# com.cabal-hunter.api/cabal-hunter

> Solana pre-trade safety for AI agents: cabal, bundle, dump, deployer & honeypot in one verdict.

- name: com.cabal-hunter.api/cabal-hunter
- version: 1.2.0
- connection class: R0 (autonomous)
- trust: 88/100
- quality: 76/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/com.cabal-hunter.api%2Fcabal-hunter
- tools: https://api.protogrid.dev/v1/servers/com.cabal-hunter.api%2Fcabal-hunter/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "cabal-hunter": {
      "type": "http",
      "url": "https://api.cabal-hunter.com/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 98
- freshness: 65
- provenance: 85
- drivers: +repository +dns-namespace +website +reachable +uptime-96% ~updated-105d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 76/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 64 (weight 30)

- pass `tools.descriptions`: every tool has a description
- warn `tools.description_length`: 2 tools have descriptions over 1,024 characters, which crowds the context
- pass `tools.schemas`: every tool has an object input schema
- fail `tools.annotations`: no tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: check_cabal_risk (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); check_wallet_in_token (readOnlyHint, destructiveHint, idempotentHint, openWorldHint)
- pass `tools.token_cost`: about 1,739 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: 3 tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 2, about 1,739 tokens to load them all
- tool set hash: 12a0bbb559f2e1d5b44e012d42b44a37
- tools last changed: 2026-10-14T01:46:18.340Z
- badge: [![protogrid quality](https://protogrid.dev/badge/com.cabal-hunter.api/cabal-hunter.svg)](https://protogrid.dev/servers/com.cabal-hunter.api/cabal-hunter)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-14 `check_cabal_risk` changed (description)
  - before: Pre-trade safety check for any Solana token mint: is a buyer about to be someone's exit liquidity? Every wallet cluster carries its evidence_txs. AFTER YOU BUY: POST /api/watch {mint} with an X-API-Key (any key; add webhook_url on the Pro plan) and we alert you the moment a coordinated dump or liquidity drain starts on that token — carrying the same on-chain evidence. This scan is a BUY check; a watch is a HOLD check, and a holder needs the second one continuously. GET/DELETE /api/watch manage your own. Layers, ordered by STRENGTH OF EVIDENCE (not marketing): 1. HOLDER CONCENTRATION — what share one wallet actually controls (`top_holder_pct`). A single wallet that can crater the price is the most basic rug vector, and it needs no coordination at all. IMPORTANT: we count only REAL wallets. LP pools, locked/vesting supply and other program-owned accounts are excluded and labelled, never scored as a whale — and supply comes from getTokenSupply, not an estimate. Tools that skip this report a locked-supply token as '65% one wallet'. Our numbers reconcile with GMGN's circulating top-10. 2. SAME-BLOCK BUNDLES — holders whose token accounts were created in the EXACT same block: a multi-wallet launch bought in one slot. A Jito bundle is one way to do that, not the only one - we read the slot, not the bundle. `time_sync: true`. 3. COORDINATED DUMP — ≥2 holders each selling ≥25% of their bag in the same block: a cabal exiting in real time. `coordinated_exit: true`, sold_pct. 4. HONEYPOT / AUTHORITY TRAPS (Solana-native) — live freeze authority, un-revoked mint authority, Token-2022 transfer-fee / transfer-hook / permanent-delegate traps. Answers: CAN you actually sell this token? 5. DEV TRACK RECORD — the creator resolved on-chain plus their full launch history WITH the peak market cap each past token hit, so a dead-count can't hide a pump-and-dump. Covers ANY Solana venue: pump.fun, Raydium, Orca, Meteora, PumpSwap. A launch counts only where the transaction actually CREATED the mint, so re-minting supply of an existing token is never miscounted as a launch. reputation (SERIAL_RUGGER / DEAD_ON_ARRIVAL / MIXED / PROVEN) + best_peak_usd, pump_and_dumps count; paid tier adds launches[] (peak_mcap_usd, now_mcap_usd, drawdown, status per launch). 