# Solana Safe Sniper β MCP Template
[](https://api.cabal-hunter.com/mcp)
[](https://api.cabal-hunter.com)
[](https://api.cabal-hunter.com/demo)
[](https://api.cabal-hunter.com/api/info)
[](https://insiders.vscode.dev/redirect/mcp/install?name=cabal-hunter&config=%7B%22type%22%3A%20%22http%22%2C%20%22url%22%3A%20%22https%3A%2F%2Fapi.cabal-hunter.com%2Fmcp%22%7D)
[](https://cursor.com/install-mcp?name=cabal-hunter&config=eyJ1cmwiOiAiaHR0cHM6Ly9hcGkuY2FiYWwtaHVudGVyLmNvbS9tY3AifQ==)
[](https://github.com/paulf280-ui/plugin-cabal-hunter)
[](LICENSE)
> π **Available in 9 languages:** [English](https://api.cabal-hunter.com/) Β· [EspaΓ±ol](https://api.cabal-hunter.com/es) Β· [PortuguΓͺs](https://api.cabal-hunter.com/pt) Β· [FranΓ§ais](https://api.cabal-hunter.com/fr) Β· [Deutsch](https://api.cabal-hunter.com/de) Β· [Nederlands](https://api.cabal-hunter.com/nl) Β· [δΈζ](https://api.cabal-hunter.com/zh) Β· [ζ₯ζ¬θͺ](https://api.cabal-hunter.com/ja) Β· [νκ΅μ΄](https://api.cabal-hunter.com/ko)
> Stop your AI trading agents getting rugged by coordinated wallet cabals.
> Drop-in template for Claude Code, Cursor, and ElizaOS.
**βΆ Try it now: [live 3D holder map of any Solana token β](https://api.cabal-hunter.com/demo)** β no signup.
**Cabal-Hunter is a free on-chain Solana token safety scanner and rug checker.** It detects coordinated wallet cabals, same-block bundle buys, serial-launcher deployers and same-block coordinated selling on any Solana mint (pump.fun, PumpSwap, Raydium, Orca, Meteora) β and answers the one question that matters before you ape: *are you the exit liquidity?* Use it via **MCP** (Claude, Cursor, ElizaOS), a **REST API**, or a free **interactive 3D holder map**.
---
## The Problem
Your autonomous trading agent is reading rug.check scores, liquidity locks, and contract audits.
**None of that catches a cabal.**
A handful of wallets take the bottom of a launch, the chart looks clean β contract fine, LP burned, everything green β and then they sell into whoever bought after them. You are the exit liquidity.
This template integrates **[Cabal-Hunter](https://api.cabal-hunter.com)** as a pre-trade safety check, so your agent can see who is holding and who has already positioned to sell before it signs a swap.
> **A note on what we do and don't claim.** This README used to open with "15 fresh wallets funded from the same master wallet, accumulating 25-40% of supply." We went looking for that pattern and could not find it. Tracing 323 pump.fun launches at the bonding curve turned up **zero coordinated funding clusters**, and showed why: the median launch has about **five successful buyers**, because on one representative token **1,260 of the curve's 1,266 transactions failed**. Launch capture is a sniper *race* between competing bots, not a quiet cabal. The detection layers below are the ones we can actually evidence β holder concentration, same-block bundles, coordinated selling and deployer history. The pre-launch funding tracer was withdrawn; the [full write-up is here](https://github.com/paulf280-ui/cabal-hunter-mcp#a-note-on-the-withdrawn-trace_funding-tool).
---
## The one question it answers: are YOU the exit liquidity?
The classic pump.fun exit-liquidity setup: wallets positioned before the crowd take the bottom of a launch, then dump on the retail (and bots) that pile in after. Cabal-Hunter's headline output is a single **Exit-Liquidity Risk** verdict β `risk_level`, one of `LOW_SIGNAL | ELEVATED | HIGH` that synthesises every signal below into the only thing that matters before you sign a swap: *are the insiders positioned to dump on you?*
## What Cabal-Hunter Does
```
Token mint address
β
0. EXIT-LIQUIDITY RISK β the headline verdict. Synthesises the layers
below (bundle, concentration, shared funder, coordinated selling,
serial-launcher dev) into risk_level: LOW_SIGNAL | ELEVATED | HIGH.
Are insiders set up to dump on a buyer? The one field an agent needs.
