Cabal Hunter
About
Pre-trade safety check for Solana tokens — traces coordinated wallet funding, same-block bundle buys and serial-launcher deployer history into one Exit-Liquidity Risk verdict before an agent buys.
Details
- Author
- paulf280-ui
- Downloads
- 601
- Categories
- Finance, Other, Security
Jump to
- Funding trace – top holders traced to shared funding wallets (cabal signature)
- Same-block Jito bundles – detects wallets that bought in one bundle (stealth launches)
- Coordinated dumps – real-time detection of multiple holders selling in the same block
- Serial-rug deployers – creator’s full launch history (“14 launched, 13 dead”)
- CEX-noise filter – exchange-funded holders are excluded to avoid false positives
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Cabal HunterCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Add the MCP server URL to your client configuration: { "mcpServers": { "cabal-hunter": { "type": "http", "url": "https://api.cabal-hunter.com/mcp" } } } — or in Claude Code, run claude mcp add --transport http cabal-hunter https://api.cabal-hunter.com/mcp. Then call check_cabal_risk(mintAddress) with a token's mint address to get a risk verdict. A free visual bubble map and a REST API are also available.
check_cabal_risk
Pre-trade safety check for any Solana token mint: is a buyer about to be someone's exit liquidity? Every flag links to its on-chain evidence tx. Layers, ordered by STRENGTH OF EVIDENCE (not marketing): 1. HOLDER CONCENTRATION — what share one wallet actually controls (`top_holder_pct`). A single wallet that can crater the price is the most basic rug vector, and it needs no coordination at all. IMPORTANT: we count only REAL wallets. LP pools, locked/vesting supply and other program-owned accounts are excluded and labelled, never scored as a whale — and supply comes from getTokenSupply, not an estimate. Tools that skip this report a locked-supply token as '65% one wallet'. Our numbers reconcile with GMGN's circulating top-10. 2. SAME-BLOCK BUNDLES — holders whose token accounts were created in the EXACT same block: a Jito-bundled multi-wallet launch. `time_sync: true`. 3. COORDINATED DUMP — ≥2 holders each selling ≥25% of their bag in the same block: a cabal exiting in real time. `coordinated_exit: true`, sold_pct. 4. HONEYPOT / AUTHORITY TRAPS (Solana-native) — live freeze authority, un-revoked mint authority, Token-2022 transfer-fee / transfer-hook / permanent-delegate traps. Answers: CAN you actually sell this token? 5. DEV TRACK RECORD — the creator resolved on-chain plus their full launch history WITH the peak market cap each past token hit, so a dead-count can't hide a pump-and-dump. reputation (SERIAL_RUGGER / DEAD_ON_ARRIVAL / MIXED / PROVEN) + best_peak_usd, pump_and_dumps count; paid tier adds launches[] (peak_mcap_usd, now_mcap_usd, drawdown, status per launch). 'Ran to $728k, now dust' = this dev has dumped six figures on holders before. Still CAPPED: peak history is evidence, never softens the score. 6. FUNDING-CLUSTER TRACE — top holders walked back to a shared funding wallet. A real capability, listed last on purpose: on our own sample it produced no verified detections once infrastructure (curve PDAs, token accounts) was correctly excluded. Treat it as supporting evidence. Returns risk (CLEAN|MEDIUM|HIGH), cabal_score 0–100, top_holder_pct, cluster breakdown with evidence_txs[], holder map, deployer verdict, honeypot_risk, plus wallets_checked / scan_complete / degraded so YOUR agent can apply its own risk tolerance instead of inheriting ours. If we cannot verify something, we say so (`degraded: true`) rather than returning a confident 'clean'. COST: first 250 scans/month FREE — no signup, no API key. After that $0.001 USDC per scan. Every scan is a live on-chain trace, not cached data. Two ways to pay, no signup or card: (1) $9/month UNLIMITED (fair use, 50k/mo) — best for 24/7 bots; or prepaid pay-as-you-go at $0.001/scan (any amount) — POST the tx to /api/buy-key, then send header X-API-Key; or (2) per-call via x402 (X-Payment-Signature header). Full terms: GET /api/info. Typical response time: <100ms for pre-indexed tokens (most graduated pump.fun mints are already cached). A token we have never seen runs the full live on-chain trace and takes 15-20s — set your client timeout to at least 30s or you will abandon a scan that was about to succeed.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"cabal hunter": {
"cabal-hunter": {
"type": "http",
"url": "https://api.cabal-hunter.com/mcp"
}
}
}
}McpServers
{
"cabal-hunter": {
"type": "http",
"url": "https://api.cabal-hunter.com/mcp"
}
}🌐Available in 9 languages:English·Español·Português·Français·Deutsch·Nederlands·中文·日本語·한국어
Stop your AI trading agents getting rugged by coordinated wallet cabals. Drop-in template for Claude Code, Cursor, and ElizaOS.
