DeFade — Multi-Chain Memecoin Analyzer
REMOTE · API.DEFADE.ORG
Rug pull risk and on-chain forensics for tokens on Solana and six EVM chains.
Available components
Last scanned (19 hours ago)
Scores higher than 89% of remote servers
Unreachable for 1 day in a row. Last reached 3 Nov 2026.
Category Crypto and Web3
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security11
- TLS not yet verified: we couldn't open a connection to check the certificate. View diagnostics → Unverified
- Authorisation not yet verified: we couldn't confirm whether this endpoint requires it. View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS not yet verified: we couldn't read the response headers to check for it. View diagnostics → Unverified
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability0
- Transport check failed: declared streamable-http, but we couldn't connect to verify it. See how to fix → View diagnostics → Fail
Schema Quality & AI Usability0
- Schema not yet verified: we couldn't read the endpoint's schema, or could read only part of its tool list.Unverified
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage0
- Tool coverage not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.Unverified
Tool Safety0
- Tool safety not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.Unverified
Capabilities0
- Capabilities not yet verified: we couldn't read the endpoint's capabilities.Unverified
Unverified: 5 categories
Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 0
- Endpoint reachability: reachable → unreachable ▼ security
- Stability: pass → unverified ▼ security
- Authorization: partial → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- TLS certificate: pass → unverified ▼ security
- HSTS header: pass → unverified ▼ security
- Transport: pass → fail ▼ security
- Capabilities: fail → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- 2 Nov 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Tool “get_rug_score” rewrote its description, which is the text the model reads security
- 31 Oct 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Tool “get_rug_score” rewrote its description, which is the text the model reads security
- 29 Oct 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Server version: 1.1.8 → 1.1.9 functional
- “get_dev_tracker” reworded the description of “chain” cosmetic
- “get_fee_fingerprint” reworded the description of “chain” cosmetic
- “get_funding_sources” reworded the description of “chain” cosmetic
- “get_holders” reworded the description of “chain” cosmetic
- “get_launch_bundles” reworded the description of “chain” cosmetic
- “get_launch_snipers” reworded the description of “chain” cosmetic
- “get_liquidity” reworded the description of “chain” cosmetic
- “get_lookalike_clusters” reworded the description of “chain” cosmetic
- “get_rug_score” reworded the description of “chain” cosmetic
- “get_smart_money” reworded the description of “chain” cosmetic
- “get_token_price” reworded the description of “chain” cosmetic
- “get_token_scan” reworded the description of “chain” cosmetic
- “get_wallet_links” reworded the description of “chain” cosmetic
- “get_whales” reworded the description of “chain” cosmetic
- 21 Oct 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Tool “get_launch_snipers” rewrote its description, which is the text the model reads security
- Tool “get_rug_score” rewrote its description, which is the text the model reads security
- Tool “get_token_scan” rewrote its description, which is the text the model reads security
- 19 Oct 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Tool “get_rug_score” rewrote its description, which is the text the model reads security
- Tool “get_token_scan” rewrote its description, which is the text the model reads security
- 14 Oct 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Tool “get_rug_score” rewrote its description, which is the text the model reads security
- 11 Oct 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Tool “get_fee_fingerprint” rewrote its description, which is the text the model reads security
- Tool “get_lookalike_clusters” rewrote its description, which is the text the model reads security
- Server version: 1.1.7 → 1.1.8 functional
- “get_dev_tracker” reworded the description of “chain” cosmetic
- “get_fee_fingerprint” reworded the description of “chain” cosmetic
- “get_funding_sources” reworded the description of “chain” cosmetic
- “get_holders” reworded the description of “chain” cosmetic
- “get_launch_bundles” reworded the description of “chain” cosmetic
- “get_launch_snipers” reworded the description of “chain” cosmetic
- “get_liquidity” reworded the description of “chain” cosmetic
- “get_lookalike_clusters” reworded the description of “chain” cosmetic
- “get_rug_score” reworded the description of “chain” cosmetic
- “get_smart_money” reworded the description of “chain” cosmetic
- “get_token_price” reworded the description of “chain” cosmetic
- “get_token_scan” reworded the description of “chain” cosmetic
- “get_wallet_links” reworded the description of “chain” cosmetic
- “get_whales” reworded the description of “chain” cosmetic
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Probed https://api.defade.org/mcp
TLS unreached
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of api.defade.org. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| org. | present | 26974 | 8 | Verified |
| defade.org. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Inconclusive
We could not reach the endpoint well enough to judge its authorisation posture.
