# Cabal-Hunter

> On-chain Solana token safety scanner. Tells you if you're the exit liquidity BEFORE you buy: it traces coordinated wallet funding, same-block bundle buys, serial-launcher deployers and same-block coordinated dumps, and returns one Exit-Liquidity Risk verdict: cabal_score 0-100, with risk (CLEAN | MEDIUM | HIGH) and recommendation (SAFE | REVIEW | AVOID). Bands: 0-34.9 CLEAN, 35-64.9 MEDIUM/CAUTION, 65-100 HIGH/AVOID.

Cabal-Hunter is built for both humans (an interactive 3D holder map) and AI trading agents (an MCP server + REST API). It works on any Solana mint — pre-graduation on the pump.fun bonding curve or after, on PumpSwap/Raydium.

## What it detects
Ordered by strength of evidence — the first checks are the ones we can stand behind.
- Holder concentration (strongest signal): the share held by the single biggest REAL wallet. Locked/vesting supply and the LP pool are identified and EXCLUDED, so a liquidity pool is never reported as a whale — our top-10 reconciles with GMGN's circulating figures and RugCheck.
- Same-block bundle detection: wallets that bought in the same slot (stealth launches). Detection is slot-based — a Jito bundle is one way to achieve it, not the only one.
- Coordinated dump detection: multiple holders selling a meaningful chunk in the exact same block — wallets exiting together at the time of the scan.
- Dev track record: the creator wallet's launch history (as far back as the walk reaches) WITH the peak market cap each past token hit — so a dead-count can't hide a pump-and-dump. Covers any Solana venue: pump.fun, Raydium, Orca, Meteora, PumpSwap. A launch counts only where the transaction actually created the mint, so minting more supply of an existing token is never miscounted as a launch. Reputation (SERIAL_LAUNCHER / DEAD_ON_ARRIVAL / MIXED / PROVEN) plus per-launch peak → now (e.g. "ran to $728k, now dust" = the dev has dumped six figures on holders before).
- deployer.verdict FIRST_LAUNCH and UNKNOWN are opposite answers and must not be treated alike: FIRST_LAUNCH means the creator's history was walked and no earlier tokens were found; UNKNOWN means the history could not be established at all. UNKNOWN is an absence of evidence, never a clean record.
- CEX-noise filter: holders funded from a shared exchange are excluded so you don't get false positives.
- Honeypot check (Solana-native): live freeze authority, Token-2022 transfer-fee / transfer-hook / permanent-delegate traps, mint authority — CAN you actually sell?
- Funding-cluster trace: top holders walked back to shared funding wallets, each with on-chain evidence transactions. Listed last deliberately — it is our weakest layer and has produced no verified true positives on our own sample, so treat it as supporting evidence, not a verdict.
- Live dump watch (for tokens you already hold): register a webhook with POST /api/watch and we poll the token continuously, pushing an alert the moment a coordinated dump or a liquidity drain starts — with the wallet count, the share of supply sold in one slot, and Solscan-verifiable evidence transactions. A scan answers whether a token is safe to BUY; a watch answers whether it is still safe to HOLD.
- Exit-Liquidity Risk: the headline verdict synthesising all of the above.
- Honest about uncertainty: when a check cannot be verified the response is marked degraded rather than returning a confident "clean".

## Help assistant
- Every page of the site carries an in-app help assistant (9 languages) that explains each panel — what the number means and what to watch for — with screenshots. Ask it about pricing, chains, API/MCP setup or any detection layer.

## For AI agents (MCP)
- MCP endpoint: https://api.cabal-hunter.com/mcp
- Tool: check_cabal_risk(mintAddress) — call it before any Solana swap; abort if recommendation is AVOID or cabal_score >= 65, or if is_controlled is true.
- Watch: POST /api/watch with {mint, webhook_url} and an X-API-Key (a free key works) to be pushed a webhook when a token you hold starts dumping. GET and DELETE on the same path list and remove your own. The webhook must resolve to a public address.
- Works with Claude (Claude Code / Desktop), Cursor, and ElizaOS (x402 auto-payment).

## REST API
- POST https://api.cabal-hunter.com/api/scan-cabal {"mintAddress":"..."} — full analysis.
- POST https://api.cabal-hunter.com/api/scan-batch {"mints":["...","..."]} with an X-API-Key (a free key works) — screen a whole feed of launches in one call, up to 25 mints, one result row per mint in the order sent. A mint that cannot be analysed returns an error row instead of failing the batch.
- Screen List (paid add-on): keep your own private list of wallets, and every scan you run also reports which of them are actually in the token — the result carries a screen_list field with the matches. Manage it with GET/POST/DELETE https://api.cabal-hunter.com/api/screen-list (X-API-Key), enable it with POST /api/screen-list/checkout. Lists are private to your key and we publish nothing.
- GET https://api.cabal-hunter.com/api/wallet-check?mint=<MINT>&wallet=<WALLET> — is a specific wallet in a specific token? Answers from the traced holders (rank, % of supply, buy slot, cluster funder, deployer) plus a live on-chain holding lookup, so a wallet outside the traced set is still resolved: holding now, or held it and sold out. Also returns any launch track record we hold. No key required. A "not found" is explicitly NOT a clean bill of health and the response says so.
- GET https://api.cabal-hunter.com/map?mint=... — free interactive 3D holder map.
- GET https://api.cabal-hunter.com/api/info — pricing, endpoints, response schema.
- OpenAPI spec: https://api.cabal-hunter.com/openapi.json — machine-readable contract for agents & codegen.

## Pricing
- Free: 5 scans/month per IP with no account at all; 250 scans/month with a free key (one email, no card).
- Screen List add-on: $9/month on top of any key — your own private wallet list, screened on every scan. Cancel anytime.
  The email step exists because 98.5% of addresses scan exactly once and never return, and
  1,656 of them share one identical browser fingerprint at a single request each; limits
  counted per address cannot see that.
  Anonymous requests must send a User-Agent header; any value is accepted.
- Then $0.001 USDC per scan — priced at infra cost (covers the Helius RPC/websocket calls of the live on-chain trace).
- Three ways to pay, same price through every door: card (Stripe Checkout), USDC on Solana, or x402 for agents that sign per call.
- $9/month buys unlimited fair-use scans (50,000/mo). By card this is a real subscription: it renews automatically and can be cancelled anytime at https://cabal-hunter.com/billing, and cancelling keeps access to the end of the period already paid for. Paid in USDC it cannot auto-renew — nothing can debit a wallet — so you send the next $9 when you choose.

## How the verdict is produced
- Published thresholds and the exact formula: https://cabal-hunter.com/methodology
  Bands: 0-34.9 CLEAN, 35-64.9 CAUTION, 65-100 AVOID. is_controlled is true at 35+.
  The score is the HIGHER of two paths, not a sum: coordination + deployer track
  record, or single-holder concentration on its own.
  Deployer term contributes nothing below 40% of past launches dead, and is damped
  until at least 10 launches have been sampled. Concentration contributes nothing
  below a 12% single non-pool holder, then 2.2 points per point above it.
- A partial trace is marked degraded and can never harden a verdict into the
  AVOID band. Treat degraded:true as incomplete, never as clean.
- Verdicts are automated assessments, not statements of fact. Anyone can contest
  one, free and without an account: https://cabal-hunter.com/contest
- Terms https://cabal-hunter.com/terms · Privacy https://cabal-hunter.com/privacy · Refunds https://cabal-hunter.com/refunds

## Telegram bot
Paste any Solana mint into https://t.me/TheCabalHunter_Bot and the same scan comes back in the chat: live market figures, contract checks (mint and freeze authority, sell route, Token-2022 traps), holder spread, the dev wallet's launches, and buttons for the full holder map, a watch alert, a fresh rescan and sharing. 5 free scans a month per chat; send the bot your email for 250 a month or to link an existing plan.

## Links
- Site: https://cabal-hunter.com/
- Telegram bot (scan a mint in the chat): https://t.me/TheCabalHunter_Bot
- X/Twitter: https://x.com/CabalhunterAPI
- Telegram (free live cabal alerts): https://t.me/CabalHunterAlerts
- GitHub template: https://github.com/paulf280-ui/solana-safe-sniper-mcp-template