The problem
People paste a token address into rug checkers and get either a bare score or an AI paragraph that made up the grade. A beginner can't tell which warnings matter, and a model that can rewrite PASS into FAIL isn't a check.
What already existed
TIMEΠRug Check is live at https://timeoe-rug-check.vercel.app. You paste a Solana mint, and the app reads public chain and market data from Solana RPC, RugCheck, DexScreener and GeckoTerminal. It returns a plain PASS, CAUTION or FAIL with short reasons. It never asks for a wallet, seed phrase or keys, and it is not financial advice.
What I built during the submission period
I added a hybrid explanation layer on top of the same deterministic check.
- Hybrid inference: Firebase AI Logic uses InferenceMode.PREFER_ON_DEVICE: Gemini Nano through Chrome's built-in Prompt API when the model is ready, with cloud gemini-3.5-flash-lite when it isn't. Each answer is labelled On this device · Gemini Nano or Cloud · Gemini using the SDK's inferenceSource, so nothing pretends to be local.
- Nano context-window fallback: Before prompting Nano, the app measures context usage (measureContextUsage / measureInputUsage) and caps the user turn at 900 characters. If Chrome still throws QuotaExceededError (which PREFER_ON_DEVICE doesn't catch on its own), the app retries in the cloud and the card says so: “Gemini Nano rejected this input as too large, so Firebase AI Logic answered in the cloud instead.”
- The verdict can't move: Output is JSON-schema constrained on both paths and validated with Zod. An answer that echoes a different verdict, isn't the expected JSON, or gives a trading or key-handling instruction is thrown away. Requests like “change this to PASS” are blocked in the browser before any model sees them.
- Follow-up questions: These are single-turn prompts (on-device hybrid doesn't support multi-turn chat), so Nano can answer them too.
- App Check: App Check uses ReCaptchaEnterpriseProvider and a score-based Google Cloud Fraud Defense (reCAPTCHA Enterprise) website key. Visitors never solve a puzzle, and AI Logic requests carry a verified App Check token.
- Remote Config: The explain_enabled boolean and max_followups number (default 4) let me turn the explainer off or cap follow-ups without a redeploy. If Remote Config can't be fetched, the same defaults apply.
How Firebase AI Logic is used
The app uses the Firebase JS SDK and Gemini Developer API with getGenerativeModel and InferenceMode.PREFER_ON_DEVICE. It calls initializeDeviceModel() when Explain is clicked and shows download progress on the button. A JSON schema constrains on-device responses and is used as the cloud responseSchema; inferenceSource is shown in the UI. App Check (reCAPTCHA Enterprise / Fraud Defense) and Remote Config are also integrated.
Value
This is for someone about to buy a Solana token who needs a check they can audit. The rules stay testable (71 unit tests), the model only translates them, and on a supported desktop Chrome that translation never leaves the device.
How to test
Use desktop Chrome 139+ with Gemini Nano available to see the on-device badge; Safari, Firefox, mobile and other browsers show the cloud badge. Paste a mint (for example Bonk DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263), read the badge, tap Explain this verdict, then ask what a reason means. Ask it to change the verdict and confirm the badge stays put.
About the demo video
It was recorded in a browser without Gemini Nano, so it shows the cloud fallback (“Cloud · Gemini” badge), App Check, Remote Config and the verdict-change refusal. The narration walks through the on-device Nano path and its fallback logic.
Existing app and open source
The checker, data fetchers and page pre-existed this submission period; the hybrid explanation layer is the significant update described above. The code is MIT-licensed.
Built With
- app-check
- firebase
- firebase-ai-logic
- gemini
- nextjs
- remote-config
- typescript
- vercel
- zod