| Result | Inconclusive |
|---|
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://api.defade.org/mcp | Unreachable | ||
| http (plaintext) | http://api.defade.org/mcp | HTTPS enforced |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
get_dev_tracker Dev wallet tracking ~485
What the token's creator has done with their supply: the share they still hold, what left through sales versus transfers, and where the transfers went. Read the state carefully: still holding is neutral, a dev who simply sold out is statusColor gray — the standard launch pattern, not a rug — fully exited on a fresh token is a warning, and transferred out to fresh wallets (red) is the single strongest rug signal DeFade tracks. The creator is the wallet that created the mint on Solana and the contract deployer on EVM chains; creatorSource says how it was identified, and creatorInferred true means it may be a launchpad authority rather than a person, so weigh the verdict accordingly. Not for wallets other than the creator (get_whales, get_wallet_links); the creator's earlier launches are already served by get_token_scan's creator block (tokenCreations, recentTokens). Arguments: address and chain — the deployer is read from the contract creation on that chain, so a 0x address needs its chain; one API unit on any chain.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… |
| chain | string | – | Chain the token is deployed on: solana (default), ethereum, base, bsc, robinhood, arc, hyperevm, monad. Required for any 0x address, because the same contract address can exist on several EVM chains.… |
| Name | Type | Req | Description |
|---|---|---|---|
| creatorSource | string|null | – | How the dev wallet was identified; creatorInferred is true when it may be a launchpad authority rather than a person. |
| currentHoldingPct | number|null | – | Percent of supply the dev holds now. |
| lastActivity | number|null | – | Unix seconds of the dev's most recent move of this token. |
| poweredBy | string|null | – | Always "DeFade.org". |
| recentSells | array|null | – | Transactions behind each bucket, newest first, capped. |
| status | string|null | – | One-line verdict: STILL HOLDING, PARTIAL EXIT, FULLY EXITED, TRANSFERRED OUT, SOLD & TRANSFERRED, DISTRIBUTED, LOCKED and similar. |
| statusColor | string|null | – | green, yellow, gray or red. A dev selling out is gray: the standard launch pattern, not a rug. |
| timestamp | string|null | – | ISO time the response was assembled. |
| token | – | – | The address that was scanned (on get_token_scan, the full token metadata object instead). |
| totalMintedPct | number|null | – | Genesis allocation as percent of supply; totalBoughtPct, totalSoldPct, totalTransferredPct, totalLockedPct, totalLiquidityPct, totalBurnedPct (supply the dev destroyed: not a transfer, not scored) al… |
| transferRecipientAnalysis | array|null | – | What large recipients did with the tokens: address, amountPct, stillHeldPct, verdict. |
| transferRecipients | number|null | – | Distinct wallets that received a transfer. |
No examples provided.
get_fee_fingerprint Shared fee-setting fingerprint ~473
Wallets whose transactions pin an identical fee setting — compute-unit price or Jito tip on Solana, priority fee or legacy gas price on EVM chains — one operator's bot settings showing up across every wallet it drives. This is the shared-CONFIGURATION member of the "who is really behind this token" family (proven transfers: get_wallet_links; funding origin: get_funding_sources; behavioural twins: get_lookalike_clusters), not a timing link: it never proves bundling, and two wallets can match days apart. Use it to corroborate get_lookalike_clusters, and to catch the operator who sold their launch wallets and re-entered through fresh ones; read a match as corroboration, never as proof of coordinated buying. Groups are strongest first; pending true means no bundle scan has run for this token yet, so nothing has looked rather than nothing was found. Arguments: address and chain; one API unit on any chain, because it reads what the bundle scan already computed.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… |
| chain | string | – | Chain the token is deployed on: solana (default), ethereum, base, bsc, robinhood, arc, hyperevm, monad. Required for any 0x address, because the same contract address can exist on several EVM chains.… |
| Name | Type | Req | Description |
|---|---|---|---|
| computedAt | string|null | – | When this result was read. |
| excluded | array|null | – | Fee values too common to link anyone, with the wallet count each covered and a reason: generic_default (a value most of the launch used) or, on EVM, round_preset (a round tip an app or wallet sets fo… |
| groups | array|null | – | One entry per fee setting shared by two or more wallets, strongest first: wallets, supplyPct bought, confidence. Only a confidence of 60 or more is evidence of one operator; below it, strangers can s… |
| pending | boolean|null | – | True when no bundle scan has run for this token yet: nothing has looked, not nothing was found. |
| poweredBy | string|null | – | Always "DeFade.org". |
| stats | object|null | – | Wallets seen, how many carried a readable fee setting, how many were linked, how many set none. |
| timestamp | string|null | – | ISO time the response was assembled. |
| token | – | – | The address that was scanned (on get_token_scan, the full token metadata object instead). |
No examples provided.