'Ran to $728k, now dust' = this dev has dumped six figures on holders before. Still CAPPED: peak history is evidence, never softens the score. READ deployer.verdict CAREFULLY — two values mean opposite things: FIRST_LAUNCH = we walked the history and found no earlier tokens. UNKNOWN = the history could NOT be established. That is not evidence of anything and must never be treated as a clean record. 6. FUNDING-CLUSTER TRACE — top holders walked back to a shared funding wallet. A real capability, listed last on purpose: on our own sample it produced no verified detections once infrastructure (curve PDAs, token accounts) was correctly excluded. Treat it as supporting evidence. Returns risk (CLEAN|MEDIUM|HIGH), cabal_score 0–100, top_holder_pct, cluster breakdown with evidence_txs[], holder map, deployer verdict, honeypot_risk, plus wallets_checked / scan_complete / degraded so YOUR agent can apply its own risk tolerance instead of inheriting ours. If we cannot verify something, we say so (`degraded: true`) rather than returning a confident 'clean'. COST: 5 scans/month FREE with no signup and no API key; 250/month free with a key (one email, no card). After that $0.01 USDC per scan. Two ways to pay, no signup or card: (1) a subscription, $9/month for 2,500 scans or $99/month unlimited (fair use 50k) — best for 24/7 bots; or prepaid pay-as-you-go at $0.01/scan (any amount) — POST the tx to /api/buy-key, then send header X-API-Key; or (2) per-call via x402 (X-Payment-Signature header). Full terms: GET /api/info. FRESHNESS: a token traced in the last 8 hours is answered from that trace in <100ms; computed_at (unix
  - after: Pre-trade safety check for any Solana token mint: is a buyer about to be someone's exit liquidity? Every wallet cluster carries its evidence_txs. AFTER YOU BUY: POST /api/watch {mint} with an X-API-Key (any key; add webhook_url on the Pro plan) and we alert you the moment a coordinated dump or liquidity drain starts on that token — carrying the same on-chain evidence. This scan is a BUY check; a watch is a HOLD check, and a holder needs the second one continuously. GET/DELETE /api/watch manage your own. Paid plans: the watch also follows the token's insiders (dev, first-seconds buyers) for 7 days and pushes insider_* events when they sell or move together, each with the transaction. Layers, ordered by STRENGTH OF EVIDENCE (not marketing): 1. HOLDER CONCENTRATION — what share one wallet actually controls (`top_holder_pct`). A single wallet that can crater the price is the most basic rug vector, and it needs no coordination at all. IMPORTANT: we count only REAL wallets. LP pools, locked/vesting supply and other program-owned accounts are excluded and labelled, never scored as a whale — and supply comes from getTokenSupply, not an estimate. Tools that skip this report a locked-supply token as '65% one wallet'. Our numbers reconcile with GMGN's circulating top-10. 2. SAME-BLOCK BUNDLES — holders whose token accounts were created in the EXACT same block: a multi-wallet launch bought in one slot. A Jito bundle is one way to do that, not the only one - we read the slot, not the bundle. `time_sync: true`. 3. COORDINATED DUMP — ≥2 holders each selling ≥25% of their bag in the same block: a cabal exiting in real time. `coordinated_exit: true`, sold_pct. 4. HONEYPOT / AUTHORITY TRAPS (Solana-native) — live freeze authority, un-revoked mint authority, Token-2022 transfer-fee / transfer-hook / permanent-delegate traps. Answers: CAN you actually sell this token? 5. DEV TRACK RECORD — the creator resolved on-chain plus their full launch history WITH the peak market cap each past token hit, so a dead-count can't hide a pump-and-dump. Covers ANY Solana venue: pump.fun, Raydium, Orca, Meteora, PumpSwap. A launch counts only where the transaction actually CREATED the mint, so re-minting supply of an existing token is never miscounted as a launch. reputation (SERIAL_RUGGER / DEAD_ON_ARRIVAL / MIXED / PROVEN) + best_peak_usd, pump_and_dumps count; paid tier adds launches[] (peak_mcap_usd, now_mcap_usd, drawdown, status per launch). 'Ran to $728k, now dust' = this dev has dumped six figures on holders before. Still CAPPED: peak history is evidence, never softens the score. READ deployer.verdict CAREFULLY — two values mean opposite things: FIRST_LAUNCH = we walked the history and found no earlier tokens. UNKNOWN = the history could NOT be established. That is not evidence of anything and must never be treated as a clean record. 