Cabal Hunter

Solana Safe Sniper — MCP Template

[MCP server] [Solana] [Live demo] [Free tier] [Install MCP in VS Code] [Install MCP in Cursor] [ElizaOS plugin] [License: MIT]

🌐 Available in 9 languages: English · Español · Português · Français · Deutsch · Nederlands · 中文 · 日本語 · 한국어

[Cabal-Hunter — live Solana cabal and rug analysis: interactive 3D holder map, serial-launcher deployer history, and an Exit-Liquidity Risk verdict]

Stop your AI trading agents getting rugged by coordinated wallet cabals. Drop-in template for Claude Code, Cursor, and ElizaOS.

▶ Try it now: live 3D holder map of any Solana token → — no signup.

Cabal-Hunter is a free on-chain Solana token safety scanner and rug checker. It detects coordinated wallet cabals, same-block bundle buys, serial-launcher deployers and same-block coordinated selling on any Solana mint (pump.fun, PumpSwap, Raydium, Orca, Meteora) — and answers the one question that matters before you ape: are you the exit liquidity? Use it via MCP (Claude, Cursor, ElizaOS), a REST API, or a free interactive 3D holder map.

The Problem

Your autonomous trading agent is reading rug.check scores, liquidity locks, and contract audits.

None of that catches a cabal.

A handful of wallets take the bottom of a launch, the chart looks clean — contract fine, LP burned, everything green — and then they sell into whoever bought after them. You are the exit liquidity.

This template integrates Cabal-Hunter as a pre-trade safety check, so your agent can see who is holding and who has already positioned to sell before it signs a swap.

A note on what we do and don't claim. This README used to open with "15 fresh wallets funded from the same master wallet, accumulating 25-40% of supply." We went looking for that pattern and could not find it. Tracing 323 pump.fun launches at the bonding curve turned up zero coordinated funding clusters, and showed why: the median launch has about five successful buyers, because on one representative token 1,260 of the curve's 1,266 transactions failed. Launch capture is a sniper race between competing bots, not a quiet cabal. The detection layers below are the ones we can actually evidence — holder concentration, same-block bundles, coordinated selling and deployer history. The pre-launch funding tracer was withdrawn; the full write-up is here.

The one question it answers: are YOU the exit liquidity?

The classic pump.fun exit-liquidity setup: wallets positioned before the crowd take the bottom of a launch, then dump on the retail (and bots) that pile in after. Cabal-Hunter's headline output is a single Exit-Liquidity Risk verdict — risk_level, one of LOW_SIGNAL | ELEVATED | HIGH that synthesises every signal below into the only thing that matters before you sign a swap: are the insiders positioned to dump on you?

What Cabal-Hunter Does

Token mint address      ↓0. EXIT-LIQUIDITY RISK — the headline verdict. Synthesises the layers   below (bundle, concentration, shared funder, coordinated selling,   serial-launcher dev) into risk_level: LOW_SIGNAL | ELEVATED | HIGH.   Are insiders set up to dump on a buyer? The one field an agent needs.      ↓1. HOLDER FUNDING TRACE (ONE HOP) — the CURRENT top holders walked back   one funding hop: were they seeded by the same wallet? ONE hop, not a   lineage — we do not claim to follow money through a chain of   wallets. Only System-owned accounts count as   a funder, so pools, vaults and routers can never be mistaken for a   person (that mistake is exactly what got our pre-launch tracer   withdrawn). Every cluster carries evidence_txs[] — the actual   funding transactions on Solscan. This layer is genuinely rare to   fire; treat a hit as significant and its absence as no evidence   either way.      ↓2. SAME-BLOCK BUNDLE DETECTION — holders whose token accounts were   created in the EXACT same slot - a Jito bundle is one way to do that, not   the only one. Catches   stealth launches that route funding through intermediaries to   evade layer 1. Returned as `time_sync: true`.      ↓3. COORDINATED SELLING DETECTION — ≥2 holders that SOLD a meaningful   chunk (≥25% of their bag each) in the EXACT same block.   `coordinated_exit: true`, with sold_pct = % of supply sold and the   signatures in evidence_txs[]. Same-slot + meaningful-size + distinct   wallets = near-zero false positives. It reads the CURRENT holder set   at scan time, so a bundle that already sold and left the top holders   is not visible here — that is what the launch-block check is for.   For a token you already hold, POST /api/watch pushes you a webhook   the moment a dump or liquidity drain STARTS.      ↓4. DEV TRACK RECORD — the creator wallet is resolved on-chain (bonding   curve pre-graduation, pump-amm pool after — works on any age token),   and their launch history is pulled WITH THE PEAK MARKET CAP each   past token hit. `sampled` says how many of those launches we actually   walked — a very prolific wallet is sampled, not exhausted, so read   `tokens_launched` as a floor, never as a complete history.   Launch detection is venue-agnostic: pump.fun, Raydium,   Orca, Meteora and PumpSwap. A launch is only counted where the   transaction actually CREATED the mint, so minting more supply of a   token that already exists is never miscounted as a launch.   A dead-count alone hides a pump-and-dump: a dev whose   tokens all died at $4k is a nobody, but one who ran a token to $728k   then dumped it to dust has done it to holders before. Reputation:   FIRST_LAUNCH | PROVEN | MIXED | DEAD_ON_ARRIVAL | SERIAL_RUGGER |   UNKNOWN, with per-launch peak → now (paid tier returns the full   launches[] array). UNKNOWN means the history could not be   established — never read it as a clean record.      ↓5. CEX-NOISE FILTER — holders funded from a shared exchange or   high-volume infra wallet are NOT a cabal. They're excluded from the   score and surfaced transparently in filtered_clusters[], so you never   get a false positive from people who just withdrew from Binance.      ↓6. HONEYPOT CHECK (Solana-native) — one RPC read of the mint account:   is the FREEZE authority live (issuer can freeze your tokens — the   sell-block lever)? is the MINT authority live (supply can be   inflated)? any Token-2022 traps (transfer fees up to 100%, transfer   hooks that block sells, permanent-delegate clawback)? On Solana a   "honeypot" is built from these — tokens have no per-token contract   code to audit. Returns `honeypot_risk: LOW | HIGH` +   `freeze_authority_revoked` / `mint_authority_revoked` /   `token2022_risks[]`.      ↓Returns: Cabal Score (0-100) + cluster map + deployer verdict         + honeypot verdict + on-chain receipts + hard verdict

