Everything here works with zero signup — your first 5 scans each month are free, no API key needed — and 250 a month with a free key. Pick your path below.
250 scans a month, free forever. No card, no charge.
Your email is used for your key and service notices. Nothing else.
Why we ask. 98.5% of the addresses that scan here use exactly one scan and never come back — and 1,656 of them share a single identical browser fingerprint, one request each. Limits counted per address cannot see a pattern like that, because every request looks like a different person. One email keeps the free tier genuinely free for people actually using the tool.
You don't need to be a developer to use Cabal-Hunter. The diamond map is free and shows you the wallet graph visually.
One GET request, any language. No auth needed for your 5 free scans a month; a free key raises that to 250.
curl "https://api.cabal-hunter.com/api/scan-cabal?mintAddress=<MINT>"
import requests r = requests.get( "https://api.cabal-hunter.com/api/scan-cabal", params={"mintAddress": mint}, timeout=30, ).json() if r["recommendation"] == "AVOID" or r["cabal_score"] >= 65: abort_buy()
const r = await (await fetch( `https://api.cabal-hunter.com/api/scan-cabal?mintAddress=${mint}` )).json() if (r.recommendation === "AVOID" || r.cabal_score >= 65) { abortBuy() }
Screening a feed? Send up to 25 mints in one request instead of looping. One result row per mint, in the order you sent them. A mint that cannot be analysed returns an error row instead of failing the batch. One scan per mint; needs a key (a free one works).
curl -X POST "https://api.cabal-hunter.com/api/scan-batch" \ -H "X-API-Key: <YOUR_KEY>" \ -H "Content-Type: application/json" \ -d '{"mints":["<MINT>","<MINT>"]}'
Paste a mint to @TheCabalHunter_Bot and it answers in the chat with the same verdict, deployer record and holder analysis. /watch <mint> messages you the moment a coordinated dump or liquidity drain starts. t.me/TheCabalHunter_Bot
| Header | Meaning |
|---|---|
| X-Free-Queries-Remaining | Free scans left this month for your IP — watch this in your bot and top up before it hits zero. |
| X-Cabal-Risk-Level | HIGH / ELEVATED / LOW_SIGNAL — read it without parsing the body. |
| X-Cabal-Recommendation | SAFE / REVIEW / AVOID — deprecated. Prefer X-Cabal-Risk-Level. |
| X-Cabal-Score | The 0–100 score. |
| X-Key-Credits-Remaining | Balance left on your prepaid key (when sending X-API-Key). |
Cabal-Hunter is a hosted MCP server at https://api.cabal-hunter.com/mcp exposing one tool: check_cabal_risk(mintAddress). Your agent calls it before any swap — automatically.
claude mcp add --transport http cabal-hunter https://api.cabal-hunter.com/mcp
{
"mcpServers": {
"cabal-hunter": {
"command": "npx",
"args": ["mcp-remote", "https://api.cabal-hunter.com/mcp"]
}
}
}
"Check the cabal risk on Ad3wM19jfM6DGbGaoswz3orJ5WHXWEjBGKpRZ2ggpump before I buy."
A published npm plugin adds the CHECK_CABAL_RISK action to any Eliza agent.
npm install elizaos-plugin-cabal-hunter
import { cabalHunterPlugin } from "elizaos-plugin-cabal-hunter" export const character = { ... plugins: [cabalHunterPlugin], }
Two lines of HTML render a live verdict card — score circle, flags, live-map link — for any token, on any site. Works in plain HTML, React, anywhere.
<div class="cabal-hunter-badge" data-mint="YOUR_TOKEN_MINT"></div> <script src="https://api.cabal-hunter.com/widget.js" defer></script>
| Attribute | What it does |
|---|---|
| data-mint | Required. The Solana mint to scan and display. |
| data-refresh="120" | Re-scan every N seconds (min 60) — live verdicts while you trade. |
| data-api-key="ch_live_…" | Use your prepaid key once you're past the free tier. |
| Field | Meaning |
|---|---|
| cabal_score | 0–100. ≥65 = HIGH risk, ≥35 = CAUTION, below = low signal. |
| risk_level | HIGH / ELEVATED / LOW_SIGNAL — what we observed. LOW_SIGNAL means our checks did not fire; it is not a safety rating. |
| recommendation | SAFE / REVIEW / AVOID — deprecated, kept so existing bots keep working. Prefer risk_level. |
| risk | HIGH / MEDIUM / CLEAN. |
| verdict | Plain-English summary of everything found — human-readable, log it. |
| time_sync | true = holders bought in the exact same block (bundled launch). |
| coordinated_exit | true = multiple holders dumping in the same block, right now. |
| top_holder_pct | Largest single non-LP holder's share of supply. |
| deployer.verdict | FIRST_LAUNCH / NORMAL / POOR_TRACK_RECORD / SERIAL_LAUNCHER — plus their launch history. |
| coordinated_clusters[] | Each cluster: type (funding / time_sync / coordinated_exit), combined % of supply, and evidence_txs[] — the proof transactions. |
| filtered_clusters[] | Clusters we excluded as CEX noise (e.g. shared Binance funding) — shown so you can verify we're not hiding anything. |
| honeypot_risk | Solana-native honeypot signals: live freeze authority, Token-2022 traps. |
| liquidity_usd · market_cap | Live from DexScreener at scan time. |
| free_queries_remaining | Free scans left this month for your IP. |
A token traced in the last 8 hours is answered from that trace (computed_at says when); any other token runs a live on-chain trace. Nothing is ever auto-charged: crypto payments are push-only, so you always stay in control.
