Cabal Hunter MCP Server

Pre-trade safety check for any Solana token mint: is a buyer about to be someone's exit liquidity? Every flag links to its on-chain evidence tx. Layers, ordered by STRENGTH OF EVIDENCE (not marketing): 1. HOLDER CONCENTRATION — what share one wallet actually controls (`top_holder_pct`). A single wallet that can crater the price is the most basic rug vector, and it needs no coordination at all. IMPORTANT: we count only REAL wallets. LP pools, locked/vesting supply and other program-owned accounts are excluded and labelled, never scored as a whale — and supply comes from getTokenSupply, not an estimate. Tools that skip this report a locked-supply token as '65% one wallet'. Our numbers reconcile with GMGN's circulating top-10. 2. SAME-BLOCK BUNDLES — holders whose token accounts were created in the EXACT same block: a Jito-bundled multi-wallet launch. `time_sync: true`. 3. COORDINATED DUMP — ≥2 holders each selling ≥25% of their bag in the same block: a cabal exiting in real time. `coordinated_exit: true`, sold_pct. 4. HONEYPOT / AUTHORITY TRAPS (Solana-native) — live freeze authority, un-revoked mint authority, Token-2022 transfer-fee / transfer-hook / permanent-delegate traps. Answers: CAN you actually sell this token? 5. DEV TRACK RECORD — the creator resolved on-chain plus their full launch history WITH the peak market cap each past token hit, so a dead-count can't hide a pump-and-dump. reputation (SERIAL_RUGGER / DEAD_ON_ARRIVAL / MIXED / PROVEN) + best_peak_usd, pump_and_dumps count; paid tier adds launches[] (peak_mcap_usd, now_mcap_usd, drawdown, status per launch). 'Ran to $728k, now dust' = this dev has dumped six figures on holders before. Still CAPPED: peak history is evidence, never softens the score. 6. FUNDING-CLUSTER TRACE — top holders walked back to a shared funding wallet. A real capability, listed last on purpose: on our own sample it produced no verified detections once infrastructure (curve PDAs, token accounts) was correctly excluded. Treat it as supporting evidence. Returns risk (CLEAN|MEDIUM|HIGH), cabal_score 0–100, top_holder_pct, cluster breakdown with evidence_txs[], holder map, deployer verdict, honeypot_risk, plus wallets_checked / scan_complete / degraded so YOUR agent can apply its own risk tolerance instead of inheriting ours. If we cannot verify something, we say so (`degraded: true`) rather than returning a confident 'clean'. COST: first 250 scans/month FREE — no signup, no API key. After that $0.001 USDC per scan, priced at cost (covers the Helius RPC behind each trace). Two ways to pay, no signup or card: (1) $9/month UNLIMITED (fair use, 50k/mo) — best for 24/7 bots; or prepaid pay-as-you-go at $0.001/scan (any amount) — POST the tx to /api/buy-key, then send header X-API-Key; or (2) per-call via x402 (X-Payment-Signature header). Full terms: GET /api/info. Typical response time: <100ms for pre-indexed tokens (most graduated pump.fun mints are already cached). A token we have never seen runs the full live on-chain trace and takes 15-20s — set your client timeout to at least 30s or you will abandon a scan that was about to succeed.