get_funding_sources Funding provenance ~517
Multi-hop tracing of where the money behind this token's key wallets actually came from, walking each funding chain back and tiering the source by whether it is a KYC'd exchange. Use it to test whether several "unrelated" holders share one funding source. It answers provenance only — money in, one dimension: it does not build the wallet-to-wallet transfer graph (get_wallet_links), group look-alike behaviour (get_lookalike_clusters), or match shared bot fee settings (get_fee_fingerprint). Read coveragePct before the origins: it is the share of supply that could be attributed, the remainder (unknownCount wallets) could not be traced and is not evidence either way, and dexPct and bridgedPct are real states rather than attributions. Results are cached for 30 minutes (computedAt, fromCache). Not for the creator's own activity (get_dev_tracker) or launch-window buying (get_launch_bundles, get_launch_snipers). Arguments: address and chain — a 0x address needs its chain; on an EVM chain this call costs 5 API units instead of 1, because the trace runs against paid indexers, so check get_usage before running it across many tokens.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… |
| chain | string | – | Chain the token is deployed on: solana (default), ethereum, base, bsc, robinhood, arc, hyperevm, monad. Required for any 0x address, because the same contract address can exist on several EVM chains.… |
| Name | Type | Req | Description |
|---|---|---|---|
| computedAt | string|null | – | When this was computed; fromCache says whether it was served from a stored result. |
| coveragePct | number|null | – | Share of supply attributed to an origin; dexPct and bridgedPct are real states but not attribution. |
| origins | array|null | – | Where holder supply was funded from, as { name, share }, biggest first. |
| poweredBy | string|null | – | Always "DeFade.org". |
| risk | object|null | – | Verdict with label and severity. |
| tiers | array|null | – | The same supply grouped by certainty tier, as { tier, share }. |
| timestamp | string|null | – | ISO time the response was assembled. |
| token | – | – | The address that was scanned (on get_token_scan, the full token metadata object instead). |
| walletCount | number|null | – | Wallets resolved, with resolvedCount and unknownCount. |
No examples provided.
get_holders Holder distribution ~392
Holder distribution for one token, with liquidity pools, burn addresses, lockers, exchange wallets and contracts classified out, so the top-holder list reflects actual holders. Returns the classified top holders with each wallet's supply share in a single response — no pagination. Use it to answer how concentrated the supply is and whether a few wallets could collapse the chart. Not for what large holders are doing right now (get_whales), whether holders are secretly one actor (get_wallet_links or get_lookalike_clusters), or pool depth and locks (get_liquidity). Arguments: address and chain; one API unit on any chain.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… |
| chain | string | – | Chain the token is deployed on: solana (default), ethereum, base, bsc, robinhood, arc, hyperevm, monad. Required for any 0x address, because the same contract address can exist on several EVM chains.… |
| Name | Type | Req | Description |
|---|---|---|---|
| bundles | object|null | – | Always { detected: false, bundlePct: "0.00", groups: [] }, kept for older readers: similar balances are not a cluster. Launch bundles are get_launch_bundles. |
| concentration | object|null | – | top5, top10, top20 as percent of supply, counting real wallets only, plus the parts one wallet can take now (heldBy). |
| deferredUnlock | object|null | – | Supply that unlocks back to the deployer later: pct, unlockDate, cancelablePct. Null when none. |
| holderCountCapped | boolean|null | – | True when the count stopped at 10,000: the token has at least that many holders. |
| leftover | object|null | – | Solana: a Meteora DBC fixed supply leftover: pct, receiver (the config's leftover receiver: the burn address 1nc1nerator11111111111111111111111111111111 when it can only be paid there), role, platfor… |
| lockedSupply | object|null | – | pct plus a lockers array naming each escrow; a vesting lock counts what is not claimable yet and adds unlocksTo, nextUnlock, fullyUnlockedAt. |
| mayhemAgent | object|null | – | Solana: what pump.fun's Mayhem agent wallet holds of the token: address, pct (of supply), amount. On a coin launched in Mayhem mode (get_token_scan token.timeline.mayhem) the create minted it 1B besi… |
| poweredBy | string|null | – | Always "DeFade.org". |
| protocolHoldings | object|null | – | What was excluded: count and totalPct. |
| timestamp | string|null | – | ISO time the response was assembled. |
| token | – | – | The address that was scanned (on get_token_scan, the full token metadata object instead). |
| topHolders | array|null | – | Top 20 accounts: rank, address, walletAddress, amount, percentage, solBalance, isProtocol, protocolLabel. A launch vault or escrow is split into parts (partOf); a part one wallet can take now has hel… |
| totalHolderCount | number|null | – | Solana: every holder of the token, counted. 10,000 with holderCountCapped true when there are more. Null when the count was not in yet; ask again a few seconds later. |
| totalHolders | number|null | – | How many of the largest accounts were read, at most 20. Not the holder count: that is totalHolderCount. |
| vesting | object|null | – | Solana: vesting a launch program holds (Jupiter Lock, LaunchLab, Meteora DBC): lockedPct, claimablePct, reclaimablePct, unlocking30dPct, nextUnlock, fullyUnlockedAt, recipients, schedules, summary. N… |
No examples provided.
