Cabal-Hunter — Solana Token Cabal Detection

check_cabal_risk

Pre-trade safety check for any Solana token mint: is a buyer about to be someone's exit liquidity? Every flag links to its on-chain evidence tx.

AFTER YOU BUY: POST /api/watch {mint, webhook_url} with an X-API-Key (a free key is enough) and we push you an alert the moment a coordinated dump or liquidity drain starts on that token — carrying the same on-chain evidence. This scan is a BUY check; a watch is a HOLD check, and a holder needs the second one continuously. GET/DELETE /api/watch manage your own.

Layers, ordered by STRENGTH OF EVIDENCE (not marketing):

HOLDER CONCENTRATION — what share one wallet actually controls (top_holder_pct). A single wallet that can crater the price is the most basic rug vector, and it needs no coordination at all. IMPORTANT: we count only REAL wallets. LP pools, locked/vesting supply and other program-owned accounts are excluded and labelled, never scored as a whale — and supply comes from getTokenSupply, not an estimate. Tools that skip this report a locked-supply token as '65% one wallet'. Our numbers reconcile with GMGN's circulating top-10.
SAME-BLOCK BUNDLES — holders whose token accounts were created in the EXACT same block: a Jito-bundled multi-wallet launch. time_sync: true.
COORDINATED DUMP — ≥2 holders each selling ≥25% of their bag in the same block: a cabal exiting in real time. coordinated_exit: true, sold_pct.
HONEYPOT / AUTHORITY TRAPS (Solana-native) — live freeze authority, un-revoked mint authority, Token-2022 transfer-fee / transfer-hook / permanent-delegate traps. Answers: CAN you actually sell this token?
DEV TRACK RECORD — the creator resolved on-chain plus their full launch history WITH the peak market cap each past token hit, so a dead-count can't hide a pump-and-dump. Covers ANY Solana venue: pump.fun, Raydium, Orca, Meteora, PumpSwap. A launch counts only where the transaction actually CREATED the mint, so re-minting supply of an existing token is never miscounted as a launch. reputation (SERIAL_RUGGER / DEAD_ON_ARRIVAL / MIXED / PROVEN) + best_peak_usd, pump_and_dumps count; paid tier adds launches[] (peak_mcap_usd, now_mcap_usd, drawdown, status per launch). 'Ran to $728k, now dust' = this dev has dumped six figures on holders before. Still CAPPED: peak history is evidence, never softens the score. READ deployer.verdict CAREFULLY — two values mean opposite things: FIRST_LAUNCH = we walked the history and found no earlier tokens. UNKNOWN = the history could NOT be established. That is not evidence of anything and must never be treated as a clean record.
FUNDING-CLUSTER TRACE — top holders walked back to a shared funding wallet. A real capability, listed last on purpose: on our own sample it produced no verified detections once infrastructure (curve PDAs, token accounts) was correctly excluded. Treat it as supporting evidence.

Returns risk (CLEAN|MEDIUM|HIGH), cabal_score 0–100, top_holder_pct, cluster breakdown with evidence_txs[], holder map, deployer verdict, honeypot_risk, plus wallets_checked / scan_complete / degraded so YOUR agent can apply its own risk tolerance instead of inheriting ours. If we cannot verify something, we say so (degraded: true) rather than returning a confident 'clean'.

COST: first 250 scans/month FREE — no signup, no API key. After that $0.001 USDC per scan. Every scan is a live on-chain trace, not cached data. Two ways to pay, no signup or card: (1) $9/month UNLIMITED (fair use, 50k/mo) — best for 24/7 bots; or prepaid pay-as-you-go at $0.001/scan (any amount) — POST the tx to /api/buy-key, then send header X-API-Key; or (2) per-call via x402 (X-Payment-Signature header). Full terms: GET /api/info.

Typical response time: <100ms for pre-indexed tokens (most graduated pump.fun mints are already cached). A token we have never seen runs the full live on-chain trace and takes 15-20s — set your client timeout to at least 30s or you will abandon a scan that was about to succeed.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`mintAddress`	Yes	The Solana mint address of the token to audit (base58, 32–44 chars)
`pairCreatedAt`	No	Optional: DexScreener pairCreatedAt timestamp in milliseconds. Speeds up analysis when provided.

TDQS

A4.5/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and is unusually candid: it discloses live on-chain tracing, degraded-mode behavior ('we say so degraded: true rather than returning a confident clean'), evidence-linking, limitations of the funding-cluster layer, and response-time variance. It also explains the nuanced UNKNOWN vs FIRST_LAUNCH deployer verdicts and that past peak market caps never soften the risk score.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well organized with numbered evidence layers and bolded terms, but it is long and includes tangential API and payment details (watch endpoint, /api/buy-key, x402 payment, /api/info) that an MCP agent does not need in order to invoke this tool. The core purpose is front-loaded, but the overall message is not tight.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Without an output schema, the description fully spells out what the agent receives: risk enum, cabal_score, top_holder_pct, evidence transactions, deployer verdict, honeypot risk, holder map, and degraded/completion flags. It also gives timeout guidance and cost thresholds, so the agent can invoke the tool with realistic expectations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers both parameters at 100%, so the baseline is 3. The description adds useful context about pre-indexed versus unseen tokens but does not materially extend the meaning of mintAddress or pairCreatedAt beyond what the schema already says.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise statement of the tool: a pre-trade safety check on a Solana token mint to determine whether a buyer is about to become exit liquidity. It clearly names the resource, the action, and the output categories (risk, cabal_score, evidence), so an agent does not need to infer the purpose from the tool name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly distinguishes this check from the /api/watch flow: 'This scan is a BUY check; a watch is a HOLD check, and a holder needs the second one continuously.' That tells an agent exactly when to invoke this tool versus set up a watch, and it also frames the tool as pre-trade rather than post-purchase.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Cabal-Hunter — Solana Token Cabal Detection tools Inspect

Try in Browser

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.2/5.0

Disambiguation5/5

With only one tool exposed, there is no possibility of confusion or overlapping purposes. check_cabal_risk is the sole entry point, so an agent can always select it unambiguously.

Naming Consistency5/5

The single tool name check_cabal_risk follows a clean verb_noun pattern and clearly conveys its action and target. With one tool there are no conflicting conventions to evaluate, and the name itself is well-formed.

Tool Count2/5

The server exposes only one tool despite the description referencing multiple related workflows such as watch management, API key purchase, and payment info. This single tool feels too few for the apparent scope of token monitoring and safety checks.

Completeness2/5

The tool covers the pre-trade buy check well, but the description explicitly directs users to external /api/watch endpoints for continuous hold monitoring, which are not exposed as MCP tools. An agent cannot create, list, or delete watches without leaving the MCP surface, creating a significant workflow gap.

Resources

Need Help?