The deployer layer is the one cabals can't dodge: wallets rotate, deployers leave a paper trail. A response of "deployer": {"reputation": "SERIAL_RUGGER", "tokens_launched": 22, "best_peak_usd": 728432, "pump_and_dumps": 2} shows the dev's full track record before the first candle — including whether this "dead" dev has quietly run tokens to six figures and dumped them on holders before. (Honest context: most prolific pump.fun creators have high dead-token rates, so this signal is capped — it flags a token for review but never drives a HIGH verdict on its own.)

FIRST_LAUNCH and UNKNOWN are not the same answer. deployer.verdict of FIRST_LAUNCH means we walked this creator's history and found no earlier tokens. UNKNOWN means the history could not be established at all — that is an absence of evidence, not a clean record, and an agent must not treat it as one. Where a deployer cannot be resolved the scan says so in words rather than returning a confident silence.

Receipts, not magic. Every wallet cluster carries evidence_txs[] — the raw signatures behind that cluster, checkable on Solscan, and holders carry funding_tx where we resolved one. Holder concentration, deployer history and the honeypot checks are read from chain state, so they carry no transaction of their own: a token can come back HIGH with no clusters at all. Verify what is there rather than trusting a score.

Response in <100ms for a mint traced in the last 8 hours — computed_at (unix seconds) says exactly when that trace ran. Any other mint runs a live on-chain trace and takes 15-20s, so allow a 30s timeout.

Free tier: 5 scans/month with no account, or 250/month with a free key (one email). Then $0.001 per scan — priced at cost (it covers the Helius RPC calls behind each live on-chain trace). Pay by card, in USDC on Solana, or via x402 — same price through every door. $9/month buys unlimited fair-use scans; by card that renews automatically and can be cancelled anytime at cabal-hunter.com/billing.

Quick Start

1. Claude Code / Claude Desktop

Add to your MCP config (~/.claude/mcp.json or project .mcp.json):

{  "mcpServers": {    "cabal-hunter": {      "url": "https://api.cabal-hunter.com/mcp"    }  }}

That's it. Claude will now call check_cabal_risk automatically when you ask it to analyse a Solana token.

Example prompt:

"Before we buy into this token, check if there are any coordinated wallets: EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v"

Claude calls the tool, pays $0.001 USDC from your connected wallet, and returns the full analysis.

2. Cursor

Add to .cursor/mcp.json in your project root:

{  "mcpServers": {    "cabal-hunter": {      "url": "https://api.cabal-hunter.com/mcp"    }  }}

3. ElizaOS (with automatic x402 payment)

If you're using ElizaOS with @hugen/plugin-x402-solana, payment is handled automatically. Add to your agent config:

{  "plugins": ["@hugen/plugin-x402-solana"],  "mcpServers": {    "cabal-hunter": {      "url": "https://api.cabal-hunter.com/mcp"    }  }}

Your agent will call check_cabal_risk(mintAddress) before any swap and abort if cabalScore >= 35 or isControlled === true.

