Guardrails and config

Guardrails are enforced by the server before anything is signed. Defaults apply with no config file at all; to customize, create a config.

Config file location

Search order:

1. HOODPOCKET_CONFIG environment variable (explicit path)
2. ./hoodpocket.config.json in the server's working directory
3. ~/.hoodpocket/config.json

Full example

{
  "rpcUrl": "https://rpc.mainnet.chain.robinhood.com",
  "policy": {
    "dailyBudgetUsd": 1000,
    "tiers": {
      "official": { "enabled": true, "maxPerTradeUsd": 500 },
      "established": { "enabled": true, "maxPerTradeUsd": 100 },
      "unknown": { "enabled": false, "maxPerTradeUsd": 0 }
    },
    "minHolders": 1000,
    "denylist": []
  }
}

Every field is optional; anything omitted falls back to the defaults shown above.

Fields

Field	Meaning
rpcUrl	Robinhood Chain RPC endpoint. Default is the public mainnet RPC.
policy.dailyBudgetUsd	Total USD turnover allowed in any rolling 24h window, across all trades
policy.tiers.<tier>.enabled	Whether the agent may trade tokens of this tier at all
policy.tiers.<tier>.maxPerTradeUsd	Max USD value of a single trade in this tier
policy.minHolders	Holder threshold for the established tier
policy.denylist	Token addresses the agent may never trade, regardless of tier
stateFile	Where trade history is stored. Default ~/.hoodpocket/state.json

How USD values are computed

Trade values are computed at execution time via the Uniswap v4 quoter: USDG counts as dollars, ETH is priced through the native-ETH/USDG pools, and other tokens through their best pool. See Quote currencies.

Example policies

Conservative (stock tokens only):

{
  "policy": {
    "dailyBudgetUsd": 200,
    "tiers": {
      "official": { "enabled": true, "maxPerTradeUsd": 50 },
      "established": { "enabled": false, "maxPerTradeUsd": 0 }
    }
  }
}

Degen pocket (memes allowed, tight caps):

{
  "policy": {
    "dailyBudgetUsd": 100,
    "tiers": {
      "established": { "enabled": true, "maxPerTradeUsd": 25 }
    }
  }
}

The unknown tier can technically be enabled. Do not enable it unless you fully understand that this is where the scams live.