get_launch_bundles Launch-window bundles ~387
Bundle detection for one token: coordinated buys in the launch window plus delayed sweeps, accounted on peak net exposure rather than raw buy count, so wallets that bought and flipped are not counted as holders. Heavy bundling that is still held is one of the strongest rug predictors. Use it for any "was this launch bundled" question. Not for lone fast buyers with no coordination (get_launch_snipers), clusters that formed after launch (get_lookalike_clusters), or the creator's own selling (get_dev_tracker). Arguments: address and chain; one API unit on any chain.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… |
| chain | string | – | Chain the token is deployed on: solana (default), ethereum, base, bsc, robinhood, arc, hyperevm, monad. Required for any 0x address, because the same contract address can exist on several EVM chains.… |
| Name | Type | Req | Description |
|---|---|---|---|
| bundles | array|null | – | Each bundle: its wallets, what they spent, what they still hold, how they were funded. |
| hiddenBundleCount | number|null | – | Bundles the shallow detector does not see. |
| poweredBy | string|null | – | Always "DeFade.org". |
| summary | object|null | – | Totals across detected bundles, accounted on peak net exposure. summary.transferredUnsoldPct is the transferred share the DeFade website prints (moved out and not sold since); transferredPct counts e… |
| timestamp | string|null | – | ISO time the response was assembled. |
| token | – | – | The address that was scanned (on get_token_scan, the full token metadata object instead). |
No examples provided.
get_launch_snipers First-block snipers ~425
Bots that bought in the first block or first seconds of this token's launch, and whether they are connected to the deployer. The window is the first 120 seconds after the first transaction; at most 30 rows are returned and totalEarlyBuyers carries the full count. Migration-crank MEV bots are excluded and named rather than silently dropped. Check reachedGenesis: when false the walk did not reach the true first transaction, the result is partial, and it is cached for an hour instead of two. Use it to tell an organic launch from a pre-arranged one. Not for coordinated multi-wallet launch buying (get_launch_bundles) or the deployer's funding of other wallets (get_wallet_links). Arguments: address and chain; one API unit on any chain.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… |
| chain | string | – | Chain the token is deployed on: solana (default), ethereum, base, bsc, robinhood, arc, hyperevm, monad. Required for any 0x address, because the same contract address can exist on several EVM chains.… |
| Name | Type | Req | Description |
|---|---|---|---|
| complete | boolean|null | – | False beside pending. |
| migrationCrankersExcluded | array|null | – | Migration-crank MEV bots filtered out as infrastructure, named. |
| pending | array|null | – | Solana: ["bundles-pro"] when this was read before Bundle Detection had run; the call started it. Call again in about a minute for the answer the scan page shows. |
| poweredBy | string|null | – | Always "DeFade.org". |
| reachedGenesis | boolean|null | – | Whether the walk reached the true first transaction. When false, partial is true and small snipers may be missing. |
| snipers | array|null | – | Wallets that bought inside the launch window, capped at 30 rows. |
| stats | object|null | – | Cohort totals for the window. stats.transferredUnsoldPct is the transferred share the DeFade website prints; the gross transfer figures count a token each time it moved. Solana: stats.bundleCohort is… |
| terminals | object|null | – | Trading terminals the launch cohort came through; activeTerminals is who trades it now. |
| timestamp | string|null | – | ISO time the response was assembled. |
| token | – | – | The address that was scanned (on get_token_scan, the full token metadata object instead). |
| totalEarlyBuyers | number|null | – | How many were found in total; windowSeconds and firstTxTime describe the window. |
No examples provided.
get_liquidity Liquidity analysis ~507
Liquidity pool analysis for one token: which DEX holds the deepest pool, its depth in USD, and whether the LP tokens are burned, locked or still in someone's hands. lpStatus is the verdict — LP BURNED, LP LOCKED, LP UNLOCKED, PARTIALLY BURNED, LP NOT LOCKABLE, BONDING CURVE (still on a launchpad curve, no pool yet) or NO LP FOUND, with combinations spelled out — and lpBurnPct, lpLockPct and poolLocks carry the evidence. Use it to answer whether liquidity is locked, how deep it is, and whether the position could be pulled: LP UNLOCKED means it can be pulled at any time. Cached for about two minutes. A token with no pool returns empty liquidity data, which is itself a warning on a token that is trading. Not for price or volume (get_token_price), market cap (get_token_scan) or holder concentration (get_holders). Arguments: address and chain — pools live per chain, so a 0x address needs the chain it trades on, and a Base pool is not found under ethereum; one API unit on any chain.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… |
| chain | string | – | Chain the token is deployed on: solana (default), ethereum, base, bsc, robinhood, arc, hyperevm, monad. Required for any 0x address, because the same contract address can exist on several EVM chains.… |
| Name | Type | Req | Description |
|---|---|---|---|
| dex | string|null | – | Which DEX holds the deepest pool. |
| lpBurnPct | number|null | – | Percent of LP tokens burned; lpLockPct is the percent locked. |
| lpStatus | string|null | – | Headline pool verdict: LP BURNED, LP LOCKED, LP UNLOCKED, PARTIALLY BURNED, LP NOT LOCKABLE, LP HELD BY DAO (a MetaDAO token: the vault of its DAO holds the liquidity), BONDING CURVE, NO LP FOUND, or… |
| poolLocks | array|null | – | Per-pool lock detail with lpLockable and an lpNote in words. |
| poweredBy | string|null | – | Always "DeFade.org". |
| risk | string|null | – | Liquidity risk label; lpEvidence carries the on-chain evidence behind it. |
| timestamp | string|null | – | ISO time the response was assembled. |
| token | – | – | The address that was scanned (on get_token_scan, the full token metadata object instead). |
| totalLiquidityUsd | number|null | – | Combined USD depth across pools; pools lists them and poolCount counts them. On an EVM chain, null when the pair feed gives no pool a liquidity figure, or the reserve of a bonding curve could not be… |
No examples provided.
get_lookalike_clusters Behavioural sybil clusters ~413
Clusters of wallets around one token that behave as a single actor — buys sized and timed alike so demand looks organic — even when no transfer or funding trail connects them. That behavioural inference is what separates it from get_wallet_links, which only reports proven links. Use it when supply looks distributed across many small wallets and the insider graph comes back clean; corroborate with get_fee_fingerprint. Not for proven transfer links (get_wallet_links), the funding source behind the wallets (get_funding_sources), or launch-window coordination (get_launch_bundles). Arguments: address and chain; on an EVM chain this call costs 5 API units instead of 1, because the trace runs against paid indexers.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… |
| chain | string | – | Chain the token is deployed on: solana (default), ethereum, base, bsc, robinhood, arc, hyperevm, monad. Required for any 0x address, because the same contract address can exist on several EVM chains.… |
| Name | Type | Req | Description |
|---|---|---|---|
| bands | array|null | – | Wallet clusters banded by how strongly they look like one operator. |
| computedAt | string|null | – | When this was computed; fromCache says whether it was served from a stored result. |
| poweredBy | string|null | – | Always "DeFade.org". |
| risk | object|null | – | Verdict for the token with label and severity. |
| stats | object|null | – | Totals across the bands: wallets clustered and the supply they hold. |
| timestamp | string|null | – | ISO time the response was assembled. |
| token | – | – | The address that was scanned (on get_token_scan, the full token metadata object instead). |
No examples provided.