6. FUNDING-CLUSTER TRACE — top holders walked back to a shared funding wallet. A real capability, listed last on purpose: on our own sample it produced no verified detections once infrastructure (curve PDAs, token accounts) was correctly excluded. Treat it as supporting evidence. Returns risk (CLEAN|MEDIUM|HIGH), cabal_score 0–100, top_holder_pct, cluster breakdown with evidence_txs[], holder map, deployer verdict, honeypot_risk, plus wallets_checked / scan_complete / degraded so YOUR agent can apply its own risk tolerance instead of inheriting ours. If we cannot verify something, we say so (`degraded: true`) rather than returning a confident 'clean'. COST: 5 scans/month FREE with no signup and no API key; 250/month free with a key (one email, no card). After that $0.01 USDC per scan. Two ways to pay, no signup or card: (1) a subscription, $9/month for 2,500 scans or $99/month unlimited (fair use 50k) — best for 24/7 bots; or prepaid pay-as-you-go at $0.01/scan (any amount) — POST the tx to /api/buy-key, then send header X-API-Key; or
- 2026-10-12 `check_cabal_risk` changed (description)
  - before: Pre-trade safety check for any Solana token mint: is a buyer about to be someone's exit liquidity? Every wallet cluster carries its evidence_txs. AFTER YOU BUY: POST /api/watch {mint, webhook_url} with an X-API-Key (a free key is enough) and we push you an alert the moment a coordinated dump or liquidity drain starts on that token — carrying the same on-chain evidence. This scan is a BUY check; a watch is a HOLD check, and a holder needs the second one continuously. GET/DELETE /api/watch manage your own. Layers, ordered by STRENGTH OF EVIDENCE (not marketing): 1. HOLDER CONCENTRATION — what share one wallet actually controls (`top_holder_pct`). A single wallet that can crater the price is the most basic rug vector, and it needs no coordination at all. IMPORTANT: we count only REAL wallets. LP pools, locked/vesting supply and other program-owned accounts are excluded and labelled, never scored as a whale — and supply comes from getTokenSupply, not an estimate. Tools that skip this report a locked-supply token as '65% one wallet'. Our numbers reconcile with GMGN's circulating top-10. 2. SAME-BLOCK BUNDLES — holders whose token accounts were created in the EXACT same block: a multi-wallet launch bought in one slot. A Jito bundle is one way to do that, not the only one - we read the slot, not the bundle. `time_sync: true`. 3. COORDINATED DUMP — ≥2 holders each selling ≥25% of their bag in the same block: a cabal exiting in real time. `coordinated_exit: true`, sold_pct. 4. HONEYPOT / AUTHORITY TRAPS (Solana-native) — live freeze authority, un-revoked mint authority, Token-2022 transfer-fee / transfer-hook / permanent-delegate traps. Answers: CAN you actually sell this token? 5. DEV TRACK RECORD — the creator resolved on-chain plus their full launch history WITH the peak market cap each past token hit, so a dead-count can't hide a pump-and-dump. Covers ANY Solana venue: pump.fun, Raydium, Orca, Meteora, PumpSwap. A launch counts only where the transaction actually CREATED the mint, so re-minting supply of an existing token is never miscounted as a launch. reputation (SERIAL_RUGGER / DEAD_ON_ARRIVAL / MIXED / PROVEN) + best_peak_usd, pump_and_dumps count; paid tier adds launches[] (peak_mcap_usd, now_mcap_usd, drawdown, status per launch). 'Ran to $728k, now dust' = this dev has dumped six figures on holders before. Still CAPPED: peak history is evidence, never softens the score. READ deployer.verdict CAREFULLY — two values mean opposite things: FIRST_LAUNCH = we walked the history and found no earlier tokens. UNKNOWN = the history could NOT be established. That is not evidence of anything and must never be treated as a clean record. 