Routes for humans and agents.
Draft for counsel review. These endpoints support the first-party beta interface and may change without notice. They are not a supported public trading API. The canonical machine-readable description is OpenAPI 3.1 JSON.
Available in the current beta
GET /api/tokens | Listed token market rows and update context. |
GET /api/token/:chain/:address | Detailed stored market and risk profile. |
GET /api/chains | Supported network metadata. |
GET /api/portfolio | Read-only holdings for a caller-supplied public EVM or Solana address. |
GET /api/quote | Provider quote for a supported swap. |
POST /api/build | Unsigned transaction data bound to a prior quote and public wallet address. |
GET /api/xquote | Cross-chain route quote and unsigned transaction material where available. |
GET /api/xstatus | Current provider-reported bridge transaction status. |
POST /api/solrpc | Allowlisted Solana reads and bounded relay of already-signed serialized transactions. |
Authentication and signing boundary
The current beta routes above do not authenticate an API user and do not accept an API credential from the caller. A public wallet address is routing input, not proof of ownership. The server may use its own provider access internally, but those credentials are never part of the public request or response contract.
/api/build constructs unsigned material only. It does not authorize, sign, submit or confirm a transaction. A compatible caller-controlled wallet must show and sign the exact transaction. /api/solrpc is the narrow exception for submission: it can forward already-signed Solana bytes after verifying signatures, enforcing the 1,232-byte transaction limit, requiring preflight and bounding retries. It cannot create a signature, change the signed message or authorize the transaction.
Rate limits and freshness
Limits are in-memory fixed windows of 60 seconds, identified by the Cloudflare client address when present and otherwise the socket address. /api/quote, /api/build and /api/xquote share 60 requests per client and 1,200 globally per window. Portfolio cache misses allow 12 per client and 300 globally. Solana RPC reads allow 60/1,200, single signed submissions 6/120, and signed batches of 2–10 transactions 2/20. Exhausted budgets return HTTP 429; process restarts reset the counters. These are current implementation limits, not service guarantees.
The token list is rebuilt at most once every 10 seconds. Identical portfolio requests can reuse a response for 30 seconds. Non-RPC application JSON responses carry Cache-Control: no-store, but internal reuse still applies and source market, profile, RPC and provider observations have independent timestamps and can be older. Quotes, transaction material, prices and bridge statuses can become stale before use; request a fresh quote and verify current chain state in the signing wallet.
Risks and availability
Providers can be unavailable, routes can disappear, price coverage can be missing, and thin or adversarial markets can make estimates misleading. Token scores and risk fields are heuristics, not audits or safety guarantees. Validate recipient, chain, assets, amounts, approvals, fees, slippage and calldata before signing. See Safety, Fees and the Risk Disclosure.
MCP status: in development
No public MemeSwap MCP endpoint is deployed today. The planned surface is limited to research reads, quotes and unsigned construction. It will not hold wallet secrets, sign messages, submit unrestricted contract calls or offer a generic trade-execution tool. Its authorization model, tool names, SDK packages and service guarantees are not yet public contracts.
Fees and access
Fee binding, OAuth metadata, SDK packages and service guarantees are not yet offered publicly. Do not build production systems against undocumented endpoints.
Security
Report vulnerabilities privately to [email protected]. Agentic Labs LLC, San Antonio, Texas 78261.