> For the complete documentation index, see [llms.txt](https://whitepaper.gopluslabs.io/goplus-network/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://whitepaper.gopluslabs.io/goplus-network/web3-security/goplus-intelligence.md). # GoPlus Intelligence ## Introduction GoPlus Intelligence is the risk analysis engine of the GoPlus security layer. It provides real-time security intelligence for AI agents, Web3 users, wallets, applications, chains, and developers. Its purpose is to detect risk before execution and provide the signals needed for runtime protection, policy enforcement, user warnings, transaction blocking, approval workflows, and security audits. GoPlus Intelligence began with Web3 security, including token risk analysis, malicious address detection, phishing detection, approval and signature analysis, dApp security information, and transaction simulation. As GoPlus expands into the AI era, GoPlus Intelligence also supports agent-oriented risk analysis such as credential leak detection, prompt-injection detection, malicious command detection, URL analysis, permission abuse analysis, package risk detection, and data exfiltration detection. GoPlus Intelligence is delivered through the Token Security Service and related security APIs for developers and platforms, and through the AI Agent Security API for autonomous systems. Since the Token Security Service moved to a paid model at the end of 2025, its usage increasingly reflects commercial consumption by exchanges, trading terminals, wallets, and, through the AI Agent Security API, AI agents. This consumption is the demand side of the GoPlus security service economy, which $GPS is designed to settle. ## AI Agent Security API The AI Agent Security API extends GoPlus Intelligence to autonomous systems. Launched in March 2026 within the Token Security Service, it enables AI agents to consume GoPlus security intelligence programmatically, within the same workflows through which decisions are made and actions are executed. Built around x402 and a usage-based access model, the service is designed for machine-to-machine interaction. It gives autonomous systems access to security checks spanning counterparty, asset, and transaction risk, including malicious address detection, token security checks, transaction simulation, and rug-pull detection across more than 50 blockchains, with infrastructure designed for tens of millions of calls per day. An agent can check a counterparty before paying it, a token before trading it, or a transaction before signing it, without a human in the loop. ### Machine-to-Machine Settlement in $GPS The AI Agent Security API is the most direct pathway from agent adoption to measurable security-service consumption, because every call is a discrete, metered security transaction originated by a machine. Over time, GoPlus intends to extend this machine-to-machine service model by using $GPS as a core settlement unit for security-service consumption. Under this model, autonomous systems consume security intelligence programmatically while settling for services through a standardized economic layer, linking machine activity with the underlying GoPlus Security Network. Usage-based rails such as x402 remain supported as payment interfaces, with consumption routed into $GPS-denominated settlement on the network side. This allows $GPS utility to scale with security-service consumption rather than relying solely on secondary-market activity. As agents take more actions, they invoke more security checks, and more of that consumption settles in $GPS. ### AI Agent Security API and GoPlus AI Security GoPlus Intelligence provides information about the address, asset, or transaction surrounding an on-chain action, while GoPlus AI Security operates at the agent layer through information-flow security, policy enforcement, and execution controls. Together they extend coverage across agent decision-making, on-chain risk assessment, and execution when autonomous systems interact with digital assets, and both are part of the same $GPS-settled service economy. ## GoPlus Intelligence Overview ### Key Features * **Real-time risk signals:** Provides up-to-date security intelligence for runtime decisions. * **Automated analysis:** Uses AI models, security rules, graph analysis, code analysis, transaction simulation, and threat intelligence to identify risk. * **Cross-environment coverage:** Supports both Web3 execution and AI agent runtime security. * **Scalable integration:** Offers APIs, SDKs, and product integrations for developers, wallets, dApps, chains, AI agent frameworks, and security platforms. * **Policy-ready output:** Produces structured risk results that can be used by GoPlus AI Security, SafuSkill, DeepScan, Security RPC, GoPlus App, browser extension, infrastructure integrations, and third-party products. * **Metered consumption:** Every intelligence call, whether from a developer platform or an autonomous agent, is a metered security service that GoPlus intends to settle in $GPS. ## GoPlus Intelligence Capabilities ### AI Agent Runtime Risk Analysis Analyzes risky actions attempted by AI agents before execution. * Features: command risk detection, file access evaluation, sensitive data access detection, tool-call risk analysis, permission abuse analysis, and runtime risk scoring. * Applications: GoPlus agent runtime protection, coding agents, autonomous workflow platforms, AI agent frameworks, MCP tool routers, and enterprise agent governance. ### Prompt Injection Detection Detects attempts to manipulate agent behavior through malicious or hidden instructions. * Features: detection of role hijacking, system prompt extraction, obfuscated payloads, encoded instructions, and indirect prompt injection patterns. * Applications: GoPlus AI security gateway and runtime enforcement, browser agents, coding agents, document-processing agents, and web automation agents. ### Credential Leak Detection Identifies exposed secrets and sensitive credentials in files, commands, prompts, repositories, and agent-accessible content. * Features: detection of API