feat(plugin-defi): add Bhairab pre-trade token risk scan

[Ayoshiss]

What

Adds a BHAIRAB_SCAN_TOKEN action to plugin-defi: a pre-trade safety check that returns a proceed / caution / stop verdict for a Solana token, based on live market signals (liquidity, 24h price move, volume, token age, pair count).

Why

The kit can already swap and trade tokens, but there's no built-in way for an agent to vet a token's risk before buying it. Autonomous agents trading trending tokens can walk straight into illiquid, crashing, or scam tokens. This adds that guardrail as a composable action an agent can call before executing a trade.

Usage

const result = await agent.methods.scanToken(
  "DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263", // BONK
  "buy",
  250,
);
// → { verdict: "proceed", confidence, summary, reasons, signals, tier }

if (result.verdict === "stop") return; // skip the trade

Because it's a registered action, the agent's model can also call it autonomously as a safety step before a swap.

• No API key required — returns a heuristic verdict (free).
• Setting BHAIRAB_API_KEY in the agent config unlocks an AI-reasoned verdict.

Changes

• plugin-defi/src/bhairab/tools/scan_token.ts — typed fetch wrapper
• plugin-defi/src/bhairab/actions/scanToken.ts — Action with zod schema, similes, examples
• registered in plugin-defi methods + actions
• added optional BHAIRAB_API_KEY to core Config

Testing

• pnpm build passes for core and plugin-defi (including DTS typecheck)
• biome check clean on the new files
• Functional smoke test against the live endpoint: known token → proceed, unknown mint → caution

[Ayoshiss]

Hey @thearyanag @michaelessiet,flagging this one in case it's useful.

The kit can swap and trade tokens, but there's no built-in way for an agent to vet a token before buying it. So autonomous agents can walk into honeypots and rugs at machine speed. This adds a BHAIRAB_SCAN_TOKEN action that returns proceed / caution / stop from live market signals + on-chain authority checks (it catches freeze-authority honeypots, the "buy but can't sell" trap).

Kept it deliberately low-footprint:

+178 / −0, additive only, slots into plugin-defi like the other integrations (OKX, Drift, Lulo), no changes to existing behavior
pnpm build passes for core + plugin-defi (incl. DTS), biome check clean
Works with no API key, agents get a heuristic verdict for free, so it adds value without forcing your users to sign up for anything
Quick demo on any mint (try the Risky preset): https://tao-gateway.vercel.app/scan

Happy to adapt it however fits your roadmap: move it to a standalone plugin, add docs/tests, or adjust the action shape. Just let me know what you'd prefer and I'll turn it around quickly.