DeFade — Multi-Chain Memecoin Analyzer

org.defadePublished by defade.orgOfficial publisherv1.1.8Updated Oct 25, 2026

Rug pull risk and on-chain forensics for tokens on Solana and six EVM chains.

VerifiedStreamable HTTPWeb executableFinanceSecurity & MonitoringData & Analytics

Overview

AI-generated overview

DeFade is a remote MCP server that lets an assistant run rug-pull risk and on-chain forensics on memecoin tokens across Solana and six EVM chains.

What you can do
Scan a token contract for metadata, holder distribution, creator history and a risk verdict, and get a 0-100 rug score with its driving signals and price history as OHLCV candles with highs, lows and percent change. Break down holders and whales with pools, burn addresses, lockers and exchanges classified out, and check liquidity pool depth and whether LP tokens are burned, locked or unlocked. Detect launch bundles, early snipers and their links to the deployer, and trace wallet links, funding sources and lookalike clusters that behave as one actor. Profile the creator's remaining supply and sales, find wallets sharing an identical fee setting, and identify smart-money wallets by historical
When to use it
Use it when evaluating whether a memecoin is safe to buy or hold, or when investigating who is really behind a token's supply and demand. It suits traders, analysts and researchers who want structured risk signals rather than raw chain data.
Requirements
A remote streamable HTTP endpoint; no local package. An x-api-key header with a DeFade API key is needed for scan tools, though connecting and listing tools works without one. Network access to the DeFade API.
Before you install
The API key is a secret sent in the x-api-key header. Scan tools require a key and may consume a metered monthly allowance, which get_usage reports. Risk scores and verdicts are third-party heuristics, not investment advice; note that the rug score runs opposite to the scan's safety score. All tools are read-only lookups.

Installation

In SourceWeft

  1. Open DeFade — Multi-Chain Memecoin Analyzer in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/org.defade%2Fdefade/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "defade-multi-chain-memecoin-analyzer": {
      "type": "http",
      "url": "https://api.defade.org/mcp"
    }
  }
}

Tools

15

get_token_scan

Scan a token

Run a full DeFade scan on one token contract. On Solana: token metadata, holder distribution, creator history (wallet age, previous token launches) and the headline risk verdict. On an EVM chain: the contract and market read only (token metadata with the owner and the mint, blacklist, whitelist and proxy flags, market, pairs and warnings), with no holders, creator or score; call get_rug_score there for the verdict. Start here for any "is this token safe", "is this a rug pull" or "should I buy this" question, then call get_rug_score for the verdict: the safety score here weighs only holders, creator and authorities. On Solana returns risk.score as a SAFETY score where 100 is clean and low numbers are dangerous, with a rating label. For the inverse — a rug pull probability where high means dangerous — call get_rug_score. Not for a single module in isolation (call that module's tool directly), price or market-cap questions (get_token_price), or checking the caller's own quota (get_usage). Arguments: address and chain; one API unit on any chain.

Parameterschainaddressrequired

get_rug_score

Rug pull probability

Rug pull probability for one token: a 0-100 score where HIGHER MEANS MORE DANGEROUS, a verdict label, and the individual signals that drove it. This is the opposite direction from get_token_scan's safety score. This is the verdict the DeFade website shows: call it, after get_token_scan, for every "is this safe", "is this a rug" or "should I buy" question, on every chain (on an EVM chain get_token_scan carries no score at all). When complete is false the score is partial: say so, and call again for the rest. Not for the evidence behind the number — it names the signals but does not list the wallets; for who is behind the risk call get_wallet_links, get_dev_tracker or get_launch_bundles. Arguments: address and chain; one API unit on Solana, five on an EVM chain, because there the score reads every module first — check get_usage before scoring many EVM tokens.

Parameterschainaddressrequired

get_holders

Holder distribution

Holder distribution for one token, with liquidity pools, burn addresses, lockers, exchange wallets and contracts classified out, so the top-holder list reflects actual holders. Returns the classified top holders with each wallet's supply share in a single response — no pagination. Use it to answer how concentrated the supply is and whether a few wallets could collapse the chart. Not for what large holders are doing right now (get_whales), whether holders are secretly one actor (get_wallet_links or get_lookalike_clusters), or pool depth and locks (get_liquidity). Arguments: address and chain; one API unit on any chain.

Parameterschainaddressrequired

get_whales

Whale activity

Wallets holding at least 1% of supply once pools, lockers, treasuries and custodial accounts are removed. Each row carries the balance, share of supply, any attribution label (known KOL, dev-linked stash, exchange), the 24-hour transaction count and recent buys and sells; the summary counts dangerous and active whales and gives a whale-risk verdict. One response, no pagination; cached for 15 minutes, so activity figures can lag by that much. A token with nothing above the threshold returns an empty list and largestHumanPct, so the empty state is explainable rather than silent. Use it after get_holders when the question is about who can dump and whether they are already dumping. Not for the full ranked holder list (get_holders), historically profitable wallets (get_smart_money), or the creator's own wallet (get_dev_tracker). Arguments: address and chain; one API unit on any chain.

Parameterschainaddressrequired

get_liquidity

Liquidity analysis

Liquidity pool analysis for one token: which DEX holds the deepest pool, its depth in USD, and whether the LP tokens are burned, locked or still in someone's hands. lpStatus is the verdict — LP BURNED, LP LOCKED, LP UNLOCKED, PARTIALLY BURNED, LP NOT LOCKABLE, BONDING CURVE (still on a launchpad curve, no pool yet) or NO LP FOUND, with combinations spelled out — and lpBurnPct, lpLockPct and poolLocks carry the evidence. Use it to answer whether liquidity is locked, how deep it is, and whether the position could be pulled: LP UNLOCKED means it can be pulled at any time. Cached for about two minutes. A token with no pool returns empty liquidity data, which is itself a warning on a token that is trading. Not for price or volume (get_token_price), market cap (get_token_scan) or holder concentration (get_holders). Arguments: address and chain — pools live per chain, so a 0x address needs the chain it trades on, and a Base pool is not found under ethereum; one API unit on any chain.

Parameterschainaddressrequired

get_launch_bundles

Launch-window bundles

Bundle detection for one token: coordinated buys in the launch window plus delayed sweeps, accounted on peak net exposure rather than raw buy count, so wallets that bought and flipped are not counted as holders. Heavy bundling that is still held is one of the strongest rug predictors. Use it for any "was this launch bundled" question. Not for lone fast buyers with no coordination (get_launch_snipers), clusters that formed after launch (get_lookalike_clusters), or the creator's own selling (get_dev_tracker). Arguments: address and chain; one API unit on any chain.

Parameterschainaddressrequired

get_launch_snipers

First-block snipers

Bots that bought in the first block or first seconds of this token's launch, and whether they are connected to the deployer. The window is the first 120 seconds after the first transaction; at most 30 rows are returned and totalEarlyBuyers carries the full count. Migration-crank MEV bots are excluded and named rather than silently dropped. Check reachedGenesis: when false the walk did not reach the true first transaction, the result is partial, and it is cached for an hour instead of two. Use it to tell an organic launch from a pre-arranged one. Not for coordinated multi-wallet launch buying (get_launch_bundles) or the deployer's funding of other wallets (get_wallet_links). Arguments: address and chain; one API unit on any chain.

Parameterschainaddressrequired

get_smart_money

Smart money

Wallets with a track record of profitable entries that are holding or trading this token, classified from their historical trade win rates — a "verified" smart-money tag requires a known win rate of 50% or better. Computed live from the current holder set and cached for about five minutes. Use it for the bullish side of a scan: who informed is in, and when they got in. Not for risk assessment — informed wallets present never offsets a rug signal, and a clean result is not a buy signal — and not for wallet size (get_whales). Arguments: address and chain; one API unit on any chain.

Parameterschainaddressrequired

get_dev_tracker

Dev wallet tracking

What the token's creator has done with their supply: the share they still hold, what left through sales versus transfers, and where the transfers went. Read the state carefully: still holding is neutral, a dev who simply sold out is statusColor gray — the standard launch pattern, not a rug — fully exited on a fresh token is a warning, and transferred out to fresh wallets (red) is the single strongest rug signal DeFade tracks. The creator is the wallet that created the mint on Solana and the contract deployer on EVM chains; creatorSource says how it was identified, and creatorInferred true means it may be a launchpad authority rather than a person, so weigh the verdict accordingly. Not for wallets other than the creator (get_whales, get_wallet_links); the creator's earlier launches are already served by get_token_scan's creator block (tokenCreations, recentTokens). Arguments: address and chain — the deployer is read from the contract creation on that chain, so a 0x address needs its chain; one API unit on any chain.

