curl -X POST https://rektopsy-api.onrender.com/autopsy \
  -H "Content-Type: application/json" \
  -d '{"signature": "2KhUjNQsVikHC6JnpigNW4fhspGJYPM7SsgutEXjR6mj8ufLgSdVwA9KZEeMjCdhxGcMMMJG91rUyYM9h32c94zX"}'

const res = await fetch("https://rektopsy-api.onrender.com/autopsy", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ signature }),
});
if (!res.ok) throw new Error((await res.json()).detail);
const autopsy = await res.json();
console.log(autopsy.cause, autopsy.fix, autopsy.funds);

import httpx

r = httpx.post("https://rektopsy-api.onrender.com/autopsy", json={"signature": signature}, timeout=90)
r.raise_for_status()
autopsy = r.json()
print(autopsy["cause"], autopsy["fix"], autopsy["funds"], sep="\n")

{
  "signature": "2KhUjNQs…h32c94zX",
  "category": "slippage",
  "cause": "The transaction failed because the Raydium AMM v4 exceeded the slippage limit you set.",
  "fix": "Retry with a fresh quote or lower the minimum you accept (your minimum was 5915877453 raw units, you would have received 5913883810 raw units, shortfall 1993643 raw units).",
  "funds": "Your money is safe; only the network fee of 0.000071794 SOL was charged.",
  "evidence": [
    { "claim": "cause", "source": "logs[6]" },
    { "claim": "fix values", "source": "logs[5] (ray_log)" },
    { "claim": "fix rule", "source": "minimum must be at most what the trade would give" },
    { "claim": "funds", "source": "meta.preBalances/postBalances, meta.preTokenBalances/postTokenBalances, meta.fee" }
  ],
  "log_lines": {
    "5": "Program log: ray_log: A/DuHF4JAAAATSCdYAEAAAABAAAA…",
    "6": "Program log: AMM error: Exceeded desired slippage limit."
  },
  "meta": { "mode": "llm", "attempts": 1, "tokens": 856, "rejected": [], "latency_ms": 2702 },
  "tx": {
    "slot": 451340359,
    "block_time": 1790604208,
    "failed_instruction": 1,
    "failure_log": 8,
    "steps": [
      { "index": 0, "label": "Compute budget set", "program_name": "Compute Budget", "status": "ok", … },
      { "index": 1, "label": "Raydium AMM v4 called", "program_name": "Raydium AMM v4", "status": "failed", … }
    ],
    "compute_consumed": 11763,
    "compute_limit": 19340,
    "programs_touched": 2,
    "logs": ["Program ComputeBudget111111111111111111111111111111 invoke [1]", …],
    "logs_truncated": false
  },
  "brief": {
    "category": "slippage",
    "cause": { "error_name": "ExceededSlippage", "custom_code": 30, "failing_program_name": "Raydium AMM v4", "resolved_by": "program log", … },
    "fix": {
      "action": "retry with a fresh quote, or lower the minimum you accept",
      "values": { "would_receive_raw": 5913883810, "your_minimum_raw": 5915877453, "shortfall_raw": 1993643, "shortfall_pct_of_minimum": "0.03" },
      "rule": "minimum must be at most what the trade would give",
      "simulated": false,
      …
    },
    "funds": { "safe": true, "fee_lamports": 71794, "fee_sol": "0.000071794", … }
  }
}

curl -X POST https://rektopsy-api.onrender.com/scam-check \
  -H "Content-Type: application/json" \
  -d '{"text": "Hi, I am from Phantom support. Please share your recovery phrase at phant0m-app.io to restore your wallet."}'

{
  "verdict": "likely_scam",
  "headline": "This looks like a scam.",
  "advice": [
    "Don't open the link. Type the real address yourself: phantom.app.",
    "Never share your seed phrase or private key. No real team, app or wallet will ever ask for it.",
    …
    "If you already signed something or shared your seed phrase, move your funds to a new wallet right away."
  ],
  "red_flags": [
    {
      "rule": "secret_request",
      "severity": "high",
      "title": "Asks for your secret phrase or private key",
      "why": "Anyone with these words owns your wallet. No real support team, app or wallet ever asks for them.",
      "match": "share your recovery phrase",
      "quote": "Please share your recovery phrase at phant0m-app.io to restore your wallet.",
      "start": 38,
      "end": 64
    },
    {
      "rule": "lookalike_link",
      "severity": "high",
      "title": "Link imitates a real site",
      "why": "In phant0m-app.io, the name \"phantom\" is used on a different site. The real site is phantom.app.",
      "match": "phant0m-app.io",
      "quote": "phant0m-app.io"
    },
    …
  ],
  "links": [
    {
      "host": "phant0m-app.io",
      "status": "lookalike",
      "detail": "the name \"phantom\" is used on a different site",
      "real": "phantom.app"
    }
  ],
  "model": {
    "score_pct": 65,
    "threshold": 0.69,
    "threshold_pct": 69,
    "flagged": false,
    "top_words": ["your", "your wallet", "from", "recovery phrase", "restore"],
    "trained_on": 8903
  },
  "lists_checked": ["MetaMask's phishing list", "Phantom's blocklist", "ScamSniffer's database"],
  "lists_unavailable": []
}

<script src="https://rektopsy-api.onrender.com/widget.js" defer></script>

<!-- Input box: the reader pastes any signature -->
<rektopsy-autopsy></rektopsy-autopsy>

<!-- Pinned: runs as soon as the page loads -->
<rektopsy-autopsy
  signature="2KhUjNQsVikHC6JnpigNW4fhspGJYPM7SsgutEXjR6mj8ufLgSdVwA9KZEeMjCdhxGcMMMJG91rUyYM9h32c94zX"
  report="https://rektopsy.vercel.app">
</rektopsy-autopsy>

const el = Rektopsy.attach({
  sig: failedSignature,              // optional: omit to show the input box
  target: "#support-panel",          // element or selector; defaults to <body>
  report: "https://rektopsy.vercel.app",
  theme: "dark",
});

document.addEventListener("rektopsy:result", (e) => {
  const autopsy = e.detail;          // the full POST /autopsy response
  analytics.track("tx_autopsy", { category: autopsy.category });
});
document.addEventListener("rektopsy:error", (e) => console.warn(e.detail.message));
document.addEventListener("rektopsy:dismiss", () => closeSupportPanel());

git clone https://github.com/SachinSigdel/rektopsy.git && cd rektopsy
uv sync
cp .env.example .env              # optional: add GROQ_API_KEY
uv run uvicorn rektopsy.api:app --port 8000

# web UI, in another terminal
cd web && cp .env.example .env.local && pnpm install && pnpm dev