6. FUNDING-CLUSTER TRACE — top holders walked back to a shared funding wallet. A real capability, listed last on purpose: on our own sample it produced no verified detections once infrastructure (curve PDAs, token accounts) was correctly excluded. Treat it as supporting evidence. Returns risk (CLEAN|MEDIUM|HIGH), cabal_score 0–100, top_holder_pct, cluster breakdown with evidence_txs[], holder map, deployer verdict, honeypot_risk, plus wallets_checked / scan_complete / degraded so YOUR agent can apply its own risk tolerance instead of inheriting ours. If we cannot verify something, we say so (`degraded: true`) rather than returning a confident 'clean'. COST: 5 scans/month FREE with no signup and no API key; 250/month free with a key (one email, no card). After that $0.01 USDC per scan. Two ways to pay, no signup or card: (1) a subscription, $9/month for 2,500 scans or $99/month unlimited (fair use 50k) — best for 24/7 bots; or prepaid pay-as-you-go at $0.01/scan (any amount) — POST the tx to /api/buy-key, then send header X-API-Key; or (2) per-call via x402 (X-Payment-Signature header). Full terms: GET /api/info. FRESHNESS: a token traced in the last 8 hours is answered from that trace in <100ms; computed_at (unix
  - after: Pre-trade safety check for any Solana token mint: is a buyer about to be someone's exit liquidity? Every wallet cluster carries its evidence_txs. AFTER YOU BUY: POST /api/watch {mint} with an X-API-Key (any key; add webhook_url on the Pro plan) and we alert you the moment a coordinated dump or liquidity drain starts on that token — carrying the same on-chain evidence. This scan is a BUY check; a watch is a HOLD check, and a holder needs the second one continuously. GET/DELETE /api/watch manage your own. Layers, ordered by STRENGTH OF EVIDENCE (not marketing): 1. HOLDER CONCENTRATION — what share one wallet actually controls (`top_holder_pct`). A single wallet that can crater the price is the most basic rug vector, and it needs no coordination at all. IMPORTANT: we count only REAL wallets. LP pools, locked/vesting supply and other program-owned accounts are excluded and labelled, never scored as a whale — and supply comes from getTokenSupply, not an estimate. Tools that skip this report a locked-supply token as '65% one wallet'. Our numbers reconcile with GMGN's circulating top-10. 2. SAME-BLOCK BUNDLES — holders whose token accounts were created in the EXACT same block: a multi-wallet launch bought in one slot. A Jito bundle is one way to do that, not the only one - we read the slot, not the bundle. `time_sync: true`. 3. COORDINATED DUMP — ≥2 holders each selling ≥25% of their bag in the same block: a cabal exiting in real time. `coordinated_exit: true`, sold_pct. 4. HONEYPOT / AUTHORITY TRAPS (Solana-native) — live freeze authority, un-revoked mint authority, Token-2022 transfer-fee / transfer-hook / permanent-delegate traps. Answers: CAN you actually sell this token? 5. DEV TRACK RECORD — the creator resolved on-chain plus their full launch history WITH the peak market cap each past token hit, so a dead-count can't hide a pump-and-dump. Covers ANY Solana venue: pump.fun, Raydium, Orca, Meteora, PumpSwap. A launch counts only where the transaction actually CREATED the mint, so re-minting supply of an existing token is never miscounted as a launch. reputation (SERIAL_RUGGER / DEAD_ON_ARRIVAL / MIXED / PROVEN) + best_peak_usd, pump_and_dumps count; paid tier adds launches[] (peak_mcap_usd, now_mcap_usd, drawdown, status per launch). 'Ran to $728k, now dust' = this dev has dumped six figures on holders before. Still CAPPED: peak history is evidence, never softens the score. READ deployer.verdict CAREFULLY — two values mean opposite things: FIRST_LAUNCH = we walked the history and found no earlier tokens. UNKNOWN = the history could NOT be established. That is not evidence of anything and must never be treated as a clean record. 6. FUNDING-CLUSTER TRACE — top holders walked back to a shared funding wallet. A real capability, listed last on purpose: on our own sample it produced no verified detections once infrastructure (curve PDAs, token accounts) was correctly excluded. Treat it as supporting evidence. Returns risk (CLEAN|MEDIUM|HIGH), cabal_score 0–100, top_holder_pct, cluster breakdown with evidence_txs[], holder map, deployer verdict, honeypot_risk, plus wallets_checked / scan_complete / degraded so YOUR agent can apply its own risk tolerance instead of inheriting ours. If we cannot verify something, we say so (`degraded: true`) rather than returning a confident 'clean'. COST: 5 scans/month FREE with no signup and no API key; 250/month free with a key (one email, no card). After that $0.01 USDC per scan. Two ways to pay, no signup or card: (1) a subscription, $9/month for 2,500 scans or $99/month unlimited (fair use 50k) — best for 24/7 bots; or prepaid pay-as-you-go at $0.01/scan (any amount) — POST the tx to /api/buy-key, then send header X-API-Key; or (2) per-call via x402 (X-Payment-Signature header). Full terms: GET /api/info. FRESHNESS: a token traced in the last 8 hours is answered from that trace in <100ms; computed_at (unix
