Skip to main content
Glama
Sign In

cabal-hunter

by com.cabal-hunter.api
OverviewDiscussionsAdmin

Server Details

Solana pre-trade safety for AI agents: cabal, bundle, dump, deployer & honeypot in one verdict.

If you are the author of this connector, you can claim ownership by verifying the domain or GitHub account it belongs to. Claimed connector authors can inspect health checks, view analytics, and manage their listing.
Status
Healthy
Uptime
99.9% over 77 days
Last Tested
Transport
Streamable HTTP · MCP 2025-11-25
URL
Repository
paulf280-ui/solana-safe-sniper-mcp-template
GitHub Stars
2
Server Listing
Cabal-Hunter
ChatGPT
–
Claude
–

TDQS

A3.9/5.0

Scored across 2 tools

Disambiguation4/5

The two tools have clearly distinct inputs and purposes: one scans a token mint for risk, the other checks a specific wallet's involvement in a token. There is minor overlap because check_wallet_in_token also returns holder trace data that overlaps with check_cabal_risk's holder map, but the core focus is different enough that an agent can tell them apart.

Naming Consistency4/5

Both tools use snake_case with a consistent check_ prefix, forming a readable verb_noun pattern. The second name adds a preposition ('in_token'), which is a minor deviation but still predictable and clearly distinguishable.

Tool Count3/5

Only two tools are provided for a domain that involves token scanning, wallet screening, and continuous watch management mentioned in the descriptions. While the two tools are substantial, the count feels thin and leaves several advertised capabilities (e.g., watch management, screen list) unexposed as tools.

Completeness3/5

The surface covers the core buy-check scan and a wallet-specific lookup, but notable gaps exist: no tool to create or manage watches (POST/GET/DELETE /api/watch), no tool for the screen list add-on, and no way to manage API keys or payment. These missing operations limit the agent's ability to perform the full HOLD-check lifecycle described as essential.

Available Tools

2 tools
check_cabal_riskAInspect

Pre-trade safety check for any Solana token mint: is a buyer about to be someone's exit liquidity? Every wallet cluster carries its evidence_txs.

AFTER YOU BUY: POST /api/watch {mint} with an X-API-Key (any key; add webhook_url on the Pro plan) and we alert you the moment a coordinated dump or liquidity drain starts on that token — carrying the same on-chain evidence. This scan is a BUY check; a watch is a HOLD check, and a holder needs the second one continuously. GET/DELETE /api/watch manage your own. Paid plans: the watch also follows the token's insiders (dev, first-seconds buyers) for 7 days and pushes insider_* events when they sell or move together, each with the transaction.

Layers, ordered by STRENGTH OF EVIDENCE (not marketing):

  1. HOLDER CONCENTRATION — what share one wallet actually controls (top_holder_pct). A single wallet that can crater the price is the most basic rug vector, and it needs no coordination at all. IMPORTANT: we count only REAL wallets. LP pools, locked/vesting supply and other program-owned accounts are excluded and labelled, never scored as a whale — and supply comes from getTokenSupply, not an estimate. Tools that skip this report a locked-supply token as '65% one wallet'. Our numbers reconcile with GMGN's circulating top-10.

  2. SAME-BLOCK BUNDLES — holders whose token accounts were created in the EXACT same block: a multi-wallet launch bought in one slot. A Jito bundle is one way to do that, not the only one - we read the slot, not the bundle. time_sync: true.

  3. COORDINATED DUMP — ≥2 holders each selling ≥25% of their bag in the same block: a cabal exiting in real time. coordinated_exit: true, sold_pct.

  4. HONEYPOT / AUTHORITY TRAPS (Solana-native) — live freeze authority, un-revoked mint authority, Token-2022 transfer-fee / transfer-hook / permanent-delegate traps. Answers: CAN you actually sell this token?

  5. DEV TRACK RECORD — the creator resolved on-chain plus their full launch history WITH the peak market cap each past token hit, so a dead-count can't hide a pump-and-dump. Covers ANY Solana venue: pump.fun, Raydium, Orca, Meteora, PumpSwap. A launch counts only where the transaction actually CREATED the mint, so re-minting supply of an existing token is never miscounted as a launch. reputation (SERIAL_RUGGER / DEAD_ON_ARRIVAL / MIXED / PROVEN) + best_peak_usd, pump_and_dumps count; paid tier adds launches[] (peak_mcap_usd, now_mcap_usd, drawdown, status per launch). 'Ran to $728k, now dust' = this dev has dumped six figures on holders before. Still CAPPED: peak history is evidence, never softens the score. READ deployer.verdict CAREFULLY — two values mean opposite things: FIRST_LAUNCH = we walked the history and found no earlier tokens. UNKNOWN = the history could NOT be established. That is not evidence of anything and must never be treated as a clean record.

  6. FUNDING-CLUSTER TRACE — top holders walked back to a shared funding wallet. A real capability, listed last on purpose: on our own sample it produced no verified detections once infrastructure (curve PDAs, token accounts) was correctly excluded. Treat it as supporting evidence.

Returns risk (CLEAN|MEDIUM|HIGH), cabal_score 0–100, top_holder_pct, cluster breakdown with evidence_txs[], holder map, deployer verdict, honeypot_risk, plus wallets_checked / scan_complete / degraded so YOUR agent can apply its own risk tolerance instead of inheriting ours. If we cannot verify something, we say so (degraded: true) rather than returning a confident 'clean'.