β
1. HOLDER FUNDING TRACE (ONE HOP) β the CURRENT top holders walked back
one funding hop: were they seeded by the same wallet? ONE hop, not a
lineage β we do not claim to follow money through a chain of
wallets. Only System-owned accounts count as
a funder, so pools, vaults and routers can never be mistaken for a
person (that mistake is exactly what got our pre-launch tracer
withdrawn). Every cluster carries evidence_txs[] β the actual
funding transactions on Solscan. This layer is genuinely rare to
fire; treat a hit as significant and its absence as no evidence
either way.
β
2. SAME-BLOCK BUNDLE DETECTION β holders whose token accounts were
created in the EXACT same slot - a Jito bundle is one way to do that, not
the only one. Catches
stealth launches that route funding through intermediaries to
evade layer 1. Returned as `time_sync: true`.
β
3. COORDINATED SELLING DETECTION β β₯2 holders that SOLD a meaningful
chunk (β₯25% of their bag each) in the EXACT same block.
`coordinated_exit: true`, with sold_pct = % of supply sold and the
signatures in evidence_txs[]. Same-slot + meaningful-size + distinct
wallets = near-zero false positives. It reads the CURRENT holder set
at scan time, so a bundle that already sold and left the top holders
is not visible here β that is what the launch-block check is for.
For a token you already hold, POST /api/watch pushes you a webhook
the moment a dump or liquidity drain STARTS.
β
4. DEV TRACK RECORD β the creator wallet is resolved on-chain (bonding
curve pre-graduation, pump-amm pool after β works on any age token),
and their launch history is pulled WITH THE PEAK MARKET CAP each
past token hit. `sampled` says how many of those launches we actually
walked β a very prolific wallet is sampled, not exhausted, so read
`tokens_launched` as a floor, never as a complete history.
Launch detection is venue-agnostic: pump.fun, Raydium,
Orca, Meteora and PumpSwap. A launch is only counted where the
transaction actually CREATED the mint, so minting more supply of a
token that already exists is never miscounted as a launch.
A dead-count alone hides a pump-and-dump: a dev whose
tokens all died at $4k is a nobody, but one who ran a token to $728k
then dumped it to dust has done it to holders before. Reputation:
FIRST_LAUNCH | PROVEN | MIXED | DEAD_ON_ARRIVAL | SERIAL_RUGGER |
UNKNOWN, with per-launch peak β now (paid tier returns the full
launches[] array). UNKNOWN means the history could not be
established β never read it as a clean record.
β
5. CEX-NOISE FILTER β holders funded from a shared exchange or
high-volume infra wallet are NOT a cabal. They're excluded from the
score and surfaced transparently in filtered_clusters[], so you never
get a false positive from people who just withdrew from Binance.
β
6. HONEYPOT CHECK (Solana-native) β one RPC read of the mint account:
is the FREEZE authority live (issuer can freeze your tokens β the
sell-block lever)? is the MINT authority live (supply can be
inflated)? any Token-2022 traps (transfer fees up to 100%, transfer
hooks that block sells, permanent-delegate clawback)? On Solana a
"honeypot" is built from these β tokens have no per-token contract
code to audit. Returns `honeypot_risk: LOW | HIGH` +
`freeze_authority_revoked` / `mint_authority_revoked` /
`token2022_risks[]`.
β
Returns: Cabal Score (0-100) + cluster map + deployer verdict
+ honeypot verdict + on-chain receipts + hard verdict
```
The deployer layer is the one cabals can't dodge: **wallets rotate, deployers leave a paper trail.** A response of `"deployer": {"reputation": "SERIAL_RUGGER", "tokens_launched": 22, "best_peak_usd": 728432, "pump_and_dumps": 2}` shows the dev's full track record before the first candle β including whether this "dead" dev has quietly run tokens to six figures and dumped them on holders before. (Honest context: most prolific pump.fun creators have high dead-token rates, so this signal is capped β it flags a token for review but never drives a HIGH verdict on its own.)
**`FIRST_LAUNCH` and `UNKNOWN` are not the same answer.** `deployer.verdict` of
`FIRST_LAUNCH` means we walked this creator's history and found no earlier tokens.
`UNKNOWN` means the history could not be established at all β that is an absence of
evidence, not a clean record, and an agent must not treat it as one. Where a deployer
cannot be resolved the scan says so in words rather than returning a confident silence.
**Receipts, not magic.** Every wallet cluster carries `evidence_txs[]` β the raw signatures behind that cluster, checkable on Solscan, and holders carry `funding_tx` where we resolved one. Holder concentration, deployer history and the honeypot checks are read from chain state, so they carry no transaction of their own: a token can come back `HIGH` with no clusters at all. Verify what is there rather than trusting a score.
**Response in <100ms** for a mint traced in the last 8 hours β `computed_at` (unix seconds) says exactly when that trace ran. Any other mint runs a live on-chain trace and takes 15-20s, so allow a 30s timeout.
**Free tier: 5 scans/month with no account, or 250/month with a free key (one email).** Then $0.01 per scan. Pay by card, in USDC on Solana, or via x402 β same price through every door. $9/month buys 2,500 scans a month and $99/month buys unlimited fair-use scans (50,000 a month); by card a plan renews automatically and can be cancelled anytime at [cabal-hunter.com/billing](https://cabal-hunter.com/billing).
---
## Quick Start
### 1. Claude Code / Claude Desktop
Add to your MCP config (`~/.claude/mcp.json` or project `.mcp.json`):
```json
{
"mcpServers": {
"cabal-hunter": {
"url": "https://api.cabal-hunter.com/mcp"
}
}
}
```
That's it. Claude will now call `check_cabal_risk` automatically when you ask it to analyse a Solana token.
**Example prompt:**
> "Before we buy into this token, check if there are any coordinated wallets: `EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v`"
Claude calls the tool, pays $0.01 USDC from your connected wallet, and returns the full analysis.
---
### 2. Cursor
Add to `.cursor/mcp.json` in your project root:
```json
{
"mcpServers": {
"cabal-hunter": {
"url": "https://api.cabal-hunter.com/mcp"
}
}
}
```
---
### 3. ElizaOS (with automatic x402 payment)
If you're using ElizaOS with `@hugen/plugin-x402-solana`, payment is handled automatically. Add to your agent config:
```json
{
"plugins": ["@hugen/plugin-x402-solana"],
"mcpServers": {
"cabal-hunter": {
"url": "https://api.cabal-hunter.com/mcp"
}
}
}
```
Your agent will call `check_cabal_risk(mintAddress)` before any swap and abort if `cabalScore >= 35` or `isControlled === true`.
---
### 4. Direct REST API
For headless scripts, custom bots, or any language. **The first 5 calls/month are free β no key, no signup.** A free key (one email) raises that to 250/month. Just call it:
```bash
curl "https://api.cabal-hunter.com/api/scan-cabal?mintAddress=YOUR_MINT_ADDRESS"
```
You get the full analysis back immediately, with `free_queries_remaining` so you always know where you stand. Machine-readable contract: [`/openapi.json`](https://api.cabal-hunter.com/openapi.json).
Once the free tier is used up, calls are $0.01 USDC via x402 β your agent just pays, no billing setup:
**Step 1 β Request analysis (get payment instructions):**
```bash
curl -X POST https://api.cabal-hunter.com/api/scan-cabal \
-H "Content-Type: application/json" \
-d '{"mintAddress": "YOUR_MINT_ADDRESS"}'
```
Response (HTTP 402):
```json
{
"error": "payment_required",
"payment": {
"recipient": "ATYjZ1kWoHWhj74umGJ8wFqUeW1yeSGBbLi1UQpahPxt",
"amount_usdc": 0.01,
"memo_required": "ch-xxxx-xxxx-xxxx",
"instructions": "Send 0.01 USDC with this memo, then resubmit with X-Payment-Signature header"
}
}
```
**Step 2 β Pay & resubmit:**
```bash
curl -X POST https://api.cabal-hunter.com/api/scan-cabal \
-H "Content-Type: application/json" \
-H "X-Payment-Signature: YOUR_TX_SIGNATURE" \
-d '{"mintAddress": "YOUR_MINT_ADDRESS"}'
```
**Response (HTTP 200):**
```json
{
"mint": "YOUR_MINT",
"token_name": "EXAMPLE",
"risk": "HIGH",
"cabal_score": 72.4,
"is_controlled": true,
"time_sync": true,
"verdict": "AVOID β 4 wallets bought in the EXACT same block (bundled launch), controlling 34.1% of supply. DEPLOYER ALERT: this creator has launched 14 tokens, 13 of 13 checked are dead (100%).",
"coordinated_clusters": [
{
"type": "funding",
"master_full": "FvbEKF...9RUg",
"master_short": "FvbEKFβ¦9RUg",
"wallet_count": 4,
"combined_pct": 34.1,
"risk": "HIGH",
"evidence_txs": ["4Y8auc5G...", "2XQx9LFv...", "AAbJ7rej..."]