▶ Try it now:live 3D holder map of any Solana token →— no signup.
Cabal-Hunter is a free on-chain Solana token safety scanner and rug checker.It detects coordinated wallet cabals, same-block Jito bundle buys, serial-launcher deployers and coordinated dumps on any Solana mint (pump.fun, PumpSwap, Raydium) — and answers the one question that matters before you ape:are you the exit liquidity?Use it viaMCP(Claude, Cursor, ElizaOS), aREST API, or a freeinteractive 3D holder map.
Your autonomous trading agent is reading rug.check scores, liquidity locks, and contract audits.
A handful of wallets take the bottom of a launch, the chart looks clean — contract fine, LP burned, everything green — and then they sell into whoever bought after them. You are the exit liquidity.
This template integratesCabal-Hunteras a pre-trade safety check, so your agent can see who is holding and who has already positioned to sell before it signs a swap.
A note on what we do and don't claim.This README used to open with "15 fresh wallets funded from the same master wallet, accumulating 25-40% of supply." We went looking for that pattern and could not find it. Tracing 323 pump.fun launches at the bonding curve turned upzero coordinated funding clusters, and showed why: the median launch has aboutfive successful buyers, because on one representative token1,260 of the curve's 1,266 transactions failed. Launch capture is a sniperracebetween competing bots, not a quiet cabal. The detection layers below are the ones we can actually evidence — holder concentration, same-block bundles, coordinated selling and deployer history. The pre-launch funding tracer was withdrawn; thefull write-up is here.
The one question it answers: are YOU the exit liquidity?
The classic pump.fun exit-liquidity setup: wallets positioned before the crowd take the bottom of a launch, then dump on the retail (and bots) that pile in after. Cabal-Hunter's headline output is a singleExit-Liquidity Riskverdict (LOW | ELEVATED | HIGH) that synthesises every signal below into the only thing that matters before you sign a swap:are the insiders positioned to dump on you?
Token mint address ↓ 0. EXIT-LIQUIDITY RISK — the headline verdict. Synthesises the layers below (bundle, concentration, shared funder, coordinated dump, serial- rug dev) into LOW | ELEVATED | HIGH: are insiders set up to dump on a buyer? The one number a trading agent needs. ↓ 1. HOLDER FUNDING LINEAGE — the CURRENT top holders walked back: were they seeded by the same wallet? Only System-owned accounts count as a funder, so pools, vaults and routers can never be mistaken for a person (that mistake is exactly what got our pre-launch tracer withdrawn). Every cluster carries evidence_txs[] — the actual funding transactions on Solscan. This layer is genuinely rare to fire; treat a hit as significant and its absence as no evidence either way. ↓ 2. SAME-BLOCK BUNDLE DETECTION — holders whose token accounts were created in the EXACT same slot bought in one Jito bundle. Catches stealth launches that route funding through intermediaries to evade layer 1. Returned as time_sync: true. ↓ 3. COORDINATED DUMP DETECTION — ≥2 holders that SOLD a meaningful chunk (≥25% of their bag each) in the EXACT same block — a cabal exiting in real time. coordinated_exit: true, with sold_pct = % of supply dumped and the sell transactions linked. Same-slot + meaningful-size + distinct wallets = near-zero false positives. ↓ 4. DEV TRACK RECORD — the creator wallet is resolved on-chain (bonding curve pre-graduation, pump-amm pool after — works on any age token), and their full launch history is pulled WITH THE PEAK MARKET CAP each past token hit. A dead-count alone hides a pump-and-dump: a dev whose tokens all died at $4k is a nobody, but one who ran a token to $728k then dumped it to dust has done it to holders before. Reputation: SERIAL_RUGGER | DEAD_ON_ARRIVAL | MIXED | PROVEN, with per-launch peak → now (paid tier returns the full launches[] array). ↓ 5. CEX-NOISE FILTER — holders funded from a shared exchange or high-volume infra wallet are NOT a cabal. They're excluded from the score and surfaced transparently in filtered_clusters[], so you never get a false positive from people who just withdrew from Binance. ↓ 6. HONEYPOT CHECK (Solana-native) — one RPC read of the mint account: is the FREEZE authority live (issuer can freeze your tokens — the sell-block lever)? is the MINT authority live (supply can be inflated)? any Token-2022 traps (transfer fees up to 100%, transfer hooks that block sells, permanent-delegate clawback)? On Solana a "honeypot" is built from these — tokens have no per-token contract code to audit. Returns honeypot_risk: LOW | HIGH + freeze_authority_revoked / mint_authority_revoked / token2022_risks[]. ↓ Returns: Cabal Score (0-100) + cluster map + deployer verdict + honeypot verdict + on-chain receipts + hard verdict
The deployer layer is the one cabals can't dodge:wallets rotate, deployers leave a paper trail.A response of"deployer": {"reputation": "SERIAL_RUGGER", "tokens_launched": 22, "best_peak_usd": 728432, "pump_and_dumps": 2}shows the dev's full track record before the first candle — including whether this "dead" dev has quietly run tokens to six figures and dumped them on holders before. (Honest context: most prolific pump.fun creators have high dead-token rates, so this signal is capped — it flags a token for review but never drives a HIGH verdict on its own.)