- 2026-10-02 `check_cabal_risk` changed (description)
  - before: Pre-trade safety check for any Solana token mint: is a buyer about to be someone's exit liquidity? Every wallet cluster carries its evidence_txs. AFTER YOU BUY: POST /api/watch {mint, webhook_url} with an X-API-Key (a free key is enough) and we push you an alert the moment a coordinated dump or liquidity drain starts on that token — carrying the same on-chain evidence. This scan is a BUY check; a watch is a HOLD check, and a holder needs the second one continuously. GET/DELETE /api/watch manage your own. Layers, ordered by STRENGTH OF EVIDENCE (not marketing): 1. HOLDER CONCENTRATION — what share one wallet actually controls (`top_holder_pct`). A single wallet that can crater the price is the most basic rug vector, and it needs no coordination at all. IMPORTANT: we count only REAL wallets. LP pools, locked/vesting supply and other program-owned accounts are excluded and labelled, never scored as a whale — and supply comes from getTokenSupply, not an estimate. Tools that skip this report a locked-supply token as '65% one wallet'. Our numbers reconcile with GMGN's circulating top-10. 2. SAME-BLOCK BUNDLES — holders whose token accounts were created in the EXACT same block: a multi-wallet launch bought in one slot. A Jito bundle is one way to do that, not the only one - we read the slot, not the bundle. `time_sync: true`. 3. COORDINATED DUMP — ≥2 holders each selling ≥25% of their bag in the same block: a cabal exiting in real time. `coordinated_exit: true`, sold_pct. 4. HONEYPOT / AUTHORITY TRAPS (Solana-native) — live freeze authority, un-revoked mint authority, Token-2022 transfer-fee / transfer-hook / permanent-delegate traps. Answers: CAN you actually sell this token? 5. DEV TRACK RECORD — the creator resolved on-chain plus their full launch history WITH the peak market cap each past token hit, so a dead-count can't hide a pump-and-dump. Covers ANY Solana venue: pump.fun, Raydium, Orca, Meteora, PumpSwap. A launch counts only where the transaction actually CREATED the mint, so re-minting supply of an existing token is never miscounted as a launch. reputation (SERIAL_RUGGER / DEAD_ON_ARRIVAL / MIXED / PROVEN) + best_peak_usd, pump_and_dumps count; paid tier adds launches[] (peak_mcap_usd, now_mcap_usd, drawdown, status per launch). 'Ran to $728k, now dust' = this dev has dumped six figures on holders before. Still CAPPED: peak history is evidence, never softens the score. READ deployer.verdict CAREFULLY — two values mean opposite things: FIRST_LAUNCH = we walked the history and found no earlier tokens. UNKNOWN = the history could NOT be established. That is not evidence of anything and must never be treated as a clean record. 6. FUNDING-CLUSTER TRACE — top holders walked back to a shared funding wallet. A real capability, listed last on purpose: on our own sample it produced no verified detections once infrastructure (curve PDAs, token accounts) was correctly excluded. Treat it as supporting evidence. Returns risk (CLEAN|MEDIUM|HIGH), cabal_score 0–100, top_holder_pct, cluster breakdown with evidence_txs[], holder map, deployer verdict, honeypot_risk, plus wallets_checked / scan_complete / degraded so YOUR agent can apply its own risk tolerance instead of inheriting ours. If we cannot verify something, we say so (`degraded: true`) rather than returning a confident 'clean'. COST: 5 scans/month FREE with no signup and no API key; 250/month free with a key (one email, no card). After that $0.001 USDC per scan. Two ways to pay, no signup or card: (1) $9/month UNLIMITED (fair use, 50k/mo) — best for 24/7 bots; or prepaid pay-as-you-go at $0.001/scan (any amount) — POST the tx to /api/buy-key, then send header X-API-Key; or (2) per-call via x402 (X-Payment-Signature header). Full terms: GET /api/info. FRESHNESS: a token traced in the last 8 hours is answered from that trace in <100ms; computed_at (unix seconds) says exactly when it was trac
