On Solana, the token that rugs you looks identical to a real one on price and volume. The difference lives in the wallet graph — who funded the holders, who bought in the same block, what the deployer did last time. That's the data Cabal-Hunter reads, and this is exactly what happens when you scan.
Paste it into the free map, call the REST API, or let your agent call the MCP tool — same engine behind all three. No signup and no key for your first 5 scans each month, then 250 a month with a free key.
Real Helius RPC calls walk the token's holders, their funding history, the launch block and the deployer's past — six detection layers run in parallel. Pre-indexed tokens return in <100ms; a cold scan takes 15–20s.
Everything is fused into a 0–100 Exit-Liquidity Risk score and a plain-language risk level — HIGH RISK, CAUTION or LOW SIGNAL — with every flag linked to the on-chain transaction that proves it.
Grouped by the question each layer answers. No single layer decides — the fusion does.
A single wallet holding an outsized share is a rug vector even with zero coordination — one seller can take the floor out. Measured as top_holder_pct.
Holders whose token accounts were created in the exact same block bought via a Jito bundle — a multi-wallet launch designed to evade funding traces. Flagged as time_sync.
Two or more holders each selling ≥25% of their bag in the same block is a cabal exiting in real time. If it's happening while you scan, you'll see it before you buy.
We resolve the token's creator on-chain (works after graduation too) and pull their full launch history — with the peak market cap each past token actually hit. A dead-count hides the part that matters: a dev whose tokens all died at $4k is a nobody, but one who ran a token to $728k then dumped it to dust is a proven pump-and-dumper. We flag those pump-and-dumps and sum it into a reputation: SERIAL_RUGGER · DEAD_ON_ARRIVAL · MIXED · PROVEN. A check we cannot finish is never reported as a clean record: a creator with no earlier tokens reads FIRST_LAUNCH, an incomplete history reads UNKNOWN.
Live freeze authority, un-revoked mint authority, and Token-2022 transfer-fee / transfer-hook traps — the "you can buy but never sell" class of scam.
We walk each top holder's funding lineage back through the chain. Wallets seeded from one shared source are a cabal signature — the classic setup for a coordinated dump. Each cluster returns with its evidence transactions.
Holders funded from an exchange hot wallet aren't a cabal — they're people withdrawing from Binance. We identify shared-exchange funding and exclude it from the score, surfacing it separately so you can verify.
Every flag carries evidence_txs — the actual transactions behind the claim. Your bot (or you) can verify each one on Solscan instead of trusting a black box.
The full response has holder maps and cluster breakdowns — these are the fields most bots gate on.
// GET /api/scan-cabal?mintAddress=<MINT> (or MCP: check_cabal_risk) { "cabal_score": 82, "risk": "HIGH", "recommendation": "AVOID", "time_sync": true, "coordinated_exit": true, "top_holder_pct": 19.4, "deployer": { "verdict": "SERIAL_LAUNCHER" }, "coordinated_clusters": [ { "type": "funding", "combined_pct": 41.2, "evidence_txs": ["..."] } ], "free_queries_remaining": 249 }
Paste any mint and see the clusters — every diamond is a wallet, every line a funding link, every node clickable through to Solscan. Check a token in ten seconds before you ape.
Open the map →Call /api/scan-cabal from any language, gate your buy on risk_level. 250 free scans/month, then $0.001/scan or $9/mo unlimited. Full examples in the docs.
Read the docs →One-click install into Claude, Cursor or VS Code; a published plugin for ElizaOS. Your agent calls check_cabal_risk before every swap — automatically.
Set up MCP →The integrations are open source — read them, fork them, wire them into your stack.