get_rug_score Rug pull probability ~470
Rug pull probability for one token: a 0-100 score where HIGHER MEANS MORE DANGEROUS, a verdict label, and the individual signals that drove it. This is the opposite direction from get_token_scan's safety score. This is the verdict the DeFade website shows: call it, after get_token_scan, for every "is this safe", "is this a rug" or "should I buy" question, on every chain (on an EVM chain get_token_scan carries no score at all). When complete is false the score is partial: say so, and call again for the rest. Not for the evidence behind the number — it names the signals but does not list the wallets; for who is behind the risk call get_wallet_links, get_dev_tracker or get_launch_bundles. Arguments: address and chain; five API units on Solana and on an EVM chain, because the score reads the scan's modules first — check get_usage before scoring many tokens.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… |
| chain | string | – | Chain the token is deployed on: solana (default), ethereum, base, bsc, robinhood, arc, hyperevm, monad. Required for any 0x address, because the same contract address can exist on several EVM chains.… |
| Name | Type | Req | Description |
|---|---|---|---|
| bundleSubScore | number|null | – | The bundle component of the score. |
| complete | boolean|null | – | True when nothing is pending: every module the score reads is in it. |
| coverage | string|null | – | "full" when the Pro signal set contributed, "free" when only the free signals did — a "free" score has seen less evidence. "partial" when a module was still running after the 25 s this tool waits (Bu… |
| fusion | object|null | – | Cross-signal wallet correlation; wallets list is empty on non-Pro keys. |
| pending | array|null | – | Modules still running when the score was taken; empty when it is complete. Call the tool again for the score with them in. |
| poweredBy | string|null | – | Always "DeFade.org". |
| proChecksLocked | number|null | – | How many Pro-only checks were withheld. |
| rugScore | number|null | – | Rug probability 0 (safe) to 100 (critical). HIGHER IS MORE DANGEROUS. |
| scoreLabel | string|null | – | Null normally. "NEVER BONDED" or "NEVER TOOK OFF" when the human surfaces print that state instead of the percentage; rugScore is still the number. |
| signals | array|null | – | Each contributing signal: what fired, its weight and its explanation. |
| timestamp | string|null | – | ISO time the response was assembled. |
| token | – | – | The address that was scanned (on get_token_scan, the full token metadata object instead). |
| verdict | string|null | – | PROBABLY SAFE (<25), SOME RISK (25+), ELEVATED RISK (45+), HIGH RISK (60+), EXTREME RISK (75+); or a state that overrides the bands: RUGGED / DEAD, ABANDONED / DEAD (failed after its market cap had o… |
No examples provided.
get_smart_money Smart money ~395
Wallets with a track record of profitable entries that are holding or trading this token, classified from their historical trade win rates — a "verified" smart-money tag requires a known win rate of 50% or better. Computed live from the current holder set and cached for about five minutes. Use it for the bullish side of a scan: who informed is in, and when they got in. Not for risk assessment — informed wallets present never offsets a rug signal, and a clean result is not a buy signal — and not for wallet size (get_whales). Arguments: address and chain; one API unit on any chain.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… |
| chain | string | – | Chain the token is deployed on: solana (default), ethereum, base, bsc, robinhood, arc, hyperevm, monad. Required for any 0x address, because the same contract address can exist on several EVM chains.… |
| Name | Type | Req | Description |
|---|---|---|---|
| activeBuys | array|null | – | Other tokens the smart wallets are currently buying. |
| poweredBy | string|null | – | Always "DeFade.org". |
| summary | object|null | – | analyzed, smartMoneyCount, verifiedCount, experiencedCount, activeTraderCount, retailCount, smartMoneyPct, avgWinRate, signal. |
| timestamp | string|null | – | ISO time the response was assembled. |
| token | – | – | The address that was scanned (on get_token_scan, the full token metadata object instead). |
| wallets | array|null | – | Profiled holders, each classified smart money, verified, experienced, active trader or retail, with win rate. |
No examples provided.
get_token_price Token price ~680
Price history for one token as OHLCV candles, plus the latest price, the window's high and low with their timestamps, and the percent change across the window — prices in USD (the *Usd fields), volume as the market source quotes it. Aggregated from DEX market sources and cached for about a minute. Intervals with no trades are omitted rather than zero-filled, so consecutive candles can sit more than one step apart. The optional timeframe argument sets the candle size and with it how far back the window reaches: 15m (the default) covers about the last 2.5 days, 1H about 10 days, 4H about 40 days and 1D up to a year of daily candles, back to the token's first trade if it is younger; there is no start or end argument, the size fixes the window. Use 1D for "what did it peak at", "how far is it down from the top" or any price history question; use the default for the market context around a risk verdict. A token with no liquidity pool returns candles: [] and totalCandles: 0 rather than an error. Not for risk of any kind — market data carries no forensic signal — and not for pool depth or lock status (get_liquidity) or market cap (get_token_scan's token block). Arguments: address, chain and timeframe — a 0x address needs its chain; one API unit on any chain regardless of timeframe.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… |
| chain | string | – | Chain the token is deployed on: solana (default), ethereum, base, bsc, robinhood, arc, hyperevm, monad. Required for any 0x address, because the same contract address can exist on several EVM chains.… |
| timeframe | string | – | Candle size, which also sets the window: 1m ≈ last 4 hours, 5m ≈ 20 hours, 15m ≈ 2.5 days (default), 30m ≈ 5 days, 1H ≈ 10 days, 4H ≈ 40 days, 1D ≈ up to 365 days. A token younger than the window ret… |
| Name | Type | Req | Description |
|---|---|---|---|
| candles | array|null | – | OHLCV candles, oldest first: ts (ms), open, high, low, close, volume and *Usd values. |
| current | object|null | – | Latest close as current.priceUsd. |
| high | object|null | – | Window high as priceUsd plus ts; low is the same shape. |
| poweredBy | string|null | – | Always "DeFade.org". |
| priceChange | number|null | – | Percent change from the first candle to the last. Null when it cannot be computed. |
| timestamp | string|null | – | ISO time the response was assembled. |
| token | – | – | The address that was scanned (on get_token_scan, the full token metadata object instead). |
| totalCandles | number|null | – | Number of candles; a token with no chart data answers 0. |
No examples provided.