  - after: Pre-trade safety check for any Solana token mint: is a buyer about to be someone's exit liquidity? Every wallet cluster carries its evidence_txs. AFTER YOU BUY: POST /api/watch {mint, webhook_url} with an X-API-Key (a free key is enough) and we push you an alert the moment a coordinated dump or liquidity drain starts on that token — carrying the same on-chain evidence. This scan is a BUY check; a watch is a HOLD check, and a holder needs the second one continuously. GET/DELETE /api/watch manage your own. Layers, ordered by STRENGTH OF EVIDENCE (not marketing): 1. HOLDER CONCENTRATION — what share one wallet actually controls (`top_holder_pct`). A single wallet that can crater the price is the most basic rug vector, and it needs no coordination at all. IMPORTANT: we count only REAL wallets. LP pools, locked/vesting supply and other program-owned accounts are excluded and labelled, never scored as a whale — and supply comes from getTokenSupply, not an estimate. Tools that skip this report a locked-supply token as '65% one wallet'. Our numbers reconcile with GMGN's circulating top-10. 2. SAME-BLOCK BUNDLES — holders whose token accounts were created in the EXACT same block: a multi-wallet launch bought in one slot. A Jito bundle is one way to do that, not the only one - we read the slot, not the bundle. `time_sync: true`. 3. COORDINATED DUMP — ≥2 holders each selling ≥25% of their bag in the same block: a cabal exiting in real time. `coordinated_exit: true`, sold_pct. 4. HONEYPOT / AUTHORITY TRAPS (Solana-native) — live freeze authority, un-revoked mint authority, Token-2022 transfer-fee / transfer-hook / permanent-delegate traps. Answers: CAN you actually sell this token? 5. DEV TRACK RECORD — the creator resolved on-chain plus their full launch history WITH the peak market cap each past token hit, so a dead-count can't hide a pump-and-dump. Covers ANY Solana venue: pump.fun, Raydium, Orca, Meteora, PumpSwap. A launch counts only where the transaction actually CREATED the mint, so re-minting supply of an existing token is never miscounted as a launch. reputation (SERIAL_RUGGER / DEAD_ON_ARRIVAL / MIXED / PROVEN) + best_peak_usd, pump_and_dumps count; paid tier adds launches[] (peak_mcap_usd, now_mcap_usd, drawdown, status per launch). 'Ran to $728k, now dust' = this dev has dumped six figures on holders before. Still CAPPED: peak history is evidence, never softens the score. READ deployer.verdict CAREFULLY — two values mean opposite things: FIRST_LAUNCH = we walked the history and found no earlier tokens. UNKNOWN = the history could NOT be established. That is not evidence of anything and must never be treated as a clean record. 6. FUNDING-CLUSTER TRACE — top holders walked back to a shared funding wallet. A real capability, listed last on purpose: on our own sample it produced no verified detections once infrastructure (curve PDAs, token accounts) was correctly excluded. Treat it as supporting evidence. Returns risk (CLEAN|MEDIUM|HIGH), cabal_score 0–100, top_holder_pct, cluster breakdown with evidence_txs[], holder map, deployer verdict, honeypot_risk, plus wallets_checked / scan_complete / degraded so YOUR agent can apply its own risk tolerance instead of inheriting ours. If we cannot verify something, we say so (`degraded: true`) rather than returning a confident 'clean'. COST: 5 scans/month FREE with no signup and no API key; 250/month free with a key (one email, no card). After that $0.01 USDC per scan. Two ways to pay, no signup or card: (1) a subscription, $9/month for 2,500 scans or $99/month unlimited (fair use 50k) — best for 24/7 bots; or prepaid pay-as-you-go at $0.01/scan (any amount) — POST the tx to /api/buy-key, then send header X-API-Key; or (2) per-call via x402 (X-Payment-Signature header). Full terms: GET /api/info. FRESHNESS: a token traced in the last 8 hours is answered from that trace in <100ms; computed_at (unix

