Skip to main content
Glama

cabal-hunter

by com.cabal-hunter.api
OverviewDiscussionsAdmin

check_cabal_risk

Pre-trade safety check for any Solana token mint: is a buyer about to be someone's exit liquidity? Every wallet cluster carries its evidence_txs.

AFTER YOU BUY: POST /api/watch {mint, webhook_url} with an X-API-Key (a free key is enough) and we push you an alert the moment a coordinated dump or liquidity drain starts on that token — carrying the same on-chain evidence. This scan is a BUY check; a watch is a HOLD check, and a holder needs the second one continuously. GET/DELETE /api/watch manage your own.

Layers, ordered by STRENGTH OF EVIDENCE (not marketing):

  1. HOLDER CONCENTRATION — what share one wallet actually controls (top_holder_pct). A single wallet that can crater the price is the most basic rug vector, and it needs no coordination at all. IMPORTANT: we count only REAL wallets. LP pools, locked/vesting supply and other program-owned accounts are excluded and labelled, never scored as a whale — and supply comes from getTokenSupply, not an estimate. Tools that skip this report a locked-supply token as '65% one wallet'. Our numbers reconcile with GMGN's circulating top-10.

  2. SAME-BLOCK BUNDLES — holders whose token accounts were created in the EXACT same block: a multi-wallet launch bought in one slot. A Jito bundle is one way to do that, not the only one - we read the slot, not the bundle. time_sync: true.

  3. COORDINATED DUMP — ≥2 holders each selling ≥25% of their bag in the same block: a cabal exiting in real time. coordinated_exit: true, sold_pct.

  4. HONEYPOT / AUTHORITY TRAPS (Solana-native) — live freeze authority, un-revoked mint authority, Token-2022 transfer-fee / transfer-hook / permanent-delegate traps. Answers: CAN you actually sell this token?

  5. DEV TRACK RECORD — the creator resolved on-chain plus their full launch history WITH the peak market cap each past token hit, so a dead-count can't hide a pump-and-dump. Covers ANY Solana venue: pump.fun, Raydium, Orca, Meteora, PumpSwap. A launch counts only where the transaction actually CREATED the mint, so re-minting supply of an existing token is never miscounted as a launch. reputation (SERIAL_RUGGER / DEAD_ON_ARRIVAL / MIXED / PROVEN) + best_peak_usd, pump_and_dumps count; paid tier adds launches[] (peak_mcap_usd, now_mcap_usd, drawdown, status per launch). 'Ran to $728k, now dust' = this dev has dumped six figures on holders before. Still CAPPED: peak history is evidence, never softens the score. READ deployer.verdict CAREFULLY — two values mean opposite things: FIRST_LAUNCH = we walked the history and found no earlier tokens. UNKNOWN = the history could NOT be established. That is not evidence of anything and must never be treated as a clean record.

  6. FUNDING-CLUSTER TRACE — top holders walked back to a shared funding wallet. A real capability, listed last on purpose: on our own sample it produced no verified detections once infrastructure (curve PDAs, token accounts) was correctly excluded. Treat it as supporting evidence.

Returns risk (CLEAN|MEDIUM|HIGH), cabal_score 0–100, top_holder_pct, cluster breakdown with evidence_txs[], holder map, deployer verdict, honeypot_risk, plus wallets_checked / scan_complete / degraded so YOUR agent can apply its own risk tolerance instead of inheriting ours. If we cannot verify something, we say so (degraded: true) rather than returning a confident 'clean'.

COST: 5 scans/month FREE with no signup and no API key; 250/month free with a key (one email, no card). After that $0.001 USDC per scan. Two ways to pay, no signup or card: (1) $9/month UNLIMITED (fair use, 50k/mo) — best for 24/7 bots; or prepaid pay-as-you-go at $0.001/scan (any amount) — POST the tx to /api/buy-key, then send header X-API-Key; or (2) per-call via x402 (X-Payment-Signature header). Full terms: GET /api/info.

FRESHNESS: a token traced in the last 8 hours is answered from that trace in <100ms; computed_at (unix seconds) says exactly when it was traced. Any other token runs the full live on-chain trace and takes 15-20s — set your client timeout to at least 30s or you will abandon a scan that was about to succeed.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
mintAddressYesThe Solana mint address of the token to audit (base58, 32–44 chars)
pairCreatedAtNoOptional: DexScreener pairCreatedAt timestamp in milliseconds. Speeds up analysis when provided.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With zero annotations provided, the description carries the full burden, and it delivers: it discloses the freshness/caching behavior (8-hour traces answered in <100ms vs full live trace in 15-20s), the degraded-mode honesty policy ('if we cannot verify something, we say so'), what counts versus what is excluded (real wallets only, LP/locked supply excluded), and the cost model. It even warns about treatment of the UNKNOWN verdict. No important behavioral trait is hidden.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The evidence layers are well-structured with clear headers and ordered by evidentiary strength, and critical warnings (FIRST_LAUNCH vs UNKNOWN) are front-loaded. However, the description is very long and carries substantial non-functional content: a marketing pitch for the paid tier ('best for 24/7 bots'), detailed pricing arithmetic, and redundant re-explanation of the watch endpoint. These earn their place only partially, dragging the score below what the structure alone merits.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool of this complexity — an external-API interaction with cost, caching, and multiple evidence layers — the description is remarkably complete. It covers the return fields (risk, cabal_score, top_holder_pct, degraded flag), tells the agent it can apply its own risk tolerance, and instructs on the required client timeout. The absence of an output schema is offset by the description listing the key return components explicitly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds minimal new meaning about the two parameters themselves — it confirms supply comes from getTokenSupply rather than an estimate, but that's about tool behavior, not the parameters. The functional details around pairCreatedAt (speeding up analysis) are already in the schema. Nothing is misleading, but nothing compensates beyond baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb-resource pairing ('Pre-trade safety check for any Solana token mint') and frames the exact question it answers ('is a buyer about to be someone's exit liquidity?'). It distinguishes itself from the sibling check_wallet_in_token by focusing on buyer-side risk per mint, and even explains the complementary watch endpoint as a separate HOLD check. An agent can select it unambiguously.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly marks this as a BUY check and contrasts it with the watch workflow ('a watch is a HOLD check... GET/DELETE /api/watch manage your own'), giving an agent both when-to-use and when-not-to-use guidance. It also states practical preconditions: free tier limits, no signup required, and the 30s client timeout needed to avoid abandoning a live trace.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All cabal-hunter toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources