.
dApp Security Info. Aggregates audit records and known incident history for decentralised applications.
Signature Data Decode. Translates a raw signature request into readable terms, so a user can see what they are actually authorising.
Phishing Site Detection. Checks a URL against a database of known fraudulent crypto sites.
Transaction Simulation. Runs an EVM or Solana transaction in a sandbox first and reports the expected balance changes before you commit.
SafeToken Protocol and Locker. Open source token templates and an on-chain locking platform for teams that want verifiable liquidity locks.
AgentGuard and DeepScan. Newer products aimed at AI agent security and automated contract auditing. AgentGuard scans agent skills for prompt injection, credential leakage and malicious commands.
Set Up Guides
Option 1: Check a Token in the Browser (No Account Needed)
Open the Token Security Check tool at console.gopluslabs.io/token-security.
Select the correct network from the chain selector. Selecting the wrong chain is the most common user error, since the same address string can exist on several EVM networks.
Paste the contract address. Copy it from the project official site or a listing page you trust, never from a social media reply.
Read the results by category rather than looking for a pass or fail score.
Option 2: Install the Browser Extension
Install the GoPlus extension from the Chrome Web Store. Confirm the publisher before installing, as security extensions are frequently cloned.
Pin it to the toolbar so alerts are visible while you browse.
Visit a DEX or dApp. The extension inspects the site and the transaction you are about to sign, then warns you if a signature or approval looks dangerous.
Treat every warning as a reason to stop and verify, not as something to click through.
Option 3: Use the API as a Developer
Register at console.gopluslabs.io and create an application to obtain an API key and secret.
Read the API overview in the developer docs at docs.gopluslabs.io. Endpoints are versioned and take a chain ID as a path parameter.
Start with the Token Security endpoint. A basic call is a GET request to the token_security path with the chain ID and one or more contract addresses.
Cache responses sensibly. Contract risk data does not change every second, and caching keeps you inside rate limits.
Option 4: Connect It to an AI Assistant
GoPlus publishes an open source MCP server that lets an AI client query its security tools directly. Install it with npm, supply your API key and secret in the client configuration, and the assistant can then run token, address, phishing, NFT and approval checks on request. This is convenient, but the same caution applies: an AI summary of a risk report is still a summary, and it can omit fields that matter.
How to Read the Results Without Fooling Yourself
This is the part most guides skip. A clean GoPlus report does not mean a token is a good investment, and it does not mean the token is safe. It means that a specific set of automated checks did not trigger.
Detection is automated, so novel contract tricks can go unflagged until the detection logic is updated.
A flag is context, not a verdict. An unrenounced owner is normal for a young project and alarming for one claiming to be fully decentralised.
Risk is dynamic. A contract with an upgradeable proxy can become dangerous after you have already bought.
Nothing in the output speaks to the team, the product, the market or the token economics.
Pros and Cons
Pros
Very broad multi-chain coverage in a single interface and a single API schema, which removes the need to juggle several chain specific scanners.
A genuinely usable free tier. The web checker requires no wallet connection and no account, which lowers the barrier for beginners.
Wide industry integration. Because major aggregators and wallets already consume the same data, results are consistent with what users see elsewhere.
Cons
Output assumes background knowledge. Terms such as proxy contract, hidden owner and transfer pausable are presented without much explanation.
Automated checks miss what they were not designed to catch, and a clean report can create false confidence.
Meaningful API volume gets expensive quickly, and batch queries are reserved for the higher tiers.
Fees
Consumer tools including the web token checker, the browser extension and the mobile app are free. API access is metered in compute units, or CU, where different endpoints consume different amounts. The figures below are taken from the official pricing page and may change, so confirm before budgeting.
Plan | Price | CU per Month | Rate Limit (CU/min) | Batch Calls | SLA |
|---|---|---|---|---|---|
Free | $0 | 150K | 150 | No | None |
Test | $199/mo | 6M | 1,125 | Yes | None |
Beginner | $399/mo | 16M | 3,750 | Yes | None |
Growth | $799/mo | 37.5M | 5,250 | Yes | 99.5% |
Pro | $1,899/mo | 150M | 12,000 | Yes | 99.9% |
Ultra | $3,499/mo | 375M | 22,500 | Yes | 99.95% |
Enterprise | Custom | Custom | Custom | Yes | 99.99% |
One inconsistency is worth noting. The support section of the developer documentation states that the open API is free with a limit of 30 calls per minute, while the console pricing page lists 150 CU per minute on the free plan. The lower figure appears to describe unauthenticated access. Test your own limits before relying on either number in production.
Related Terms
Honeypot token: a token that can be bought but not sold, usually because the contract blocks selling for ordinary holders.
Token approval: permission granted to a smart contract to move tokens from your wallet. Approvals persist until revoked.
Rug pull: a scheme in which project insiders remove liquidity or dump supply, leaving holders unable to exit at a meaningful value.
Mint authority: on Solana, the permission to create additional supply of a token.
Frequently Asked Questions
Is GoPlus Security free to use?
Yes for normal users. The web based token checker, the browser extension and the mobile app cost nothing and the token checker does not require an account. Developers get a free API tier and pay only when they exceed it.
Does GoPlus need access to my wallet?
The token security checker does not. You paste a contract address and read a report. Wallet connections are only relevant for features that inspect your own holdings or approvals, and you should always confirm what you are signing.
Does a clean GoPlus report mean a token is safe?
No. It means a defined set of automated checks did not trigger. Automated detection cannot evaluate the team, the token economics, the market or risks introduced after the scan. Treat it as one input among several.
Which blockchains does GoPlus support?
Roughly 40 EVM networks including Ethereum, BNB Chain, Arbitrum, Base, Polygon and Optimism, plus Solana, Tron and Sui through dedicated endpoints. Coverage varies by feature.
How is GoPlus different from a smart contract audit?
An audit is a manual, in depth review by human engineers, usually before launch. GoPlus is automated, real time and continuous. They answer different questions and are not substitutes for each other.
Can I use GoPlus to check my existing token approvals?
Yes. The Approval Security functionality reviews the spending permissions a wallet has granted. Revoking permissions you no longer use is one of the highest value housekeeping tasks in self custody.
Is there an AI integration?
Yes. GoPlus publishes an open source MCP server so AI clients can query its security tools directly. Verify anything important against the raw report, since a summary can drop relevant fields.
Disclaimer: This article is educational and is not financial, investment or legal advice. Security tools reduce risk. They do not remove it. Verify contract addresses independently and confirm pricing and feature details on the official site before making decisions.
The 5-Minute Token Safety Check: How to Use RugCheck, GoPlus and Bubblemaps
RugCheck vs GoPlus: Which Token Security Tool Is Better?
Bubblemaps Review: How to Read Token Holder Bubble Maps
Rugcheck Explained: How to Spot Scam Tokens on Solana in 2 Minutes