Parameterschainaddressrequired

get_funding_sources

Funding provenance

Multi-hop tracing of where the money behind this token's key wallets actually came from, walking each funding chain back and tiering the source by whether it is a KYC'd exchange. Use it to test whether several "unrelated" holders share one funding source. It answers provenance only — money in, one dimension: it does not build the wallet-to-wallet transfer graph (get_wallet_links), group look-alike behaviour (get_lookalike_clusters), or match shared bot fee settings (get_fee_fingerprint). Read coveragePct before the origins: it is the share of supply that could be attributed, the remainder (unknownCount wallets) could not be traced and is not evidence either way, and dexPct and bridgedPct are real states rather than attributions. Results are cached for 30 minutes (computedAt, fromCache). Not for the creator's own activity (get_dev_tracker) or launch-window buying (get_launch_bundles, get_launch_snipers). Arguments: address and chain — a 0x address needs its chain; on an EVM chain this call costs 5 API units instead of 1, because the trace runs against paid indexers, so check get_usage before running it across many tokens.

Parameterschainaddressrequired

get_lookalike_clusters

Behavioural sybil clusters

Clusters of wallets around one token that behave as a single actor — buys sized and timed alike so demand looks organic — even when no transfer or funding trail connects them. That behavioural inference is what separates it from get_wallet_links, which only reports proven links. Use it when supply looks distributed across many small wallets and the insider graph comes back clean; corroborate with get_fee_fingerprint. Not for proven transfer links (get_wallet_links), the funding source behind the wallets (get_funding_sources), or launch-window coordination (get_launch_bundles). Arguments: address and chain; on an EVM chain this call costs 5 API units instead of 1, because the trace runs against paid indexers.

Parameterschainaddressrequired

get_fee_fingerprint

Shared fee-setting fingerprint

Wallets whose transactions pin an identical fee setting — compute-unit price or Jito tip on Solana, priority fee or legacy gas price on EVM chains — one operator's bot settings showing up across every wallet it drives. This is the shared-CONFIGURATION member of the "who is really behind this token" family (proven transfers: get_wallet_links; funding origin: get_funding_sources; behavioural twins: get_lookalike_clusters), not a timing link: it never proves bundling, and two wallets can match days apart. Use it to corroborate get_lookalike_clusters, and to catch the operator who sold their launch wallets and re-entered through fresh ones; read a match as corroboration, never as proof of coordinated buying. Groups are strongest first; pending true means no bundle scan has run for this token yet, so nothing has looked rather than nothing was found. Arguments: address and chain; one API unit on any chain, because it reads what the bundle scan already computed.

Parameterschainaddressrequired

get_token_price

Token price

Price history for one token as OHLCV candles, plus the latest price, the window's high and low with their timestamps, and the percent change across the window — prices in USD (the *Usd fields), volume as the market source quotes it. Aggregated from DEX market sources and cached for about a minute. Intervals with no trades are omitted rather than zero-filled, so consecutive candles can sit more than one step apart. The optional timeframe argument sets the candle size and with it how far back the window reaches: 15m (the default) covers about the last 2.5 days, 1H about 10 days, 4H about 40 days and 1D up to a year of daily candles, back to the token's first trade if it is younger; there is no start or end argument, the size fixes the window. Use 1D for "what did it peak at", "how far is it down from the top" or any price history question; use the default for the market context around a risk verdict. A token with no liquidity pool returns candles: [] and totalCandles: 0 rather than an error. Not for risk of any kind — market data carries no forensic signal — and not for pool depth or lock status (get_liquidity) or market cap (get_token_scan's token block). Arguments: address, chain and timeframe — a 0x address needs its chain; one API unit on any chain regardless of timeframe.

Parameterschainaddressrequiredtimeframe

get_usage

API usage

Report the calling API key's plan, rate limits and how much of its monthly allowance is left. Takes no arguments. Use it when a call fails on quota, or when the user asks what their DeFade plan includes. Not for anything about a token — every other tool takes an address; this one reports on the key itself.

Takes no parameters.

Version history

2
  1. v1.1.8LatestOct 10, 2026
  2. v1.1.7Sep 16, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.