keys, private keys, tokens, database credentials, cloud credentials, and connection strings. * Applications: agent runtime protection, developer workflow protection, repository scanning, and supply-chain security. ### Malicious Command and Data Exfiltration Detection Detects command patterns and data movement behaviors that may cause system compromise or sensitive data leakage. * Features: remote code execution detection, reverse shell detection, encoded payload detection, suspicious network transfer detection, sensitive path access detection, and exfiltration pattern analysis. * Applications: coding agents, deployment agents, CI/CD assistants, local agent runtimes, and enterprise automation workflows. ### URL and Package Risk Analysis Analyzes URLs, domains, packages, plugins, skills, and agent supply-chain inputs. * Features: malicious domain detection, phishing URL analysis, suspicious TLD analysis, homograph attack detection, malicious package indicators, and advisory-based detection. * Applications: SafuSkill scanning, agent runtime deep scan and daily patrol, MCP security workflows, agent plugin review, and browser-agent protection. ### Multi-chain Token Security Provides detailed security analysis of tokens across supported blockchain networks. * Features: token contract security, liquidity analysis, holder distribution, permission risk, honeypot indicators, and malicious behavior signals. * Applications: exchanges, wallets, DeFi platforms, token launch platforms, research tools, and trading applications. ### AI-Powered Token Audit Powers DeepScan with token contract audit capabilities that combine static analysis, AI semantic review, financial risk modeling, and accumulated security rule patterns. * Features: smart contract vulnerability detection, rug pull risk detection, access-control analysis, honeypot and scam detection, Graph-IR static analysis, LLM-powered audit, and financial semantic modeling. * Applications: DeepScan, token projects, launchpads, exchanges, wallets, dApps, and AI-assisted Web3 development workflows. ### Malicious Address Detection Provides a timely and comprehensive malicious address intelligence service. * Features: identification of scam, phishing, drainer, exploit, laundering, and other malicious addresses. * Applications: transaction screening, wallet warnings, compliance workflows, dApp risk management, and chain-level protection. ### NFT Security Assessment Assesses NFT-related risks to help detect scams, suspicious contracts, or fraudulent activity. * Features: origin analysis, transaction history review, contract security analysis, and suspicious behavior detection. * Applications: NFT marketplaces, wallets, collectibles platforms, and digital asset services. ### Approval Security Analysis Analyzes token approval requests to prevent unauthorized or high-risk asset exposure. * Features: spender risk detection, unlimited approval risk analysis, known malicious contract detection, and approval behavior assessment. * Applications: wallets, DeFi applications, browser extension, transaction protection, and user security dashboards. ### dApp Security Information Aggregates and analyzes security information about dApps. * Features: contract risk signals, audit status, malicious behavior indicators, phishing relationships, and historical security information. * Applications: wallets, dApp browsers, security dashboards, ecosystem monitoring, and user warnings. ### Signature Data Decoding Decodes and analyzes signature payloads for irregularities or malicious intent. * Features: ABI signature decoding, permit and permit2 risk detection, malicious signature pattern recognition, and transaction intent interpretation. * Applications: wallet protection, transaction confirmation flows, phishing prevention, and user-facing risk explanations. ### Phishing Site Detection Detects and blocks phishing websites before users or agents interact with them. * Features: real-time URL verification, phishing pattern detection, suspicious domain analysis, and malicious site intelligence. * Applications: browser extensions, wallets, AI browser agents, security tools, and dApp front-end protection. ### Multi-chain Transaction Simulation Simulates transactions across blockchain networks to assess expected results and detect potential risks before execution. * Features: * Preview transactions in a secure environment. * Identify anomalies, risky token transfers, approval changes, and unexpected contract behavior. * Support multiple blockchain networks including Ethereum, BNB Chain, Solana, Sui, and others. * Provide reports on gas estimation, token movements, and contract interactions. * Applications: * Wallet transaction protection. * dApp and DeFi risk management. * Chain-level and RPC-level security. * AI agents that prepare, review, or submit Web3 transactions. ### GoPlus Intelligence and $GPS GoPlus Intelligence is both the largest source of security-service consumption in the GoPlus ecosystem and the shared engine behind every other product line. Its connection to $GPS runs in both directions: * **Consumption:** Business users pay in $GPS to access GoPlus Intelligence. Autonomous systems consume it through the AI Agent Security API, which GoPlus intends to settle in $GPS. Fiat and stablecoin payments from enterprise customers are routed into $GPS-denominated settlement on the network side. * **Production:** The data behind GoPlus Intelligence comes from the Security Data Layer, where contributors stake $GPS and earn $GPS for verified data, and analysis capacity comes from the Security Compute Layer, where operators stake $GPS and are rewarded from settlement. ### Conclusion GoPlus Intelligence provides the risk intelligence foundation for the GoPlus security layer. By combining Web3 security analysis with AI agent runtime risk detection, and by making that intelligence available to machines through the AI Agent Security API, it enables GoPlus to protect high-risk actions before they execute across agents, wallets, applications, chains, and decentralized security services, with consumption settled in $GPS.