get_token_scan Scan a token ~500
Run a full DeFade scan on one token contract. On Solana: token metadata, holder distribution, creator history (wallet age, previous token launches) and the headline risk verdict. On an EVM chain: the contract and market read only (token metadata with the owner and the mint, blacklist, whitelist and proxy flags, market, pairs and warnings), with no holders, creator or score; call get_rug_score there for the verdict. Start here for any "is this token safe", "is this a rug pull" or "should I buy this" question, then call get_rug_score for the verdict: the safety score here weighs only holders, creator and authorities. On Solana returns risk.score as a SAFETY score where 100 is clean and low numbers are dangerous, with a rating label. For the inverse — a rug pull probability where high means dangerous — call get_rug_score. Not for a single module in isolation (call that module's tool directly), price or market-cap questions (get_token_price), or checking the caller's own quota (get_usage). Arguments: address and chain; one API unit on any chain.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… |
| chain | string | – | Chain the token is deployed on: solana (default), ethereum, base, bsc, robinhood, arc, hyperevm, monad. Required for any 0x address, because the same contract address can exist on several EVM chains.… |
| Name | Type | Req | Description |
|---|---|---|---|
| analyzedAt | string|null | – | Solana: ISO time of the scan itself. |
| creator | object|null | – | Solana only. Deployer wallet: address, walletAgeDays, solBalance, totalTransactions, tokenCreations, recentTokens, riskLevel. |
| holders | object|null | – | Solana only. Same body as get_holders: totalHolderCount, holderCountCapped, totalHolders, topHolders, concentration, protocolHoldings, lockedSupply, deferredUnlock, vesting, leftover, mayhemAgent, bu… |
| launchpad | object|null | – | EVM only: the launchpad the token launched on, as the DeFade page names it: name (four.meme, flap.sh, Genius, Clanker, Zora, Virtuals, Pangea, Stockereum.fun, Pons, nad.fun, LiquidLaunch …), curve (i… |
| market | object|null | – | EVM only: the main pair — priceUsd, marketCap, fdv, liquidityUsd, volume24h, priceChange, pairCreatedAt, dex. A token still on its launchpad's bonding curve (nad.fun, Virtuals, four.meme, Genius, fla… |
| poweredBy | string|null | – | Always "DeFade.org". |
| risk | object|null | – | Solana only. The SAFETY score: score (0-100, 100 is clean), rating, color, flags. Opposite direction from get_rug_score. Absent on EVM chains, where get_rug_score is the score. |
| scanCount | number|null | – | How many times this token was scanned in the last 24 hours, on every DeFade surface (web, app, extension, Telegram, API) by every user, including this scan (scanWindow "24h"). |
| scanWindow | string|null | – | The window scanCount covers: "24h". |
| success | boolean|null | – | Solana: whether the scan completed. |
| timestamp | string|null | – | ISO time the response was assembled. |
| token | object|null | – | Token metadata. Solana: name, symbol, mint, supply, decimals, creator, mintAuthority, freezeAuthority, marketCap, liquidity, and timeline, whose launchPlatform names the launchpad (pump.fun, bonk.fun… |
| warnings | array|null | – | EVM only: what the contract and market read flagged, each level (critical, warning or info), code and message. |
No examples provided.
get_usage API usage ~75
Report the calling API key's plan, rate limits and how much of its monthly allowance is left. Takes no arguments. Use it when a call fails on quota, or when the user asks what their DeFade plan includes. Not for anything about a token — every other tool takes an address; this one reports on the key itself.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| credits | object|null | – | Overage: balance, overageEnabled, costPerRequest. |
| limits | object|null | – | perMinute, perDay, perMonth: the monthly allowance in units, or for the Pro connector key the web plan's monthly scans. |
| tier | string|null | – | The tier this key is on. web_mcp is the connector key included with a DeFade Pro web subscription; its allowance is the plan's monthly scans, reported in plan/limits.perMonth. |
| units | object|null | – | How metering works: one request is one unit except the heaviest calls, listed in heavyOnEvm with heavyCost and in heavyOnSolana with heavyCostOnSolana. |
| usage | object|null | – | today, total, thisPeriod, remainingThisPeriod, periodResetsAt. |
No examples provided.