Receipts, not magic.Every cluster and red flag links to the underlying Solscan transaction (evidence_txs[],holders[].funding_tx) — verify the trail yourself instead of trusting a score.
Response in <100mson pre-indexed tokens — every pump.fun graduation is scanned and cached automatically as it happens.
Free tier: 5 scans/month with no account, or 250/month with a free key (one email).Then $0.001 per scan — priced at cost (it covers the Helius RPC calls behind each live on-chain trace). Pay by card, in USDC on Solana, or via x402 — same price through every door. $9/month buys unlimited fair-use scans; by card that renews automatically and can be cancelled anytime atcabal-hunter.com/billing.
Add to your MCP config (~/.claude/mcp.jsonor project.mcp.json):
{ "mcpServers": { "cabal-hunter": { "url": "https://api.cabal-hunter.com/mcp" } } }
That's it. Claude will now callcheck_cabal_riskautomatically when you ask it to analyse a Solana token.
"Before we buy into this token, check if there are any coordinated wallets:EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v"
Claude calls the tool, pays $0.001 USDC from your connected wallet, and returns the full analysis.
Add to.cursor/mcp.jsonin your project root:
{ "mcpServers": { "cabal-hunter": { "url": "https://api.cabal-hunter.com/mcp" } } }
3. ElizaOS (with automatic x402 payment)
If you're using ElizaOS with@hugen/plugin-x402-solana, payment is handled automatically. Add to your agent config:
{ "plugins": ["@hugen/plugin-x402-solana"], "mcpServers": { "cabal-hunter": { "url": "https://api.cabal-hunter.com/mcp" } } }
Your agent will callcheck_cabal_risk(mintAddress)before any swap and abort ifcabalScore >= 35orisControlled === true.
For headless scripts, custom bots, or any language.The first 250 calls/month are free — no key, no signup.Just call it:
curl "https://api.cabal-hunter.com/api/scan-cabal?mintAddress=YOUR_MINT_ADDRESS"
You get the full analysis back immediately, withfree_queries_remainingso you always know where you stand. Machine-readable contract:/openapi.json.