Full history: https://api.protogrid.dev/v1/servers/com.cabal-hunter.api%2Fcabal-hunter/changes

## Remotes

- https://api.cabal-hunter.com/mcp (streamable-http, auth none, reachable true, uptime30d 0.95652175)

## Packages

_none_

## Tools (2)

- `check_cabal_risk`: Pre-trade safety check for any Solana token mint: is a buyer about to be
someone's exit liquidity? Every wallet cluster carries its evidence_txs.

AFTER YOU BUY: POST /api/watch {mint} with an X-API-Key (any key; add
webhook_url on the Pro plan) and we alert you the moment a coordinated dump
or liquidity drain starts on that token — carrying the same on-chain
evidence. This scan is a BUY check; a watch is a HOLD check, and a holder
needs the second one continuously. GET/DELETE /api/watch manage your own.
Paid plans: the watch also follows the token's insiders (dev, first-seconds
buyers) for 7 days and pushes insider_* events when they sell or move
together, each with the transaction.

Layers, ordered by STRENGTH OF EVIDENCE (not marketing):

1. HOLDER CONCENTRATION — what share one wallet actually controls
   (`top_holder_pct`). A single wallet that can crater the price is the
   most basic rug vector, and it needs no coordination at all.
   IMPORTANT: we count only REAL wallets. LP pools, locked/vesting supply
   and other program-owned accounts are excluded and labelled, never scored
   as a whale — and supply comes from getTokenSupply, not an estimate. Tools
   that skip this report a locked-supply token as '65% one wallet'. Our
   numbers reconcile with GMGN's circulating top-10.
2. SAME-BLOCK BUNDLES — holders whose token accounts were created in the
   EXACT same block: a multi-wallet launch bought in one slot. A Jito bundle is
   one way to do that, not the only one - we read the slot, not the bundle.
   `time_sync: true`.
3. COORDINATED DUMP — ≥2 holders each selling ≥25% of their bag in the same
   block: a cabal exiting in real time. `coordinated_exit: true`, sold_pct.
4. HONEYPOT / AUTHORITY TRAPS (Solana-native) — live freeze authority,
   un-revoked mint authority, Token-2022 transfer-fee / transfer-hook /
   permanent-delegate traps. Answers: CAN you actually sell this token?
5. DEV TRACK RECORD — the creator resolved on-chain plus their full launch
   history WITH the peak market cap each past token hit, so a dead-count
   can't hide a pump-and-dump. Covers ANY Solana venue: pump.fun, Raydium,
   Orca, Meteora, PumpSwap. A launch counts only where the transaction
   actually CREATED the mint, so re-minting supply of an existing token is
   never miscounted as a launch. reputation (SERIAL_RUGGER / DEAD_ON_ARRIVAL
   / MIXED / PROVEN) + best_peak_usd, pump_and_dumps count; paid tier adds
   launches[] (peak_mcap_usd, now_mcap_usd, drawdown, status per launch).
   'Ran to $728k, now dust' = this dev has dumped six figures on holders
   before. Still CAPPED: peak history is evidence, never softens the score.
   READ deployer.verdict CAREFULLY — two values mean opposite things:
   FIRST_LAUNCH = we walked the history and found no earlier tokens.
   UNKNOWN = the history could NOT be established. That is not evidence of