4. Direct REST API

For headless scripts, custom bots, or any language. The first 5 calls/month are free — no key, no signup. A free key (one email) raises that to 250/month. Just call it:

curl "https://api.cabal-hunter.com/api/scan-cabal?mintAddress=YOUR_MINT_ADDRESS"

You get the full analysis back immediately, with free_queries_remaining so you always know where you stand. Machine-readable contract: /openapi.json.

Once the free tier is used up, calls are $0.001 USDC via x402 — your agent just pays, no billing setup:

Step 1 — Request analysis (get payment instructions):

curl -X POST https://api.cabal-hunter.com/api/scan-cabal \  -H "Content-Type: application/json" \  -d '{"mintAddress": "YOUR_MINT_ADDRESS"}'

Response (HTTP 402):

{  "error": "payment_required",  "payment": {    "recipient": "ATYjZ1kWoHWhj74umGJ8wFqUeW1yeSGBbLi1UQpahPxt",    "amount_usdc": 0.001,    "memo_required": "ch-xxxx-xxxx-xxxx",    "instructions": "Send 0.001 USDC with this memo, then resubmit with X-Payment-Signature header"  }}

Step 2 — Pay & resubmit:

curl -X POST https://api.cabal-hunter.com/api/scan-cabal \  -H "Content-Type: application/json" \  -H "X-Payment-Signature: YOUR_TX_SIGNATURE" \  -d '{"mintAddress": "YOUR_MINT_ADDRESS"}'

Response (HTTP 200):

{  "mint": "YOUR_MINT",  "token_name": "EXAMPLE",  "risk": "HIGH",  "cabal_score": 72.4,  "is_controlled": true,  "time_sync": true,  "verdict": "AVOID — 4 wallets bought in the EXACT same block (bundled launch), controlling 34.1% of supply. DEPLOYER ALERT: this creator has launched 14 tokens, 13 of 13 checked are dead (100%).",  "coordinated_clusters": [    {      "type": "funding",      "master_full": "FvbEKF...9RUg",      "master_short": "FvbEKF…9RUg",      "wallet_count": 4,      "combined_pct": 34.1,      "risk": "HIGH",      "evidence_txs": ["4Y8auc5G...", "2XQx9LFv...", "AAbJ7rej..."]    }  ],  "filtered_clusters": [    {      "funder_label": "high-volume wallet",      "master_short": "43ViqZ…Z6iy",      "wallet_count": 2,      "combined_pct": 4.4    }  ],  "deployer": {    "creator": "5TbRN6...full address...",    "creator_short": "5TbRN6…2TGC",    "tokens_launched": 14,    "dead": 13,    "sampled": 13,    "dead_pct": 100.0,    "verdict": "SERIAL_LAUNCHER"  },  "holders": [    { "rank": 1, "address": "...", "pct": 12.4, "cluster_id": 0, "funding_tx": "4Y8auc5G..." }  ],  "wallets_checked": 12,  "analysis_time_ms": 487,  "source": "real_time"}

5. Run the MCP server locally (Docker / Node)

Fastest — no clone needed: npx cabal-hunter-mcp — the same stdio server, published to npm (cabal-hunter-mcp · npm). Or run it from this repo:

Prefer to run the connector yourself instead of hitting the hosted /mcp endpoint? This repo ships a thin stdio MCP server that exposes check_cabal_risk(mintAddress) and proxies to the Cabal-Hunter API (free tier works with no key; paid scans use x402 at call time):

# Node 18+npm installnode server/index.mjs
# or Dockerdocker build -t cabal-hunter-mcp .docker run -i cabal-hunter-mcp

Then point any MCP client at the local command:

{  "mcpServers": {    "cabal-hunter": {      "command": "node",      "args": ["server/index.mjs"]    }  }}

Integrate into Your Trading Logic

import requests
def is_safe_to_buy(mint_address: str, payment_sig: str) -> bool:    """Returns True if token passes cabal check."""    resp = requests.post(        "https://api.cabal-hunter.com/api/scan-cabal",        json={"mintAddress": mint_address},        headers={"X-Payment-Signature": payment_sig}    )    if resp.status_code != 200:        return False  # fail-safe: don't buy on error    data = resp.json()    # Block on: coordinated control, high score, bundled launch,    # or a deployer with a history of dead tokens    deployer_verdict = (data.get("deployer") or {}).get("verdict", "UNKNOWN")    return (        not data.get("is_controlled")        and data.get("cabal_score", 100) < 35        and not data.get("time_sync")        and deployer_verdict not in ("SERIAL_RUGGER", "SERIAL_LAUNCHER", "POOR_TRACK_RECORD")    )
# In your bot's buy logic:if is_safe_to_buy(token_mint, my_payment_sig):    execute_swap(token_mint, sol_amount)else:    print(f"Cabal detected — skipping {token_mint}")

Interactive 3D Holder Map (Free)

See exactly what the analysis found. Every real holder is a faceted crystal sized by its share of supply; wallets in the same cluster are joined by light beams, and the liquidity pool and locked supply sit apart in a wireframe vault because they cannot be sold. Drag to rotate, hover for the wallet, click through to Solscan:

https://api.cabal-hunter.com/map?mint=ANY_SOLANA_MINT

Free to view, in 9 languages. Share this URL when you catch a rug. Every crystal is clickable and links to Solscan for deep-dive research.

