{"service":"Cabal-Hunter","description":"On-chain coordinated wallet detection for Solana meme tokens — tells you if you'd be the exit liquidity before you buy","pricing":{"free_tier":"5 free scans, no signup — then 250/month free with an email","paid":"$9/month unlimited (fair use 50k), or pay-as-you-go at $0.001 USDC per scan — every scan is a live on-chain trace, not cached data"},"billing_terms":"5 free scans with no signup at all. Then 250 free scans a month — one email, no card. After that there are two ways to pay — no signup, no card, no KYC: (1) $9 USDC for UNLIMITED (fair use, 50k/mo) — best for 24/7 bots; (2) pay-as-you-go at $0.001/scan, any amount from $1. Pre-fund a reusable key (send USDC, POST the tx to /api/buy-key, then send X-API-Key), or pay per-call via x402. Nothing is auto-charged: crypto payments are push-only. Why the email: 98.5% of the addresses that scan here use exactly one scan and never return, and 1,656 of them share a single identical browser fingerprint at one request each. Metering per address cannot see a pattern like that, because every request individually looks like a different person. The email step exists so the free tier stays genuinely free for the people using the tool. Anonymous requests must also send a User-Agent; any value is accepted.","detection_layers":{"exit_liquidity_risk":"BOOLEAN flag, present only when liquidity is too thin vs market cap to exit without heavy slippage. The headline verdict is cabal_score (0-100) with risk (CLEAN | MEDIUM | HIGH) and recommendation (SAFE | REVIEW | AVOID). Synthesises the signals that mean insiders are positioned to dump on a buyer — bundled launch, single-wallet concentration, shared-funder cluster, coordinated dump, serial-launcher deployer. The one number a trader needs.","funding_trace":"Top holders walked back to shared funding wallets (clusters[].type='funding'). Each cluster carries evidence_txs[] — the actual funding transactions.","bundle_detect":"Holders that bought in the exact same block — Jito bundle signature (time_sync:true, clusters[].type='time_sync')","coordinated_exit":"Multiple holders that DUMPED (≥25% of their bag each) in the exact same block — a cabal exiting in real time (coordinated_exit:true, clusters[].type='coordinated_exit', sold_pct = % of supply dumped)","deployer":"Token creator resolved on-chain + launch TRACK RECORD, on ANY Solana venue — pump.fun, Raydium, Orca, Meteora and PumpSwap (a launch is counted only where the transaction actually CREATED the mint, so minting more supply of an existing token is never miscounted as a launch). deployer.verdict distinguishes two cases your agent must not confuse: FIRST_LAUNCH = we walked the creator's history and found no earlier tokens; UNKNOWN = the history could not be established, which is not evidence of anything. deployer.reputation (SERIAL_RUGGER | DEAD_ON_ARRIVAL | MIXED | PROVEN | FIRST_LAUNCH) plus peak-MC per past launch: best_peak_usd, median_peak_usd, pump_and_dumps (ran past $100k then dumped to dust), dead_on_arrival, still_alive. Free tier gets this summary; the full per-launch launches[] array (peak/now/drawdown/status each) is paid.","cex_filter":"Holders funded from a shared exchange / high-volume wallet are excluded from the score and surfaced in filtered_clusters[] — no false positives from CEX withdrawals","honeypot_check":"Solana-native CAN-YOU-SELL check: live freeze authority, un-revoked mint authority, and Token-2022 traps — transfer fee, transfer hook, permanent delegate, default-frozen accounts. Returns honeypot_risk, freeze_authority_revoked, mint_authority_revoked, token2022_risks[]. This part reads on-chain authorities and mint extensions: it tells you who CAN block a sale.","sell_route":"And whether a way OUT exists right now: we quote selling the token back to SOL and return sell_check{routable, price_impact_pct, sol_out}. A quote, never a trade — nothing is signed and nothing is spent. Price impact is reported because a route you cannot use is not an exit: one live token quoted a route at 100% impact on a single token. A missing route is only called BLOCKED when the token demonstrably has liquidity; on a token too new or too dead to have a pool we report unchecked rather than invent a verdict.","live_watch":"AFTER the buy: POST /api/watch {mint, webhook_url} (or an email) and we poll the token continuously, pushing an alert the moment a coordinated sell or a liquidity drain starts — with the wallets, the share of supply sold in one slot, and the Solscan-verifiable transactions. A scan answers whether a token is safe to BUY; this answers whether it is still safe to HOLD.","screen_list_addon":"PAID ADD-ON ($9/month, on any key): your own private list of wallets, checked automatically on every scan you run. A hit means a wallet from YOUR list holds this token or funded a detected cluster — reported as on-chain observations, never as claims about who a wallet belongs to. Lists are private to the key that owns them. Manage: GET/POST/DELETE /api/screen-list. Enable: POST /api/screen-list/checkout with your X-API-Key.","wallet_check":"FREE, no key: GET /api/wallet-check?mint=<MINT>&wallet=<WALLET> answers whether ONE wallet is in ONE token. The caller brings the address. Returns roles[] (holder with rank/pct/buy_slot, cluster_funder, deployer, liquidity_pool, labelled_exchange), holding{holds_now, sold_out, ui_amount} from a live on-chain lookup, and track_record{prior_tokens, graduated} where we hold one. A wallet we do not find is NEVER reported as clean — the trace covers the largest holders, and a wallet that sold out and closed its token account leaves nothing to observe; holding.sold_out=true means it held this token and has since sold. We publish no list of wallets and make no claim about who an address belongs to."},"response_fields":{"cabal_score":"0–100. ≥65 HIGH, ≥35 CAUTION, else LOW SIGNAL","risk":"HIGH | MEDIUM | CLEAN","is_controlled":"true when score ≥ 35","verdict":"plain-English summary string","time_sync":"true if a same-block (bundled) buy group was found","coordinated_exit":"true if a same-block coordinated dump was found","clusters":"[] scored coordination groups; each has wallet_count, combined_pct, master_full, type ('funding'|'time_sync'|'coordinated_exit'), sold_pct (exits), evidence_txs[]","filtered_clusters":"[] CEX/infra groups excluded from the score (funder_label, wallet_count, combined_pct)","deployer":"{ creator, tokens_launched, dead, sampled, dead_pct, verdict, reputation, best_peak_usd, median_peak_usd, pump_and_dumps, dead_on_arrival, still_alive } — the dev track record, across pump.fun, Raydium, Orca, Meteora and PumpSwap. verdict: FIRST_LAUNCH means we checked and found no earlier launches; UNKNOWN means we could not establish the history and is never a clean bill of health. Paid tier adds launches[]: per-launch { mint, symbol, peak_mcap_usd, now_mcap_usd, drawdown_from_peak, status } so a bot can score a dev's whole history before buying.","holders":"[] top holders; cluster members carry funding_tx + buy_slot (on-chain receipts)","screen_list":"present only when your key has the Screen List add-on enabled: { checked, matches, hits[] }. checked:true with zero matches means the screen RAN and found none — distinct from no screen at all. Each hit carries wallet, your own label, role (holder | cluster_funder) and pct where known","computed_at":"unix seconds — use with the freshness/recheck flow","honeypot_risk":"HIGH | LOW | UNKNOWN — Solana-native sell-blocking check","sell_check":"{ checked, routable, price_impact_pct, sol_out, note } — a live Jupiter quote back to SOL. routable=false with liquidity present is the honeypot shape; checked=false means we could not judge and are saying so","decimals":"mint decimals","freeze_authority_revoked":"true = nobody can freeze your tokens. false = the issuer still can","mint_authority_revoked":"true = supply is fixed. false = more can be minted","token2022_risks":"[] named Token-2022 traps found: transfer fee, transfer hook, permanent delegate, accounts frozen by default","liquidity_usd":"pool liquidity at scan time","market_cap":"market cap at scan time","confidence":"HIGH | LOW — LOW means treat a clean result with suspicion","degraded":"true when the trace was partial; a degraded scan is never allowed to harden a verdict","source":"pre_indexed (<100ms) | real_time"},"free_tier":"5 scans/month per IP anonymously; 250/month with a free key","price_per_query":"0.001 USDC","payment_method":"Solana SPL USDC transfer + X-Payment-Signature header","mcp_endpoint":"/mcp","rest_endpoint":"/api/scan-cabal","batch_endpoint":"POST /api/scan-batch {mints:[...]} with an X-API-Key (a free key works) — screen a whole feed of launches in one call, up to 25 mints, one result row per mint in the order sent; a mint that cannot be analysed returns an error row instead of failing the batch. One scan per mint.","map_endpoint":"/map?mint=<MINT> — free interactive 3D holder map","cex_funding":"/api/cex-funding?mint=<MINT> — per-exchange funding breakdown (which CEXes funded the holders, % of supply each). Labels from Helius identity (12.5k+ verified) — only confirmed exchanges named.","cohorts":"/api/cohorts?mint=<MINT> — Team/Snipers/Insiders cohort breakdown: initial buy %, % of bag still held, and realized SOL profit per cohort (reconstructed from the pool's full swap history).","trade_analysis":"/api/trade-analysis?mint=<MINT> — combined cohorts + wash-trading score + exit-liquidity price-impact in one call (pool swaps fetched once). wash: {wash_score, wash_volume_pct, offenders}; liquidity: {liquidity_usd, lp_burned, sells:[{sol, impact_pct}]}.","dump_webhook":"POST /api/watch {mint, webhook_url} — register a live dump watch; we POST your webhook the instant a coordinated dump / liquidity drain starts (payload: {event, mint, reason, coordinated, action}). GET to list, DELETE to remove. The push model for bot auto-exit.","recheck":"/api/map-data?mint=<MINT>&fresh=1 — force a live re-trace, bypass cache","example_request":{"method":"POST","url":"/api/scan-cabal","headers":{"X-Payment-Signature":"<solana_tx_sig>"},"body":{"mintAddress":"EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v"}}}