}
],
"filtered_clusters": [
{
"funder_label": "high-volume wallet",
"master_short": "43ViqZβ¦Z6iy",
"wallet_count": 2,
"combined_pct": 4.4
}
],
"deployer": {
"creator": "5TbRN6...full address...",
"creator_short": "5TbRN6β¦2TGC",
"tokens_launched": 14,
"dead": 13,
"sampled": 13,
"dead_pct": 100.0,
"verdict": "SERIAL_LAUNCHER"
},
"holders": [
{ "rank": 1, "address": "...", "pct": 12.4, "cluster_id": 0, "funding_tx": "4Y8auc5G..." }
],
"wallets_checked": 12,
"analysis_time_ms": 487,
"source": "real_time"
}
```
### 5. Run the MCP server locally (Docker / Node)
**Fastest β no clone needed:** `npx cabal-hunter-mcp` β the same stdio server, published to npm ([cabal-hunter-mcp](https://github.com/paulf280-ui/cabal-hunter-mcp) Β· [npm](https://www.npmjs.com/package/cabal-hunter-mcp)). Or run it from this repo:
Prefer to run the connector yourself instead of hitting the hosted `/mcp`
endpoint? This repo ships a thin **stdio MCP server** that exposes
`check_cabal_risk(mintAddress)` and proxies to the Cabal-Hunter API (free tier
works with no key; paid scans use x402 at call time):
```bash
# Node 18+
npm install
node server/index.mjs
# or Docker
docker build -t cabal-hunter-mcp .
docker run -i cabal-hunter-mcp
```
Then point any MCP client at the local command:
```json
{
"mcpServers": {
"cabal-hunter": {
"command": "node",
"args": ["server/index.mjs"]
}
}
}
```
---
## Integrate into Your Trading Logic
```python
import requests
def is_safe_to_buy(mint_address: str, payment_sig: str) -> bool:
"""Returns True if token passes cabal check."""
resp = requests.post(
"https://api.cabal-hunter.com/api/scan-cabal",
json={"mintAddress": mint_address},
headers={"X-Payment-Signature": payment_sig}
)
if resp.status_code != 200:
return False # fail-safe: don't buy on error
data = resp.json()
# Block on: coordinated control, high score, bundled launch,
# or a deployer with a history of dead tokens
deployer_verdict = (data.get("deployer") or {}).get("verdict", "UNKNOWN")
return (
not data.get("is_controlled")
and data.get("cabal_score", 100) < 35
and not data.get("time_sync")
and deployer_verdict not in ("SERIAL_RUGGER", "SERIAL_LAUNCHER", "POOR_TRACK_RECORD")
)
# In your bot's buy logic:
if is_safe_to_buy(token_mint, my_payment_sig):
execute_swap(token_mint, sol_amount)
else:
print(f"Cabal detected β skipping {token_mint}")
```
---
## Interactive 3D Holder Map (Free)
See exactly what the analysis found. Every real holder is a faceted crystal sized by its share of supply; wallets in the same cluster are joined by light beams, and the liquidity pool and locked supply sit apart in a wireframe vault because they cannot be sold. Drag to rotate, hover for the wallet, click through to Solscan:
```
https://api.cabal-hunter.com/map?mint=ANY_SOLANA_MINT
```
Free to view, in 9 languages. Share this URL when you catch a rug. Every crystal is clickable and links to Solscan for deep-dive research.
---
## Cabal-Hunter everywhere
Same detection engine, wherever your stack lives:
- **`npx cabal-hunter-mcp`** β standalone MCP server for Claude Β· Cursor Β· VS Code Β· any MCP client: [cabal-hunter-mcp](https://github.com/paulf280-ui/cabal-hunter-mcp) Β· [npm](https://www.npmjs.com/package/cabal-hunter-mcp)
- **ElizaOS plugin:** `npm i elizaos-plugin-cabal-hunter` β [plugin-cabal-hunter](https://github.com/paulf280-ui/plugin-cabal-hunter) Β· [npm](https://www.npmjs.com/package/elizaos-plugin-cabal-hunter)
- **REST API + OpenAPI:** [api.cabal-hunter.com](https://api.cabal-hunter.com) Β· [/openapi.json](https://api.cabal-hunter.com/openapi.json)
---
## Pricing
**First 5 scans every month are free** β no signup, no API key. A free key (one email) raises that to 250/month.
After that, pick whatever matches how hard your bot works:
| Plan | Price | What you get |
|------|-------|--------------|
| **Trader** | $9 USDC / month | 2,500 scans a month |
| **Pro** β | $99 USDC / month | Unlimited β _fair use: 50,000/mo, more than any bot needs_ |
| **Pay as you go** | $0.01 USDC / scan | Only what you use β prepaid or per-call, no commitment |
Prepaid keys: send USDC once β `POST /api/buy-key` with the tx signature β use header `X-API-Key` on every scan. Or pay per-call via x402 (`X-Payment-Signature` header). No credit card, no account, no lock-in.