Cabal-Hunter everywhere

Same detection engine, wherever your stack lives:

• npx cabal-hunter-mcp — standalone MCP server for Claude · Cursor · VS Code · any MCP client: cabal-hunter-mcp · npm
• ElizaOS plugin: npm i elizaos-plugin-cabal-hunter — plugin-cabal-hunter · npm
• REST API + OpenAPI: api.cabal-hunter.com · /openapi.json

Pricing

First 5 scans every month are free — no signup, no API key. A free key (one email) raises that to 250/month.

After that, pick whatever matches how hard your bot works (priced at cost — it covers the Helius RPC behind each live on-chain trace):

Prepaid keys: send USDC once → POST /api/buy-key with the tx signature → use header X-API-Key on every scan. Or pay per-call via x402 (X-Payment-Signature header). No credit card, no account, no lock-in.

Does it pay for itself? Work it out with your own numbers rather than ours: the Unlimited tier is $9 a month, so it pays for itself the first time it keeps you out of a position bigger than $9 that goes to zero. Whether that happens once a month or once a week depends on what you trade and how often — we are not going to invent an average for you.

Payment is native on Solana — no credit card, no account, no subscription lock-in.

Live dashboard badge

Drop a live safety badge into your own bot's dashboard — two lines of HTML, and every token shows its verdict as it trades:

<div class="cabal-hunter-badge" data-mint="YOUR_TOKEN_MINT"></div><script src="https://api.cabal-hunter.com/widget.js" defer></script>

It renders the 0–100 score, the plain-English verdict, and the active flags (bundled launch, coordinated selling, whale concentration, serial-launcher deployer, honeypot). Add data-refresh="120" to re-scan live as you trade, and data-api-key="..." once you're past your free scans. Works anywhere — React, plain HTML, any site.

API Reference

Emergency dump webhook (auto-exit)

Instead of polling, let your bot subscribe to a token it holds — we push the moment a coordinated dump or liquidity drain starts:

curl -X POST https://api.cabal-hunter.com/api/watch \  -H "Content-Type: application/json" \  -d '{"mint":"YOUR_MINT","webhook_url":"https://your-bot.com/dump-alert"}'

Your endpoint receives:

{ "event":"dump_detected", "mint":"...", "reason":"price −34% since last check",  "coordinated": true, "price_usd": 0.0001, "liquidity_usd": 4200,  "action":"consider_immediate_exit", "ts": 1781370000 }

Infrastructure

• RPC: Helius (Frankfurt)
• Hosting: AWS EC2 Frankfurt — low latency for EU/global
• Analysis: read from the chain, never scraped from another scanner. A completed trace is cached for 8 hours and computed_at always says when it ran; fresh=1 forces a new one
• Uptime: 99.9% target — monitored, auto-restart via systemd

FAQ

What is a Solana cabal? A group of wallets — often funded from the same source and buying in the same block — that quietly accumulate a large share of a token's supply before retail, then dump simultaneously into everyone who buys after launch.

How do I check if a Solana token is a rug? Scan the mint with Cabal-Hunter (MCP, REST API, or the free 3D holder map). It traces holder funding back one hop to shared sources, detects same-block bundle buys, flags serial-launcher deployers and same-block coordinated selling, and returns an Exit-Liquidity Risk verdict — risk_level: LOW_SIGNAL, ELEVATED or HIGH.

Is it free? Yes — 5 scans/month with no signup or API key, and 250/month with a free key (one email). Beyond that it's $0.001 USDC per scan — which just covers the Helius RPC cost of the live trace — paid natively on Solana.

Is there a way to use it without writing code? Yes — @TheCabalHunter_Bot on Telegram. Paste a mint, get the same scan as a card, and ask it to watch a token you hold so it messages you when a dump starts. Scored tokens are posted to @CabalHunterAlerts.

Can AI trading agents use it? Yes — that's the whole point. The MCP server (api.cabal-hunter.com/mcp) lets Claude, Cursor and ElizaOS agents call check_cabal_risk(mintAddress) automatically before any swap, and a REST API covers any other language.

License

MIT — fork it, build on it, integrate it. If you build something with this, share it.

Built by Cabal Hunter · Powered by Helius · Contact: api.cabal-hunter.com/api/info