Once the free tier is used up, calls are $0.001 USDC via x402 — your agent just pays, no billing setup:
Step 1 — Request analysis (get payment instructions):
curl -X POST https://api.cabal-hunter.com/api/scan-cabal \ -H "Content-Type: application/json" \ -d '{"mintAddress": "YOUR_MINT_ADDRESS"}'
{ "error": "payment_required", "payment": { "recipient": "ATYjZ1kWoHWhj74umGJ8wFqUeW1yeSGBbLi1UQpahPxt", "amount_usdc": 0.001, "memo_required": "ch-xxxx-xxxx-xxxx", "instructions": "Send 0.001 USDC with this memo, then resubmit with X-Payment-Signature header" } }
curl -X POST https://api.cabal-hunter.com/api/scan-cabal \ -H "Content-Type: application/json" \ -H "X-Payment-Signature: YOUR_TX_SIGNATURE" \ -d '{"mintAddress": "YOUR_MINT_ADDRESS"}'
{ "mint": "YOUR_MINT", "token_name": "EXAMPLE", "risk": "HIGH", "cabal_score": 72.4, "is_controlled": true, "time_sync": true, "verdict": "AVOID — 4 wallets bought in the EXACT same block (bundled launch), controlling 34.1% of supply. DEPLOYER ALERT: this creator has launched 14 tokens, 13 of 13 checked are dead (100%).", "coordinated_clusters": [ { "type": "funding", "master_full": "FvbEKF...9RUg", "master_short": "FvbEKF…9RUg", "wallet_count": 4, "combined_pct": 34.1, "risk": "HIGH", "evidence_txs": ["4Y8auc5G...", "2XQx9LFv...", "AAbJ7rej..."] } ], "filtered_clusters": [ { "funder_label": "high-volume wallet", "master_short": "43ViqZ…Z6iy", "wallet_count": 2, "combined_pct": 4.4 } ], "deployer": { "creator": "5TbRN6...full address...", "creator_short": "5TbRN6…2TGC", "tokens_launched": 14, "dead": 13, "sampled": 13, "dead_pct": 100.0, "verdict": "SERIAL_LAUNCHER" }, "holders": [ { "rank": 1, "address": "...", "pct": 12.4, "cluster_id": 0, "funding_tx": "4Y8auc5G..." } ], "wallets_checked": 12, "analysis_time_ms": 487, "source": "real_time" }
5. Run the MCP server locally (Docker / Node)
Fastest — no clone needed:npx cabal-hunter-mcp— the same stdio server, published to npm (cabal-hunter-mcp·npm). Or run it from this repo:
Prefer to run the connector yourself instead of hitting the hosted/mcpendpoint? This repo ships a thinstdio MCP serverthat exposescheck_cabal_risk(mintAddress)and proxies to the Cabal-Hunter API (free tier works with no key; paid scans use x402 at call time):
# Node 18+ npm install node server/index.mjs # or Docker docker build -t cabal-hunter-mcp . docker run -i cabal-hunter-mcp
Then point any MCP client at the local command:
{ "mcpServers": { "cabal-hunter": { "command": "node", "args": ["server/index.mjs"] } } }
import requests def is_safe_to_buy(mint_address: str, payment_sig: str) -> bool: """Returns True if token passes cabal check.""" resp = requests.post( "https://api.cabal-hunter.com/api/scan-cabal", json={"mintAddress": mint_address}, headers={"X-Payment-Signature": payment_sig} ) if resp.status_code != 200: return False # fail-safe: don't buy on error data = resp.json() # Block on: coordinated control, high score, bundled launch, # or a deployer with a history of dead tokens deployer_verdict = (data.get("deployer") or {}).get("verdict", "UNKNOWN") return ( not data.get("is_controlled") and data.get("cabal_score", 100) < 35 and not data.get("time_sync") and deployer_verdict not in ("SERIAL_RUGGER", "SERIAL_LAUNCHER", "POOR_TRACK_RECORD") ) # In your bot's buy logic: if is_safe_to_buy(token_mint, my_payment_sig): execute_swap(token_mint, sol_amount) else: print(f"Cabal detected — skipping {token_mint}")
See exactly what the analysis found. Every real holder is a faceted crystal sized by its share of supply; wallets in the same cluster are joined by light beams, and the liquidity pool and locked supply sit apart in a wireframe vault because they cannot be sold. Drag to rotate, hover for the wallet, click through to Solscan:
https://api.cabal-hunter.com/map?mint=ANY_SOLANA_MINT
Free to view, in 9 languages. Share this URL when you catch a rug. Every crystal is clickable and links to Solscan for deep-dive research.
Same detection engine, wherever your stack lives:
- npx cabal-hunter-mcp— standalone MCP server for Claude · Cursor · VS Code · any MCP client:cabal-hunter-mcp·npm
- ElizaOS plugin:npm i elizaos-plugin-cabal-hunter—plugin-cabal-hunter·npm
- REST API + OpenAPI:api.cabal-hunter.com·/openapi.json
First 250 scans every month are free— per IP, no signup, no API key.
After that, pick whatever matches how hard your bot works (priced at cost — it covers the Helius RPC behind each live on-chain trace):
Prepaid keys: send USDC once →POST /api/buy-keywith the tx signature → use headerX-API-Keyon every scan. Or pay per-call via x402 (X-Payment-Signatureheader). No credit card, no account, no lock-in.
Does it pay for itself?Work it out with your own numbers rather than ours: the Unlimited tier is $9 a month, so it pays for itself the first time it keeps you out of a position bigger than $9 that goes to zero. Whether that happens once a month or once a week depends on what you trade and how often — we are not going to invent an average for you.