5 scans a month with no signup at all, then 250 with a free key. One email, no card. The free_queries_remaining field and X-Free-Queries-Remaining header show your balance on every response, and a warning field appears at 20 left.
$9/month Unlimited (fair use, 50k/mo) for 24/7 bots — or pay-as-you-go at $0.001/scan, any amount from $1. Either way it's one USDC payment from any Solana wallet.
A scan answers what is behind a token right now — a question you ask once. A watch answers whether it is still safe to hold, which is a question that never stops being worth asking. We poll the token continuously and POST your webhook the moment a coordinated dump or a liquidity drain begins.
Needs a key so that only you can see or remove your own watches. A free key is enough.
curl -X POST https://api.cabal-hunter.com/api/watch -H "X-API-Key: YOUR_KEY" -H "Content-Type: application/json" -d '{"mint":"<MINT>","webhook_url":"https://your-bot.example.com/hook"}'Your webhook must resolve to a public address. Loopback, private ranges, link-local and cloud-metadata targets are refused — that field is a common way to attack the server receiving it, and we do not accept it on ours.
GET /api/watch lists only your own watches, with used and
limit so your client never has to guess its headroom.
DELETE /api/watch removes one; omit webhook_url to remove
every watch you hold on that mint.
Re-registering the same mint and URL is idempotent and does not consume another slot. If you reach your plan limit the API answers 429 and tells you the limit and how many you are using.
Every claim comes with the transactions that prove it. evidence_txs are
Solscan-verifiable signatures, so your bot can confirm the alert on-chain instead of
trusting us — the same principle as the scanner.
{
"event": "dump_detected",
"mint": "<MINT>",
"reason": "price -34% since last check",
"drop_pct": 34.2,
"price_usd": 0.0000021, "previous_price_usd": 0.0000032,
"liquidity_usd": 4200, "previous_liquidity_usd": 9100,
"coordinated": true,
"coordinated_detail": {
"wallet_count": 7, "sold_pct": 41.2, "slot": "slot 298471123",
"evidence_txs": ["...", "...", "..."]
},
"verify": "https://cabal-hunter.com/map?mint=<MINT>",
"action": "consider_immediate_exit"
}Keep a list of wallets you care about, and every scan you run also reports which of them are actually in the token — as a screen_list field in the result. $9/month on top of any key, free keys included. Cancel anytime.
Returns a checkout link for the key that made the call. Nothing new is minted — the add-on switches on for the key you already have.
curl -X POST https://api.cabal-hunter.com/api/screen-list/checkout -H "X-API-Key: YOUR_KEY"The label is yours alone and is only ever shown back to you. A list holds up to 500 wallets; addresses are validated, so a lookalike string is refused with the reason rather than stored silently.
curl -X POST https://api.cabal-hunter.com/api/screen-list -H "X-API-Key: YOUR_KEY" -H "Content-Type: application/json" -d '{"wallet":"<WALLET>","label":"for my eyes only"}'
curl https://api.cabal-hunter.com/api/screen-list -H "X-API-Key: YOUR_KEY"
curl -X DELETE https://api.cabal-hunter.com/api/screen-list/<WALLET> -H "X-API-Key: YOUR_KEY"Every scan gains a screen_list object: checked, matches, and hits[] — each hit carrying the wallet, your label, its role (holder or cluster_funder) and its share of supply where known.
"screen_list": {
"checked": true,
"matches": 1,
"hits": [
{ "wallet": "<WALLET>", "label": "for my eyes only",
"role": "holder", "pct": 4.1 }
]
}checked: true with zero matches means the screen RAN and found none — which is a different fact from no screen at all. Absence of a hit is never a clean bill of health for a wallet you did not list.
Your IP used its 5 anonymous scans this month. A free key (one email) raises that to 250 a month. The response body lists both ways to keep going ($9 Unlimited or $0.001/scan). Counters reset on the 1st.
Cold tokens need a live on-chain trace (15–20s). Already-indexed tokens return in <100ms. Pass pairCreatedAt (DexScreener ms timestamp) to speed up cold scans.
CLEAN means no coordinated cabal — it can't predict a solo dev pulling liquidity with a clean wallet graph. Combine with top_holder_pct, deployer.verdict and liquidity for the full picture — and check the live demo for how it performs on our own bot.
Use the feedback box on the homepage — it comes straight to us — or ping @CabalhunterAPI.