Documentation

Get a verdict in under a minute.

Everything here works with zero signup — your first 5 scans each month are free, no API key needed — and 250 a month with a free key. Pick your path below.

Get a free API key

250 scans a month, free forever. No card, no charge.

Your email is used for your key and service notices. Nothing else.

Why we ask. 98.5% of the addresses that scan here use exactly one scan and never come back — and 1,656 of them share a single identical browser fingerprint, one request each. Limits counted per address cannot see a pattern like that, because every request looks like a different person. One email keeps the free tier genuinely free for people actually using the tool.

For everyone · no code

Check a token from your browser

You don't need to be a developer to use Cabal-Hunter. The diamond map is free and shows you the wallet graph visually.

  1. Copy the token's mint address — the long string from DexScreener, GMGN, pump.fun or your wallet (it looks like Ad3w…pump).
  2. Open cabal-hunter.com/map and paste it into the search box.
  3. Read the map. Each diamond is a wallet (size = holdings). Lines are funding links — connected diamonds were funded by the same source. Red clusters are the cabal. Click any diamond to verify it on Solscan.
Rule of thumb: a healthy token looks like scattered, unconnected diamonds. A rug-in-waiting looks like a spider web — many holders wired to one funding source, often created in the same block.
For bot builders

REST API

One GET request, any language. No auth needed for your 5 free scans a month; a free key raises that to 250.

cURL — try it right now

curl "https://api.cabal-hunter.com/api/scan-cabal?mintAddress=<MINT>"

Python

import requests

r = requests.get(
    "https://api.cabal-hunter.com/api/scan-cabal",
    params={"mintAddress": mint},
    timeout=30,
).json()

if r["recommendation"] == "AVOID" or r["cabal_score"] >= 65:
    abort_buy()

JavaScript / TypeScript

const r = await (await fetch(
  `https://api.cabal-hunter.com/api/scan-cabal?mintAddress=${mint}`
)).json()

if (r.recommendation === "AVOID" || r.cabal_score >= 65) {
  abortBuy()
}

Many tokens at once — /api/scan-batch

Screening a feed? Send up to 25 mints in one request instead of looping. One result row per mint, in the order you sent them. A mint that cannot be analysed returns an error row instead of failing the batch. One scan per mint; needs a key (a free one works).

curl -X POST "https://api.cabal-hunter.com/api/scan-batch" \
  -H "X-API-Key: <YOUR_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"mints":["<MINT>","<MINT>"]}'

Telegram — nothing to install

Paste a mint to @TheCabalHunter_Bot and it answers in the chat with the same verdict, deployer record and holder analysis. /watch <mint> messages you the moment a coordinated dump or liquidity drain starts. t.me/TheCabalHunter_Bot

Useful response headers

HeaderMeaning
X-Free-Queries-RemainingFree scans left this month for your IP — watch this in your bot and top up before it hits zero.
X-Cabal-Risk-LevelHIGH / ELEVATED / LOW_SIGNAL — read it without parsing the body.
X-Cabal-RecommendationSAFE / REVIEW / AVOID — deprecated. Prefer X-Cabal-Risk-Level.
X-Cabal-ScoreThe 0–100 score.
X-Key-Credits-RemainingBalance left on your prepaid key (when sending X-API-Key).
Also free: GET /api/cex-funding?mint= (which exchanges funded the holders), GET /api/trade-analysis?mint= (cohort PnL + wash-trade score), and POST /api/watch (webhook push the moment a coordinated dump starts on a token you hold). Machine-readable spec: openapi.json.
For agent developers

MCP — Claude, Cursor, VS Code

Cabal-Hunter is a hosted MCP server at https://api.cabal-hunter.com/mcp exposing one tool: check_cabal_risk(mintAddress). Your agent calls it before any swap — automatically.

