Current Solana slot, epoch, block height and recommended priority fee. Cheap orientation call — use it to anchor timestamps and confirm the RPC is healthy.

SOL and SPL token balances for one or more wallets, with USD value where Helius prices the token. Use this before any transfer or portfolio question.

Raw + parsed on-chain account state for any address: lamports, owning program, executable flag and parsed data (mint config, token account, stake, etc). Use this to tell a wallet from a PDA, a mint or a program.

Helius enhanced (human-readable) parse of up to 100 signatures: type, source protocol, description, native + token transfers, swap events and per-account balance deltas. This is the primary way to understand what a transaction actually did.

Full raw jsonParsed transaction including logMessages, inner instructions, compute units and pre/post balances. Use only when the enhanced parse in get_transactions is not enough (custom programs, failure debugging).

Parsed SOL + SPL transfer feed for a wallet with server-side filters: counterparty, direction, mint, time and slot range. The fastest primitive for fund-movement questions — prefer it over walking signatures.

Signature-level history for an address with slot/time/status filters and cursor pagination. Use when you need coverage of every transaction touching an address, not just transfers.

Normalized DEX swap history for a wallet: what was sold, what was bought, venue and fee per trade, plus a per-mint net-position summary. Use for trading behaviour, wash-trading and PnL groundwork.

Paginated list of every token account for a mint with owner and balance. Use for holder-distribution work beyond the top-20 that analyze_token returns.

Digital Asset Standard lookup: one asset by mint, or every asset held by an owner. Covers NFTs, compressed NFTs, fungible tokens and Token-2022, with metadata, authorities, creators, royalties and price.

Flexible DAS query across owner, creator, collection, compression state and token type. Use to enumerate a scammer's mints, a collection's supply, or every token a wallet ever created.

Every transaction signature that touched a COMPRESSED NFT (Bubblegum tree asset), oldest to newest. Use to reconstruct a cNFT's mint-and-sale chain of custody. Fungible mints and standard NFTs are not indexed here — use get_transaction_history or get_transfers for those.

Escape hatch: call any read-only Solana JSON-RPC or Helius DAS method directly when no dedicated tool fits. Only get*, is*, search*, minimumLedgerSlot and simulateTransaction are forwarded; anything that could submit or sign (sendTransaction, requestAirdrop, sendBundle) is rejected.

coin-scout transport stats: HTTP requests issued, JSON-RPC batch compression, retries, cache hit rate and adaptive rate-limit state. Use to explain slow responses or confirm caching is working.

One-call wallet profile: portfolio value, holdings, first/last activity, in/out flow shape, top counterparties, earliest funders and heuristic risk flags (fresh wallet, single funder, fan-in/fan-out, frozen assets). Start every wallet investigation here.

Rug-pull and manipulation screen for an SPL mint: live mint/freeze authority, metadata mutability, supply, FDV, holder count, top-holder concentration (top1/top10/HHI) with program-owned pools separated from real holders, plus a 0-100 risk score and explicit flags.

Breadth-first fund-flow graph from a wallet, forwards (where money went) or backwards (where money came from), up to N hops. Returns nodes, weighted edges, terminal sinks and detected circular flows. The core tool for following stolen or laundered funds.

Start from one wallet and discover the other wallets likely controlled by the same actor: who pays its fees, who co-signs with it, where its token-account rent goes, which wallets share its funder, plus same-slot activity, creation time and timing similarity. Returns scored members with the signature evidence for each signal. Use compare_wallets instead when you already have the candidate list.

Resolve where funds went when they left Solana (or where they came from when they arrived) through Wormhole, deBridge, Mayan or Circle CCTP: other chain, recipient address, amounts and the transaction hash on the other chain. Pass signatures, or an address to scan its recent history for bridge transactions. trace_funds already resolves the crossings it meets.

Realized and unrealized PnL per token from a wallet's DEX swaps, valued in USD at the time of each swap (average-cost basis). Answers "did this wallet profit from the rug" (pass mint), sniper/insider profit, and overall trading results. Sales of tokens never bought in the sample (airdropped, sent by a dev wallet, bought before the sample) are reported as unmatchedProceedsUsd and realizedPnlIfUnboughtFreeUsd instead of realized PnL — check those for insiders. With mint set, receivedWithoutSwap lists who sent the wallet that token for free.

Rank every address a wallet transacted with over a transfer sample, split by inbound/outbound count and per-mint volume, with first/last contact. Use to spot the funder, the sink, or the one address a wallet keeps cycling with.

Sybil / co-ownership check across 2-10 wallets: direct transfers between them, shared funders, counterparty-set Jaccard overlap and a 0-100 link strength per pair. Use to test whether separate addresses are the same actor.

Deep dive on one signature: enhanced parse, net SOL/token delta per account, every mint involved screened for rug risk, and a profile of the fee payer. Use when a single transaction is the starting point of an investigation.

Who is behind these Solana addresses: built-in exchange wallets (OKX proof-of-reserves addresses, ownership signature verified), Helius wallet identity when the API key has access, case labels, program labels, and a deposit-address check that flags addresses sweeping their funds to an exchange or a high fan-in hot wallet. Each label says its source and confidence.

Read a token's recent trades straight from its highest-volume AMM pools or bonding curve (found through DexScreener and the top holders, each checked on-chain) and score them for wash trading: wallets whose buys and sells cancel out, same-slot buy+sell, quick round trips of the same size, volume concentration, and traders funded by a common wallet. Returns a 0-100 score, flags, the suspicious traders with a sample signature each, and funder groups.

Follow funds forward from an address on an EVM chain, usually the destination of a bridge crossing that trace_funds or follow_bridge found. Reads native and ERC-20 transfers, values them in USD at the time, expands the largest recipients and stops at contracts and labelled addresses. Chains: Ethereum, BNB Chain, Polygon, Avalanche, Arbitrum, Optimism, Base, Fantom, Celo, Moonbeam, Scroll, Mantle, Linea. Ethereum works without a key through Blockscout; the rest need ETHERSCAN_API_KEY.

Create a case or add to it: summary, address labels with confidence and evidence signatures, and dated notes (findings, leads, retractions). Labels are shown by every other tool from then on, across sessions and cases.

With no arguments, list every case. With address, search all cases for prior labels, notes and saved traces mentioning it — do this before starting on any address. With case, return that case's labels, notes and an index of saved artifacts; add artifactId to get one saved trace, cluster or bridge result in full.

Write the case to disk as report.md (labels, notes, tables, Mermaid diagrams) plus one standalone SVG fund-flow diagram per saved trace or cluster, ready to drop into a report. Returns the file paths.