Cabal Hunter

On-chain Solana cabal & rug detection as an MCP server. One tool — check_cabal_risk — scans any Solana token mint before your agent buys and returns an Exit-Liquidity Risk verdict (SAFE | REVIEW | AVOID), a 0–100 cabal score, funding-cluster detection, same-block Jito-bundle detection, coordinated-dump detection, serial-launcher deployer history ("launched 14, 13 dead"), and a Solana-native honeypot check (freeze authority + Token-2022 traps). Every flag links to its on-chain evidence transaction.

npm MCP server Solana Free tier License: MIT

🌐 Available in 9 languages: English · Español · Português · Français · Deutsch · Nederlands · 中文 · 日本語 · 한국어

Contract-clean is not cabal-clean. A basic scanner tells you the mint/freeze/LP are fine — it doesn't tell you that 15 wallets funded from one source are holding 30% of supply, waiting to dump on you.

Credit where it's due: RugCheck also does same-source wallet clustering (their "Insider Networks"), and it's a good tool — if it does what you need, genuinely, use it. What this gives you is one fused exit-liquidity verdict in a single call, at $9/month with no account.

Quick start

npx cabal-hunter-mcp

No install, no signup, no API key — 250 free scans/month per IP. That's the whole setup; the command below is what you drop into any MCP client.

Claude Desktop / Claude Code / Cursor / VS Code / ElizaOS

{
  "mcpServers": {
    "cabal-hunter": {
      "command": "npx",
      "args": ["-y", "cabal-hunter-mcp"]
    }
  }
}

Prefer a remote HTTP server (no local process)? Point straight at the hosted endpoint instead:

{ "mcpServers": { "cabal-hunter": { "url": "https://api.cabal-hunter.com/mcp" } } }

The tool

check_cabal_risk({ mint }) — pass a Solana token mint (contract) address. Returns the full forensic JSON:

{
  "recommendation": "AVOID",        // SAFE | REVIEW | AVOID  ← the headline
  "risk": "HIGH",                   // exit-liquidity risk
  "cabal_score": 100,               // 0-100
  "honeypot_risk": "LOW",           // freeze authority + Token-2022 traps
  "mint_authority_revoked": true,
  "freeze_authority_revoked": true,
  "deployer": { "verdict": "SERIAL_LAUNCHER", "tokens_launched": 14, "dead": 13 },
  "coordinated_clusters": [
    { "wallets": 5, "combined_pct": 23.1, "evidence_tx": "https://solscan.io/tx/…" }
  ],
  "time_sync": true,                // same-block (Jito-bundled) buys
  "coordinated_exit": false,        // ≥2 holders dumped together
  "top_reasons": ["..."],
  "wallets_checked": 15,
  "scan_complete": true
}

scan_complete / wallets_checked are included on purpose so your agent can apply its own risk tolerance instead of inheriting ours — the score is a starting point you can verify (every cluster carries an evidence_tx), not a verdict you take on faith.

Gate a buy in your agent

"Before buying any token, call check_cabal_risk with the mint. If recommendation is AVOID or cabal_score >= 65 or honeypot_risk is HIGH, skip the trade and say why."

A note on the withdrawn trace_funding tool

An earlier version of this README documented a second tool, trace_funding, that traced a token's first buyers back to their funding source.

It has been withdrawn. On measuring it properly we found that its headline detections were an artifact: the "shared funder" it reported was frequently the token's own pump.fun bonding curve. Every seller receives SOL back from the curve, so ordinary buying and selling was being reported as a coordinated cluster. After fixing that, the detector produced zero genuine detections across 24 tokens, and on live freshly-graduated tokens it could not complete the trace at all.

We would rather withdraw a feature than ship a detector that has never demonstrably detected anything. It may return if the approach can be made to work and its detection rate can be shown; until then it is not advertised and not billed.

Pricing

• 250 scans/month per IP — free, no key.
• After that: $9/month for Unlimited (fair use), or pay-as-you-go at $0.001 USDC per scan (priced at cost). No signup, no card.
• Prepaid key: send USDC, POST /api/buy-key, then set CABAL_HUNTER_API_KEY (sent as the X-API-Key header). Full details: api.cabal-hunter.com/pricing.

Configuration

Env var	Default	Purpose
CABAL_HUNTER_API_KEY	(none)	Prepaid key for unlimited / metered use (X-API-Key).
CABAL_HUNTER_API	https://api.cabal-hunter.com	Override the API base URL.

Other ways to use Cabal-Hunter

• REST: curl "https://api.cabal-hunter.com/api/scan-cabal?mintAddress=<MINT>" — OpenAPI spec
• ElizaOS plugin: elizaos-plugin-cabal-hunter (npm install elizaos-plugin-cabal-hunter)
• MCP template / starter: solana-safe-sniper-mcp-template
• Human? Free interactive bubble map — wallets, Solscan receipts, live chart + trade links on one screen: api.cabal-hunter.com/map

What it detects (why "contract-clean" misses it)

A cabal is 15 fresh wallets — all funded from the same master wallet, all buying in the first seconds of launch — quietly accumulating 25–40% of supply before your bot sees the first candle. Contract clean. LP burned. Everything green. Then they dump, simultaneously, into your liquidity. Cabal-Hunter traces the funding graph on-chain and answers the only question that matters before you sign a swap: are you the exit liquidity?

---

MIT licensed. Powered by Cabal-Hunter. This package is a thin MCP wrapper over the hosted API — the detection runs server-side against live Solana on-chain data (Helius RPC).