Data Sources

Every service aggregates one or more upstream sources, and every response tells you exactly which sources were consulted and how each fared. You never integrate with these providers yourself — the cent covers the aggregation — but you should always be able to weigh the evidence behind an answer.

Who powers what

Source	Powers
GoPlus Security	token-risk (primary risk flags)
Honeypot.is	token-risk (buy/sell simulation)
DexScreener	token-risk (liquidity), pool-snapshot (primary)
GeckoTerminal	pool-snapshot (fallback)
Etherscan API V2	contract-explain (primary)
Sourcify	contract-explain (fallback)
Blockscout	contract-explain (fallback)
DefiLlama	protocol-context (primary)
MetaMask eth-phishing-detect	phishing-check (mirrored locally — zero network calls)
Alchemy	wallet-brief (primary), approval-risk (fallback)
Moralis	approval-risk (primary)
Exa	exa-search, exa-contents, protocol-context (discovery fallback)
Firecrawl	firecrawl-map, firecrawl-search, firecrawl-scrape
Context7	context7-resolve-library, context7-query-docs

Per-service source lists with roles (primary / secondary / enrichment / fallback) are on each service’s page in the catalog and in the machine-readable detail at GET /services/:slug.

Attribution in every response

The response envelope names each source consulted, with per-call status:

"providers": [
  { "name": "goplus", "status": "ok" },
  { "name": "honeypot-is", "status": "ok" },
  { "name": "dexscreener", "status": "error" }
]

An agent deciding how much to trust a risk verdict can see whether it came from three healthy sources or one degraded one.

Degradation is signalled, never hidden

• A failed enrichment source degrades the response rather than failing the request, with a plain-language note in warnings — you still receive the primary data.
• A failed primary source surfaces as an explicit error (provider_error, provider_timeout, or provider_rate_limited) with the source named — see Error Codes.
• If a source is unavailable on a deployment, its services return 503 provider_unconfigured instead of quietly serving thinner data.

The rule throughout: the response never pretends to more evidence than it has.