On Solana, the token that rugs you looks identical to a real one on price and volume. The difference lives in the wallet graph — who funded the holders, who bought in the same block, what the deployer did last time. That's the data Cabal-Hunter reads, and this is exactly what happens when you scan.
Paste it into the free map, call the REST API, or let your agent call the MCP tool — same engine behind all three. No signup and no key for your first 5 scans each month, then 250 a month with a free key.
Real Helius RPC calls walk the token's holders, their funding history, the launch block and the deployer's past — six detection layers run in parallel. Pre-indexed tokens return in <100ms; a cold scan takes 15–20s.
Everything is fused into a 0–100 Exit-Liquidity Risk score and a plain-language risk level — HIGH RISK, CAUTION or LOW SIGNAL — with every wallet cluster linked to the on-chain transactions that prove it.
Grouped by the question each layer answers. No single layer decides — the fusion does.
A single wallet holding an outsized share is a rug vector even with zero coordination — one seller can take the floor out. Measured as top_holder_pct.
Holders whose token accounts were created in the exact same block — a multi-wallet launch designed to evade funding traces. Flagged as time_sync.
Two or more holders each selling ≥25% of their bag in the same block is a cabal exiting in real time. If it's happening while you scan, you'll see it before you buy.
We resolve the token's creator on-chain (works after graduation too) and pull their launch history — with the peak market cap each past token actually hit. A dead-count hides the part that matters: a dev whose tokens all died at $4k is a nobody, but one who ran a token to $728k then dumped it to dust is a proven pump-and-dumper. We flag those pump-and-dumps and sum it into a reputation: SERIAL_RUGGER · DEAD_ON_ARRIVAL · MIXED · PROVEN. A check we cannot finish is never reported as a clean record: a creator with no earlier tokens reads FIRST_LAUNCH, an incomplete history reads UNKNOWN.
Live freeze authority, un-revoked mint authority, and Token-2022 transfer-fee / transfer-hook traps — the "you can buy but never sell" class of scam.
We walk each top holder's funding lineage back through the chain. Wallets seeded from one shared source are a cabal signature — the classic setup for a coordinated dump. Each cluster returns with its evidence transactions.
Holders funded from an exchange hot wallet aren't a cabal — they're people withdrawing from Binance. We identify shared-exchange funding and exclude it from the score, surfacing it separately so you can verify.
Every wallet cluster carries evidence_txs — the actual transactions behind it. Concentration, deployer history and the honeypot checks are read from chain state and carry none. Your bot (or you) can verify each one on Solscan instead of trusting a black box.
The full response has holder maps and cluster breakdowns — these are the fields most bots gate on.
// GET /api/scan-cabal?mintAddress=<MINT> (or MCP: check_cabal_risk) { "cabal_score": 82, "risk": "HIGH", "recommendation": "AVOID", "time_sync": true, "coordinated_exit": true, "top_holder_pct": 19.4, "deployer": { "verdict": "SERIAL_LAUNCHER" }, "coordinated_clusters": [ { "type": "funding", "combined_pct": 41.2, "evidence_txs": ["..."] } ], "free_queries_remaining": 249 }
Paste any mint and see the clusters — every diamond is a wallet, every line a funding link, every node clickable through to Solscan. Check a token in ten seconds before you ape.
Open the map →Call /api/scan-cabal from any language, gate your buy on risk_level. 250 free scans/month, then $0.01/scan or $99/mo unlimited. Full examples in the docs.
Read the docs →One-click install into Claude, Cursor or VS Code; a published plugin for ElizaOS. Your agent calls check_cabal_risk before every swap — automatically.
Set up MCP →The integrations are open source — read them, fork them, wire them into your stack.