   anything and must never be treated as a clean record.
6. FUNDING-CLUSTER TRACE — top holders walked back to a shared funding
   wallet. A real capability, listed last on purpose: on our own sample it
   produced no verified detections once infrastructure (curve PDAs, token
   accounts) was correctly excluded. Treat it as supporting evidence.

Returns risk (CLEAN|MEDIUM|HIGH), cabal_score 0–100, top_holder_pct, cluster
breakdown with evidence_txs[], holder map, deployer verdict, honeypot_risk,
plus wallets_checked / scan_complete / degraded so YOUR agent can apply its
own risk tolerance instead of inheriting ours. If we cannot verify something,
we say so (`degraded: true`) rather than returning a confident 'clean'.

COST: 5 scans/month FREE with no signup and no API key;
250/month free with a key (one email, no card). After that
$0.01 USDC per scan.
Two ways to pay, no signup or card: (1) a subscription, $9/month for 2,500 scans or $99/month unlimited (fair use 50k) —
best for 24/7 bots; or prepaid pay-as-you-go at $0.01/scan (any amount) —
POST the tx to /api/buy-key, then send header X-API-Key;
or (2) per-call via x402 (X-Payment-Signature header). Full terms: GET /api/info.

FRESHNESS: a token traced in the last 8 hours is answered from that trace in <100ms; computed_at (unix seconds) says exactly when it was traced. Any other token runs the full live on-chain trace and takes 15-20s — set your client timeout to at least 30s or you will abandon a scan that was about to succeed.
- `check_wallet_in_token`: Is a SPECIFIC wallet involved in a SPECIFIC Solana token? Use this when a
user names a wallet they are worried about, or when your agent keeps its
own watchlist of addresses and wants to screen a token against one.

Answers from two sources at once:
  1. the traced holders of that token — rank, % of supply, buy slot,
     whether it funded a coordinated cluster, whether it created the token,
     or whether it is the liquidity pool / a labelled exchange wallet
  2. a LIVE on-chain holding lookup, so a wallet too small to appear in the
     trace is still resolved rather than dismissed

HOW TO READ THE RESULT — this matters more than the fields:
  found_in_scan=false is NOT a clean bill of health. The trace covers the
  largest holders, so a smaller position sits outside it, and a wallet that
  sold out and closed its token account leaves nothing to observe. Never
  tell a user a wallet is 'clean' or 'not involved' on this result. The
  `note` field states the limit of what was actually checked; relay it.

  holding.sold_out=true is the strong signal: a token account exists holding
  none of the token, i.e. this wallet HELD it and has since sold out.

  track_record, when present, counts earlier tokens the wallet was early in
  and how many graduated. It is an association measured out-of-sample, NOT a
  profit signal and not a recommendation to copy or avoid anyone. Absence of
  a track record means we hold no record, not that the wallet has no history.

Free, no API key, rate limited per caller. For screening MANY wallets on
every scan automatically, the Screen List add-on stores a private list per
key: POST /api/screen-list/checkout.