Payment is native on Solana — no credit card, no account, no subscription lock-in.
Drop a live safety badge into your own bot's dashboard — two lines of HTML, and every token shows its verdict as it trades:
<div class="cabal-hunter-badge" data-mint="YOUR_TOKEN_MINT"></div> <script src="https://api.cabal-hunter.com/widget.js" defer></script>
It renders the 0–100 score, the plain-English verdict, and the active flags (bundled launch, coordinated dump, whale concentration, serial-launcher deployer, honeypot). Adddata-refresh="120"to re-scan live as you trade, anddata-api-key="..."once you're past your free scans. Works anywhere — React, plain HTML, any site.
curl -X POST https://api.cabal-hunter.com/api/watch \ -H "Content-Type: application/json" \ -d '{"mint":"YOUR_MINT","webhook_url":"https://your-bot.com/dump-alert"}'
{ "event":"dump_detected", "mint":"...", "reason":"price −34% since last check", "coordinated": true, "price_usd": 0.0001, "liquidity_usd": 4200, "action":"consider_immediate_exit", "ts": 1781370000 }
|GET /health| Uptime check | Free | |POST /mcp| MCP tool endpoint | $0.001 USDC per call |
- RPC: Dedicated Helius node (Frankfurt) — fastest Solana data available
- Hosting: AWS EC2 Frankfurt — low latency for EU/global
- Analysis: Real on-chain data — no scrapers, no caches of cached caches
- Uptime: 99.9% target — monitored, auto-restart via systemd
What is a Solana cabal?A group of wallets — often funded from the same source and buying in the same block — that quietly accumulate a large share of a token's supply before retail, then dump simultaneously into everyone who buys after launch.
How do I check if a Solana token is a rug?Scan the mint with Cabal-Hunter (MCP, REST API, or the free 3D holder map). It traces holder funding back to shared sources, detects same-block bundle buys, flags serial-launcher deployers and live coordinated dumps, and returns anExit-Liquidity Riskverdict:LOW,ELEVATED, orHIGH.
Is it free?Yes — 250 scans/month per IP, with no signup or API key. Beyond that it's $0.001 USDC per scan — which just covers the Helius RPC cost of the live trace — paid natively on Solana.
Can AI trading agents use it?Yes — that's the whole point. The MCP server (api.cabal-hunter.com/mcp) lets Claude, Cursor and ElizaOS agents callcheck_cabal_risk(mintAddress)automatically before any swap, and a REST API covers any other language.
MIT — fork it, build on it, integrate it. If you build something with this, share it.
Built byPF Capital· Powered by Helius · Contact: api.cabal-hunter.com/api/info
Remote MCP server for historical crypto & prediction-market data: search ~500K instruments, live market stats (OHLC, turnover, spreads, depth, slippage) and tick-data purchase. Keyless for catalog & stats; optional OAuth for account tools. Endpoint: https://cryptostruct.com/mcp
Read-only MCP server for your Evibe investment portfolio + live market data (holdings, performance, dividends, benchmarks, screeners). Works with Claude & ChatGPT.
Remote MCP server with real-money crypto casino audit data: trust scores, rankings, live payout tests, and T&C-decoded bonuses. No API key, Ed25519-signed answers. Endpoint: https://wagerx.io/mcp
Alpaca’s official MCP Server lets you trade stocks, ETFs, crypto, and options, run data analysis, and build strategies in plain English directly from your favorite LLM tools and IDEs
Live cross-DEX crypto prices read from on-chain pool state: per-venue price, liquidity depth and gross cross-venue spread across BSC, Polygon, Arbitrum, Base, Avalanche and Optimism. Works keyless, no account.
Bottom/top market-timing verdicts for 8 markets (crypto, stocks, commodities, FX, property) — x402 pay-per-call, no API key.
Read-only, sourced and timestamped prices for nine Binance Spot USDT markets through a public Streamable HTTP MCP endpoint.
Read-only crypto derivatives data for agents: funding, open interest, liquidations, options flow, COT, ETF flows, VPIN. 20 tools, no API key, hosted at https://mcp.bykaranteli.com
Free crypto address labels. Identify known addresses on major networks with a free API.
Crypto Market Pulse & Base USDC Stats
x402-paid MCP server: live crypto market pulse ($0.001) and Base USDC on-chain stats ($0.005), settled in USDC on Base mainnet.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
