Read-only by default. Write mode is a choice you make.

Two modes

In read-only mode the server can only read public chain state. The write tools are not registered, so a client cannot list or call them. The worst outcome is a wrong answer.

In write mode the key in PONS_PRIVATE_KEY can spend everything that wallet holds. Use a fresh wallet funded with only what you intend to spend, and do not reuse one that holds anything else.

Where the key comes from

The key is read from PONS_PRIVATE_KEY (32-byte hex, 0x prefix optional) and from nowhere else. There is no key file, no prompt, no RPC parameter, and no tool input that can carry one.

Only the derived address is logged, to stderr, at startup. The variable is deleted from process.env as soon as the key is loaded. There is no way to turn write mode on at runtime; it takes a restart with the variable set.

Dry run, then confirm

To broadcast, a write tool needs both dryRun=false and confirm=true. Both are strict zod booleans, so the string "false" does not parse. Anything else returns a dry run.

A dry run simulates every step with eth_call, using balance overrides so an unfunded wallet still exercises the contract logic. It estimates gas and returns the exact calldata. Nothing is broadcast and nothing is signed. The Permit2 permit on a V4 sell is signed only at broadcast; the dry run simulates with an allowance override instead, so a preview never contains a live, replayable signature.

On broadcast the server simulates again, refuses if any step reverts, signs, and sends the steps one at a time, waiting for each receipt. A status-0 receipt comes back as a structured REVERTED, and later steps are never sent after an earlier one fails.

One thing to know before you use it: pons_set_creator_fee_recipient takes effect as soon as it is mined. There is no 72 hour delay. The timelocked propose-and-execute flow is the owner override, reached through pons_admin_call.

Caps and checks

PONS_MAX_DEV_BUY_ETH

Default "0.05". Hard cap on a launch's opening buy. A malformed value stops startup rather than disabling the cap.

PONS_MAX_LAUNCHES_PER_DAY

Default 5. Hard cap on launch broadcasts per rolling 24 hours, counted in memory for the life of the process.

Curve registration

pons_buy and pons_sell only accept the curve the factory registered for a token. A contract that merely implements the curve ABI is rejected as NOT_A_LAUNCH.

Contract drift

The live launchForwarder and memeHook addresses are compared to pinned values before any value is sent to them. A mismatch blocks the broadcast unless you pass acceptContractDrift.

Transaction hash

The hash returned by eth_sendRawTransaction must equal the locally computed keccak-256 of the signed payload.

The key in PONS_PRIVATE_KEY can spend everything that wallet holds. Fund it with what you intend to spend and nothing else.