One-click installs

⚡ Install in VS Code ⚡ Install in Cursor

Claude Code (CLI)

claude mcp add --transport http cabal-hunter https://api.cabal-hunter.com/mcp

Claude Desktop claude_desktop_config.json

{
  "mcpServers": {
    "cabal-hunter": {
      "command": "npx",
      "args": ["mcp-remote", "https://api.cabal-hunter.com/mcp"]
    }
  }
}

Then just ask

"Check the cabal risk on Ad3wM19jfM6DGbGaoswz3orJ5WHXWEjBGKpRZ2ggpump before I buy."
System-prompt tip for trading agents: add "Call check_cabal_risk before any Solana buy. Do not buy if risk_level is HIGH or cabal_score ≥ 65." — that one line makes the gate automatic.
For ElizaOS builders

ElizaOS plugin

A published npm plugin adds the CHECK_CABAL_RISK action to any Eliza agent.

npm install elizaos-plugin-cabal-hunter

Register it in your character

import { cabalHunterPlugin } from "elizaos-plugin-cabal-hunter"

export const character = {
  ...
  plugins: [cabalHunterPlugin],
}
For your dashboard

Live badge widget

Two lines of HTML render a live verdict card — score circle, flags, live-map link — for any token, on any site. Works in plain HTML, React, anywhere.

<div class="cabal-hunter-badge" data-mint="YOUR_TOKEN_MINT"></div>
<script src="https://api.cabal-hunter.com/widget.js" defer></script>

Options

AttributeWhat it does
data-mintRequired. The Solana mint to scan and display.
data-refresh="120"Re-scan every N seconds (min 60) — live verdicts while you trade.
data-api-key="ch_live_…"Use your prepaid key once you're past the free tier.
Reference

Response fields

The fields your code will actually use. Full schema: openapi.json.

FieldMeaning
cabal_score0–100. ≥65 = HIGH risk, ≥35 = CAUTION, below = low signal.
risk_levelHIGH / ELEVATED / LOW_SIGNAL — what we observed. LOW_SIGNAL means our checks did not fire; it is not a safety rating.
recommendationSAFE / REVIEW / AVOID — deprecated, kept so existing bots keep working. Prefer risk_level.
riskHIGH / MEDIUM / CLEAN.
verdictPlain-English summary of everything found — human-readable, log it.
time_synctrue = holders bought in the exact same block (bundled launch).
coordinated_exittrue = multiple holders dumping in the same block, right now.
top_holder_pctLargest single non-LP holder's share of supply.
deployer.verdictFIRST_LAUNCH / NORMAL / POOR_TRACK_RECORD / SERIAL_LAUNCHER — plus their launch history.
coordinated_clusters[]Each cluster: type (funding / time_sync / coordinated_exit), combined % of supply, and evidence_txs[] — the proof transactions.
filtered_clusters[]Clusters we excluded as CEX noise (e.g. shared Binance funding) — shown so you can verify we're not hiding anything.
honeypot_riskSolana-native honeypot signals: live freeze authority, Token-2022 traps.
liquidity_usd · market_capLive from DexScreener at scan time.
free_queries_remainingFree scans left this month for your IP.
Pricing & keys

Free for most. $9/mo if your bot never stops.

A token traced in the last 8 hours is answered from that trace (computed_at says when); any other token runs a live on-chain trace. Nothing is ever auto-charged: crypto payments are push-only, so you always stay in control.

Free tier — most people stay here

5 scans a month with no signup at all, then 250 with a free key. One email, no card. The free_queries_remaining field and X-Free-Queries-Remaining header show your balance on every response, and a warning field appears at 20 left.

Beyond free — two options

$9/month Unlimited (fair use, 50k/mo) for 24/7 bots — or pay-as-you-go at $0.001/scan, any amount from $1. Either way it's one USDC payment from any Solana wallet.

Getting a key (60 seconds, no account)

  1. Send USDC on Solana to the wallet shown on /pricing — $9 for Unlimited, or any amount ≥ $1 for pay-as-you-go credits.
  2. Redeem the transaction: paste the tx signature on /pricing, or from code: POST /api/buy-key {"tx_signature": "…"}
  3. Use the returned key as a header on every scan: X-API-Key: ch_live_… — check the balance anytime at GET /api/key-balance.
For autonomous agents: the x402 pay-per-call flow is also supported — the 402 response body contains complete machine-readable payment instructions (recipient, amount, memo), so an agent can pay and retry without a human.
LIVE MONITORING

Watch a token you already hold

A scan answers what is behind a token right now — a question you ask once. A watch answers whether it is still safe to hold, which is a question that never stops being worth asking. We poll the token continuously and POST your webhook the moment a coordinated dump or a liquidity drain begins.

Register a watch

Needs a key so that only you can see or remove your own watches. A free key is enough.

curl -X POST https://api.cabal-hunter.com/api/watch -H "X-API-Key: YOUR_KEY" -H "Content-Type: application/json" -d '{"mint":"<MINT>","webhook_url":"https://your-bot.example.com/hook"}'

Your webhook must resolve to a public address. Loopback, private ranges, link-local and cloud-metadata targets are refused — that field is a common way to attack the server receiving it, and we do not accept it on ours.

Manage them

GET /api/watch lists only your own watches, with used and limit so your client never has to guess its headroom. DELETE /api/watch removes one; omit webhook_url to remove every watch you hold on that mint.

Re-registering the same mint and URL is idempotent and does not consume another slot. If you reach your plan limit the API answers 429 and tells you the limit and how many you are using.

What arrives when it fires

Every claim comes with the transactions that prove it. evidence_txs are Solscan-verifiable signatures, so your bot can confirm the alert on-chain instead of trusting us — the same principle as the scanner.

{ "event": "dump_detected", "mint": "<MINT>", "reason": "price -34% since last check", "drop_pct": 34.2, "price_usd": 0.0000021, "previous_price_usd": 0.0000032, "liquidity_usd": 4200, "previous_liquidity_usd": 9100, "coordinated": true, "coordinated_detail": { "wallet_count": 7, "sold_pct": 41.2, "slot": "slot 298471123", "evidence_txs": ["...", "...", "..."] }, "verify": "https://cabal-hunter.com/map?mint=<MINT>", "action": "consider_immediate_exit" }
A watch reports what we observed on-chain. It is not a prediction, not financial advice and not a guarantee that you can still exit — liquidity may already be gone by the time anyone can act. Always do your own research.
PAID ADD-ON

Your own private wallet list

Keep a list of wallets you care about, and every scan you run also reports which of them are actually in the token — as a screen_list field in the result. $9/month on top of any key, free keys included. Cancel anytime.

Turn it on

Returns a checkout link for the key that made the call. Nothing new is minted — the add-on switches on for the key you already have.

curl -X POST https://api.cabal-hunter.com/api/screen-list/checkout -H "X-API-Key: YOUR_KEY"

Add a wallet

The label is yours alone and is only ever shown back to you. A list holds up to 500 wallets; addresses are validated, so a lookalike string is refused with the reason rather than stored silently.

curl -X POST https://api.cabal-hunter.com/api/screen-list -H "X-API-Key: YOUR_KEY" -H "Content-Type: application/json" -d '{"wallet":"<WALLET>","label":"for my eyes only"}' curl https://api.cabal-hunter.com/api/screen-list -H "X-API-Key: YOUR_KEY" curl -X DELETE https://api.cabal-hunter.com/api/screen-list/<WALLET> -H "X-API-Key: YOUR_KEY"

What comes back

Every scan gains a screen_list object: checked, matches, and hits[] — each hit carrying the wallet, your label, its role (holder or cluster_funder) and its share of supply where known.

"screen_list": { "checked": true, "matches": 1, "hits": [ { "wallet": "<WALLET>", "label": "for my eyes only", "role": "holder", "pct": 4.1 } ] }

checked: true with zero matches means the screen RAN and found none — which is a different fact from no screen at all. Absence of a hit is never a clean bill of health for a wallet you did not list.

Your list is private to your key. We publish no list of wallets and make no claim about who any address belongs to — a hit is an on-chain observation, never a statement about a person.
Troubleshooting

Quick answers

I get HTTP 402

Your IP used its 5 anonymous scans this month. A free key (one email) raises that to 250 a month. The response body lists both ways to keep going ($9 Unlimited or $0.001/scan). Counters reset on the 1st.

The scan takes a few seconds

Cold tokens need a live on-chain trace (15–20s). Already-indexed tokens return in <100ms. Pass pairCreatedAt (DexScreener ms timestamp) to speed up cold scans.

Score says CLEAN but the token rugged

CLEAN means no coordinated cabal — it can't predict a solo dev pulling liquidity with a clean wallet graph. Combine with top_holder_pct, deployer.verdict and liquidity for the full picture — and check the live demo for how it performs on our own bot.

Something else?

Use the feedback box on the homepage — it comes straight to us — or ping @CabalhunterAPI.