Cabal Hunter

Token mint address
      ↓
0. EXIT-LIQUIDITY RISK — the headline verdict. Synthesises the layers
   below (bundle, concentration, shared funder, coordinated selling,
   serial-launcher dev) into risk_level: LOW_SIGNAL | ELEVATED | HIGH.
   Are insiders set up to dump on a buyer? The one field an agent needs.
      ↓
1. HOLDER FUNDING TRACE (ONE HOP) — the CURRENT top holders walked back
   one funding hop: were they seeded by the same wallet? ONE hop, not a
   lineage — we do not claim to follow money through a chain of
   wallets. Only System-owned accounts count as
   a funder, so pools, vaults and routers can never be mistaken for a
   person (that mistake is exactly what got our pre-launch tracer
   withdrawn). Every cluster carries evidence_txs[] — the actual
   funding transactions on Solscan. This layer is genuinely rare to
   fire; treat a hit as significant and its absence as no evidence
   either way.
      ↓
2. SAME-BLOCK BUNDLE DETECTION — holders whose token accounts were
   created in the EXACT same slot - a Jito bundle is one way to do that, not
   the only one. Catches
   stealth launches that route funding through intermediaries to
   evade layer 1. Returned as `time_sync: true`.
      ↓
3. COORDINATED SELLING DETECTION — ≥2 holders that SOLD a meaningful
   chunk (≥25% of their bag each) in the EXACT same block.
   `coordinated_exit: true`, with sold_pct = % of supply sold and the
   signatures in evidence_txs[]. Same-slot + meaningful-size + distinct
   wallets = near-zero false positives. It reads the CURRENT holder set
   at scan time, so a bundle that already sold and left the top holders
   is not visible here — that is what the launch-block check is for.
   For a token you already hold, POST /api/watch pushes you a webhook
   the moment a dump or liquidity drain STARTS.
      ↓
4. DEV TRACK RECORD — the creator wallet is resolved on-chain (bonding
   curve pre-graduation, pump-amm pool after — works on any age token),
   and their launch history is pulled WITH THE PEAK MARKET CAP each
   past token hit. `sampled` says how many of those launches we actually
   walked — a very prolific wallet is sampled, not exhausted, so read
   `tokens_launched` as a floor, never as a complete history.
   Launch detection is venue-agnostic: pump.fun, Raydium,
   Orca, Meteora and PumpSwap. A launch is only counted where the
   transaction actually CREATED the mint, so minting more supply of a
   token that already exists is never miscounted as a launch.
   A dead-count alone hides a pump-and-dump: a dev whose
   tokens all died at $4k is a nobody, but one who ran a token to $728k
   then dumped it to dust has done it to holders before. Reputation:
   FIRST_LAUNCH | PROVEN | MIXED | DEAD_ON_ARRIVAL | SERIAL_RUGGER |
   UNKNOWN, with per-launch peak → now (paid tier returns the full
   launches[] array). UNKNOWN means the history could not be
   established — never read it as a clean record.
      ↓
5. CEX-NOISE FILTER — holders funded from a shared exchange or
   high-volume infra wallet are NOT a cabal. They're excluded from the
   score and surfaced transparently in filtered_clusters[], so you never
   get a false positive from people who just withdrew from Binance.
      ↓
6. HONEYPOT CHECK (Solana-native) — one RPC read of the mint account:
   is the FREEZE authority live (issuer can freeze your tokens — the
   sell-block lever)? is the MINT authority live (supply can be
   inflated)? any Token-2022 traps (transfer fees up to 100%, transfer
   hooks that block sells, permanent-delegate clawback)? On Solana a
   "honeypot" is built from these — tokens have no per-token contract
   code to audit. Returns `honeypot_risk: LOW | HIGH` +
   `freeze_authority_revoked` / `mint_authority_revoked` /
   `token2022_risks[]`.
      ↓
Returns: Cabal Score (0-100) + cluster map + deployer verdict
         + honeypot verdict + on-chain receipts + hard verdict