**Does it pay for itself?** Work it out with your own numbers rather than ours: the Trader plan is $9 a month, so it pays for itself the first time it keeps you out of a position bigger than $9 that goes to zero. Whether that happens once a month or once a week depends on what you trade and how often β we are not going to invent an average for you.
Payment is native on Solana β no credit card, no account, no subscription lock-in.
---
## Live dashboard badge
Drop a live safety badge into your own bot's dashboard β two lines of HTML, and every token shows its verdict as it trades:
```html
```
It renders the 0β100 score, the plain-English verdict, and the active flags (bundled launch, coordinated selling, whale concentration, serial-launcher deployer, honeypot). Add `data-refresh="120"` to re-scan live as you trade, and `data-api-key="..."` once you're past your free scans. Works anywhere β React, plain HTML, any site.
---
## API Reference
| Endpoint | Description | Auth |
|----------|-------------|------|
| `POST /api/scan-cabal` | Full cabal analysis | $0.01 USDC |
| `GET /api/scan-cabal?mintAddress=` | GET version | $0.01 USDC |
| `GET /map?mint=` | Interactive 3D holder map | Free |
| `GET /api/cex-funding?mint=` | Per-exchange funding breakdown (which CEXes funded holders, % each) | Free |
| `GET /api/trade-analysis?mint=` | Cohort PnL (Team/Snipers/Insiders) + wash-trading score + exit-liquidity price impact, one call | Free |
| `POST /api/watch` | Register an emergency dump webhook for a mint (push on dump/rug start) | Free |
| `GET /api/info` | Pricing, endpoints | Free |
| `GET /health` | Uptime check | Free |
| `POST /mcp` | MCP tool endpoint | $0.01 USDC per call |
### Emergency dump webhook (auto-exit)
Instead of polling, let your bot subscribe to a token it holds β we push the moment a coordinated dump or liquidity drain starts:
```bash
curl -X POST https://api.cabal-hunter.com/api/watch \
-H "Content-Type: application/json" \
-d '{"mint":"YOUR_MINT","webhook_url":"https://your-bot.com/dump-alert"}'
```
Your endpoint receives:
```json
{ "event":"dump_detected", "mint":"...", "reason":"price β34% since last check",
"coordinated": true, "price_usd": 0.0001, "liquidity_usd": 4200,
"action":"consider_immediate_exit", "ts": 1781370000 }
```
---
## Infrastructure
- **RPC**: Helius (Frankfurt)
- **Hosting**: AWS EC2 Frankfurt β low latency for EU/global
- **Analysis**: read from the chain, never scraped from another scanner. A
completed trace is cached for 8 hours and `computed_at` always says when it
ran; `fresh=1` forces a new one
- **Uptime**: 99.9% target β monitored, auto-restart via systemd
---
## FAQ
**What is a Solana cabal?**
A group of wallets β often funded from the same source and buying in the same block β that quietly accumulate a large share of a token's supply before retail, then dump simultaneously into everyone who buys after launch.
**How do I check if a Solana token is a rug?**
Scan the mint with Cabal-Hunter (MCP, REST API, or the free 3D holder map). It traces holder funding back one hop to shared sources, detects same-block bundle buys, flags serial-launcher deployers and same-block coordinated selling, and returns an **Exit-Liquidity Risk** verdict β `risk_level`: `LOW_SIGNAL`, `ELEVATED` or `HIGH`.
**Is it free?**
Yes β 5 scans/month with no signup or API key, and 250/month with a free key (one email). Beyond that it's $0.01 USDC per scan, paid natively on Solana.
**Is there a way to use it without writing code?**
Yes β [@TheCabalHunter_Bot](https://t.me/TheCabalHunter_Bot) on Telegram. Paste a mint, get the same scan as a card, and ask it to watch a token you hold so it messages you when a dump starts. Scored tokens are posted to [@CabalHunterAlerts](https://t.me/CabalHunterAlerts).
**Can AI trading agents use it?**
Yes β that's the whole point. The MCP server (`api.cabal-hunter.com/mcp`) lets Claude, Cursor and ElizaOS agents call `check_cabal_risk(mintAddress)` automatically before any swap, and a REST API covers any other language.
---
## License
MIT β fork it, build on it, integrate it. If you build something with this, share it.
---
*Built by [Cabal Hunter](https://cabal-hunter.com) Β· Powered by Helius Β· Contact: api.cabal-hunter.com/api/info*