COST: 5 scans/month FREE with no signup and no API key; 250/month free with a key (one email, no card). After that $0.01 USDC per scan. Two ways to pay, no signup or card: (1) a subscription, $9/month for 2,500 scans or $99/month unlimited (fair use 50k) — best for 24/7 bots; or prepaid pay-as-you-go at $0.01/scan (any amount) — POST the tx to /api/buy-key, then send header X-API-Key; or (2) per-call via x402 (X-Payment-Signature header). Full terms: GET /api/info.

FRESHNESS: a token traced in the last 8 hours is answered from that trace in <100ms; computed_at (unix seconds) says exactly when it was traced. Any other token runs the full live on-chain trace and takes 15-20s — set your client timeout to at least 30s or you will abandon a scan that was about to succeed.

NameRequiredDescriptionDefault
mintAddressYesThe Solana mint address of the token to audit (base58, 32–44 chars)
pairCreatedAtNoOptional: DexScreener pairCreatedAt timestamp in milliseconds. Speeds up analysis when provided.

TDQS

A4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and succeeds: it discloses cost, API-key/x402 payment, freshness behavior, timeout requirements, degraded/scan_complete flags, evidence layers, and explicit warnings about ambiguous verdicts. It even advises the agent to apply its own risk tolerance rather than inheriting the service's. This is unusually rich behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The first sentence is well front-loaded, but the description is massively overlong, including pricing tiers, payment mechanics, watch endpoints, and extensive marketing-style detail. Much of that content does not help an agent select or invoke this specific tool correctly, so it fails the 'every sentence earns its place' standard.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity, no output schema, and no annotations, the description supplies the return fields, risk semantics, evidence layers, degradation flags, and operational constraints needed to call it correctly. It is complete enough for an agent to interpret both invocation and output without additional structured support.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents mintAddress and pairCreatedAt. The description does not add syntax, constraints, or meaning beyond what the schema provides for those parameters, so the baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence states a specific verb and resource: a pre-trade safety check for any Solana token mint. It is not a tautology and clearly indicates a token audit rather than a wallet audit. It does not explicitly differentiate itself from the sibling check_wallet_in_token, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear usage context: this is a pre-trade / BUY check, while a watch is a HOLD check. It explains when to use the scan and what to do afterward for ongoing monitoring. It does not mention when to use this instead of the sibling check_wallet_in_token, so it lacks full alternative routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_wallet_in_tokenAInspect

Is a SPECIFIC wallet involved in a SPECIFIC Solana token? Use this when a user names a wallet they are worried about, or when your agent keeps its own watchlist of addresses and wants to screen a token against one.

Answers from two sources at once:

  1. the traced holders of that token — rank, % of supply, buy slot, whether it funded a coordinated cluster, whether it created the token, or whether it is the liquidity pool / a labelled exchange wallet

  2. a LIVE on-chain holding lookup, so a wallet too small to appear in the trace is still resolved rather than dismissed

HOW TO READ THE RESULT — this matters more than the fields: found_in_scan=false is NOT a clean bill of health. The trace covers the largest holders, so a smaller position sits outside it, and a wallet that sold out and closed its token account leaves nothing to observe. Never tell a user a wallet is 'clean' or 'not involved' on this result. The note field states the limit of what was actually checked; relay it.

holding.sold_out=true is the strong signal: a token account exists holding none of the token, i.e. this wallet HELD it and has since sold out.

track_record, when present, counts earlier tokens the wallet was early in and how many graduated. It is an association measured out-of-sample, NOT a profit signal and not a recommendation to copy or avoid anyone. Absence of a track record means we hold no record, not that the wallet has no history.

Free, no API key, rate limited per caller. For screening MANY wallets on every scan automatically, the Screen List add-on stores a private list per key: POST /api/screen-list/checkout.

NameRequiredDescriptionDefault
walletYesThe wallet address to look for in that token (base58, 32–44 chars)
mintAddressYesThe Solana mint address of the token (base58, 32–44 chars)

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so thoroughly. It discloses the dual-source lookup, warns that found_in_scan=false is not a clean bill of health, explains holding.sold_out=true as the strong signal, and cautions that track_record is not a profit signal or recommendation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every section earns its place: purpose, behavior, result-interpretation caveats, and access constraints. It front-loads the core question and usage case, then structures critical warnings in a clear, readable way.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema and no annotations, the description covers what an agent needs to call and interpret the tool correctly: result meaning, limitations, false-negative risk, rate limiting, and authentication. Nothing essential appears missing for this tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both parameters adequately. The description adds contextual meaning by framing them as 'specific wallet' and 'specific token,' but does not add meaningful semantic detail beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool answers whether a specific wallet is involved in a specific Solana token, with a concrete use case. It does not explicitly differentiate itself from the sibling tool check_cabal_risk, so it misses the highest bar for sibling distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use guidance: when a user names a worried-about wallet or when an agent screens a token against a watchlist. It also mentions the Screen List add-on as an alternative for bulk screening, though it does not discuss exclusions relative to check_cabal_risk.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool update
    • Addedcheck_wallet_in_token
  2. 1 tool update
    • Removedtrace_funding
  3. 1 tool update
    • Addedtrace_funding

Related MCP Connectors

Related MCP Servers

Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources