# Cabal-Hunter

> On-chain Solana token safety scanner. Tells you if you're the exit liquidity BEFORE you buy: it traces coordinated wallet funding, same-block bundle buys, serial-launcher deployers and same-block coordinated dumps, and returns one Exit-Liquidity Risk verdict: cabal_score 0-100, with risk (CLEAN | MEDIUM | HIGH) and recommendation (SAFE | REVIEW | AVOID). Bands: 0-34.9 CLEAN, 35-64.9 MEDIUM/CAUTION, 65-100 HIGH/AVOID.

Cabal-Hunter is built for both humans (an interactive 3D holder map) and AI trading agents (an MCP server + REST API). It works on any Solana mint — pre-graduation on the pump.fun bonding curve or after, on PumpSwap/Raydium.

## What it detects
Ordered by strength of evidence — the first checks are the ones we can stand behind.
- Holder concentration (strongest signal): the share held by the single biggest REAL wallet. Locked/vesting supply and the LP pool are identified and EXCLUDED, so a liquidity pool is never reported as a whale — our top-10 reconciles with GMGN's circulating figures and RugCheck.
- Same-block bundle detection: wallets that bought in the same slot (stealth launches). Detection is slot-based — a Jito bundle is one way to achieve it, not the only one.
- Coordinated dump detection: multiple holders selling a meaningful chunk in the exact same block — wallets exiting together at the time of the scan.
- Dev track record: the creator wallet's launch history (as far back as the walk reaches) WITH the peak market cap each past token hit — so a dead-count can't hide a pump-and-dump. Covers any Solana venue: pump.fun, Raydium, Orca, Meteora, PumpSwap. A launch counts only where the transaction actually created the mint, so minting more supply of an existing token is never miscounted as a launch. Reputation (SERIAL_LAUNCHER / DEAD_ON_ARRIVAL / MIXED / PROVEN) plus per-launch peak → now (e.g. "ran to $728k, now dust" = the dev has dumped six figures on holders before).
- deployer.verdict FIRST_LAUNCH and UNKNOWN are opposite answers and must not be treated alike: FIRST_LAUNCH means the creator's history was walked and no earlier tokens were found; UNKNOWN means the history could not be established at all. UNKNOWN is an absence of evidence, never a clean record.
- CEX-noise filter: holders funded from a shared exchange are excluded so you don't get false positives.
- Honeypot check (Solana-native): live freeze authority, Token-2022 transfer-fee / transfer-hook / permanent-delegate traps, mint authority — CAN you actually sell?
- Funding-cluster trace: top holders walked back to shared funding wallets, each with on-chain evidence transactions. Listed last deliberately — it is our weakest layer and has produced no verified true positives on our own sample, so treat it as supporting evidence, not a verdict.
- Live dump watch (for tokens you already hold): register a webhook with POST /api/watch and we poll the token continuously, pushing an alert the moment a coordinated dump or a liquidity drain starts — with the wallet count, the share of supply sold in one slot, and Solscan-verifiable evidence transactions. A scan answers whether a token is safe to BUY; a watch answers whether it is still safe to HOLD.
- Insider alerts (Paid plans): the watch also follows the token's insiders (dev, first-seconds buyers) for 7 days and pushes insider_* events when they sell or move together, each with the transaction.
- Exit-Liquidity Risk: the headline verdict synthesising all of the above.
- Honest about uncertainty: when a check cannot be verified the response is marked degraded rather than returning a confident "clean".

## Wallet lookup
Paste any Solana wallet at https://cabal-hunter.com/wallet (or into the Telegram bot) and get everything the chain proves about it, each line linked to its transaction:
- First funding: the very first SOL that reached the wallet, with the exchange named when it came from one. An exchange withdrawal is shown as the exchange; the chain does not show which customer asked for it.
- Tokens it created: counted only where the creation transaction names this wallet as the creator.
- Launches it bought in the first seconds, with its share of supply and the buy transaction.
- Repeat groups: wallets that keep buying the first seconds of the same launches, with how those launches ended beside the all-launch baseline.
- SOL in and SOL out per launch (only fully balanced records), and its biggest SOL counterparties, with exchange labels.
- Connected creators on every dev check: when a dev wallet was funded by a private wallet, how many other token creators that funder also funded.
- An avoid list: star a wallet once and it is flagged in every token you scan (creator, the dev's funder, first-seconds buyers, top holders).
Facts only: it states what the chain recorded and never who is behind a wallet. Wallet lookups a month: free key 10, $9 plan 100, Pro 2,000.

## Help assistant
- Every page of the site carries an in-app help assistant (9 languages) that explains each panel — what the number means and what to watch for — with screenshots. Ask it about pricing, chains, API/MCP setup or any detection layer.

## For AI agents (MCP)
- MCP endpoint: https://api.cabal-hunter.com/mcp
- Tool: check_cabal_risk(mintAddress) — call it before any Solana swap; abort if recommendation is AVOID or cabal_score >= 65, or if is_controlled is true.
- Watch: POST /api/watch with {mint} and an X-API-Key (any key) to be emailed when a token you hold starts dumping; add webhook_url (Pro plan) to be pushed a webhook instead. GET and DELETE on the same path list and remove your own. The webhook must resolve to a public address.
- Works with Claude (Claude Code / Desktop), Cursor, and ElizaOS (x402 auto-payment).

## REST API
- POST https://api.cabal-hunter.com/api/scan-cabal {"mintAddress":"..."} — full analysis.
- POST https://api.cabal-hunter.com/api/scan-batch {"mints":["...","..."]} with an X-API-Key on the Pro plan — screen a whole feed of launches in one call, up to 25 mints, one result row per mint in the order sent. A mint that cannot be analysed returns an error row instead of failing the batch.
- Screen List (paid add-on): keep your own private list of wallets, and every scan you run also reports which of them are actually in the token — the result carries a screen_list field with the matches. Manage it with GET/POST/DELETE https://api.cabal-hunter.com/api/screen-list (X-API-Key), enable it with POST /api/screen-list/checkout. Lists are private to your key and we publish nothing.
- GET https://api.cabal-hunter.com/api/wallet-check?mint=<MINT>&wallet=<WALLET> — is a specific wallet in a specific token? Answers from the traced holders (rank, % of supply, buy slot, cluster funder, deployer) plus a live on-chain holding lookup, so a wallet outside the traced set is still resolved: holding now, or held it and sold out. Also returns any launch track record we hold. No key required. A "not found" is explicitly NOT a clean bill of health and the response says so.
- GET https://api.cabal-hunter.com/map?mint=... — free interactive 3D holder map.
- GET https://api.cabal-hunter.com/api/info — pricing, endpoints, response schema.
- OpenAPI spec: https://api.cabal-hunter.com/openapi.json — machine-readable contract for agents & codegen.

## Pricing
- Free: 5 scans/month per IP with no account at all; 250 scans/month with a free key (one email, no card).
- Screen List add-on: $9/month on top of any key — your own private wallet list, screened on every scan. Cancel anytime.
  The email step exists because 98.5% of addresses scan exactly once and never return, and
  1,656 of them share one identical browser fingerprint at a single request each; limits
  counted per address cannot see that.
  Anonymous requests must send a User-Agent header; any value is accepted.
- Then $0.01 USDC per scan, or a subscription: $9/month for 2,500 scans or $99/month unlimited (fair use 50k).
- Three ways to pay, same price through every door: card (Stripe Checkout), USDC on Solana, or x402 for agents that sign per call.
- By card each plan is a real subscription: it renews automatically and can be cancelled anytime at https://cabal-hunter.com/billing, and cancelling keeps access to the end of the period already paid for. Paid in USDC it cannot auto-renew — nothing can debit a wallet — so you send the next $9 when you choose.

## How the verdict is produced
- Published thresholds and the exact formula: https://cabal-hunter.com/methodology
  Bands: 0-34.9 CLEAN, 35-64.9 CAUTION, 65-100 AVOID. is_controlled is true at 35+.
  The score is the HIGHER of two paths, not a sum: coordination + deployer track
  record, or single-holder concentration on its own.
  Deployer term contributes nothing below 40% of past launches dead, and is damped
  until at least 10 launches have been sampled. Concentration contributes nothing
  below a 12% single non-pool holder, then 2.2 points per point above it.
- A partial trace is marked degraded and can never harden a verdict into the
  AVOID band. Treat degraded:true as incomplete, never as clean.
- Verdicts are automated assessments, not statements of fact. Anyone can contest
  one, free and without an account: https://cabal-hunter.com/contest
- Terms https://cabal-hunter.com/terms · Privacy https://cabal-hunter.com/privacy · Refunds https://cabal-hunter.com/refunds

## Telegram bot
Paste any Solana mint into https://t.me/TheCabalHunter_Bot and the same scan comes back in the chat: live market figures, contract checks (mint and freeze authority, sell route, Token-2022 traps), holder spread, the dev wallet's launches, and buttons for the full holder map, a watch alert, a fresh rescan and sharing. Paste a wallet instead and the bot returns its case file (first funder, tokens created, repeat group, SOL in and out, biggest money contact); /avoid manages your avoid list. 5 free scans a month per chat; send the bot your email for 250 a month or to link an existing plan.

## Links
- Site: https://cabal-hunter.com/
- Telegram bot (scan a mint in the chat): https://t.me/TheCabalHunter_Bot
- X/Twitter: https://x.com/CabalhunterAPI
- Telegram (free live cabal alerts): https://t.me/CabalHunterAlerts
- GitHub template: https://github.com/paulf280-ui/solana-safe-sniper-mcp-template