get_wallet_links Proven insider links ~499
The graph of proven on-chain links between wallets around one token — who funded whom, who transferred to whom, and coordinated timing — typically the deployer's supply fanned out to look like organic demand. Use it when the holder list looks distributed and you want to know whether it really is. This is the hard-evidence member of the four "who is really behind this token" tools — a link counts only when a transfer or a shared funder is on chain: wallets that merely behave alike are get_lookalike_clusters, where the money first entered the chain is get_funding_sources, and identical bot fee settings are get_fee_fingerprint. Scope: the top 25 real holders are traced (pools, lockers and exchanges excluded), connections is capped at 50 rows with connectionsTotal as the full count, and an empty graph means no on-chain link was found among them — not proof they are independent, so follow up with get_lookalike_clusters. Not for the creator wallet's own sales and transfers (get_dev_tracker) or for market data of any kind. Arguments: address and chain; one API unit on any chain.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… |
| chain | string | – | Chain the token is deployed on: solana (default), ethereum, base, bsc, robinhood, arc, hyperevm, monad. Required for any 0x address, because the same contract address can exist on several EVM chains.… |
| Name | Type | Req | Description |
|---|---|---|---|
| connections | array|null | – | Wallet-to-wallet transfers that tie the cohort together; connectionsTotal is the count before truncation. |
| insiderCount | number|null | – | Wallets in the connected cohort; insiderHoldingPct is the supply they hold. |
| locked | boolean|null | – | True on non-Pro keys, in which case only reason, upgradeUrl and message are present. |
| nodes | array|null | – | Graph nodes; clusters groups them. |
| poweredBy | string|null | – | Always "DeFade.org". |
| timestamp | string|null | – | ISO time the response was assembled. |
| token | – | – | The address that was scanned (on get_token_scan, the full token metadata object instead). |
| totalTransfers | number|null | – | Transfers behind the graph, moving transferredPct of supply. |
| walletConnections | object|null | – | Per-wallet connection counts. |
No examples provided.
get_whales Whale activity ~456
Wallets holding at least 1% of supply once pools, lockers, treasuries and custodial accounts are removed. Each row carries the balance, share of supply, any attribution label (known KOL, dev-linked stash, exchange), the 24-hour transaction count and recent buys and sells; the summary counts dangerous and active whales and gives a whale-risk verdict. One response, no pagination; cached for 15 minutes, so activity figures can lag by that much. A token with nothing above the threshold returns an empty list and largestHumanPct, so the empty state is explainable rather than silent. Use it after get_holders when the question is about who can dump and whether they are already dumping. Not for the full ranked holder list (get_holders), historically profitable wallets (get_smart_money), or the creator's own wallet (get_dev_tracker). Arguments: address and chain; one API unit on any chain.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… |
| chain | string | – | Chain the token is deployed on: solana (default), ethereum, base, bsc, robinhood, arc, hyperevm, monad. Required for any 0x address, because the same contract address can exist on several EVM chains.… |
| Name | Type | Req | Description |
|---|---|---|---|
| poweredBy | string|null | – | Always "DeFade.org". |
| protocolAccounts | array|null | – | Pools, lockers, treasuries and custodial accounts held out of the whale list, named. |
| summary | object|null | – | totalWhales, totalWhalePct, dangerWhales, activeWhales, whaleRisk, whaleThreshold, largestHumanPct, protocol and Streamflow-lock totals. |
| terminalUsage | object|null | – | Which trading terminals the whale cohort trades through (Pro keys). |
| timestamp | string|null | – | ISO time the response was assembled. |
| token | – | – | The address that was scanned (on get_token_scan, the full token metadata object instead). |
| whales | array|null | – | Each whale: address, balance, percentage of supply, attribution label (notable wallet, dev-linked, exchange), txCount24h, recent buys and sells. |
No examples provided.
How do I install the DeFade — Multi-Chain Memecoin Analyzer MCP server?
DeFade — Multi-Chain Memecoin Analyzer is a hosted endpoint at https://api.defade.org/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · api.defade.org
claude mcp add --transport http org-defade-defade 'https://api.defade.org/mcp'
What is the DeFade — Multi-Chain Memecoin Analyzer MCP server?
DeFade — Multi-Chain Memecoin Analyzer is an MCP server listed in the public MCP registry as org.defade/defade. Rug pull risk and on-chain forensics for tokens on Solana and six EVM chains. This page covers its hosted endpoint (https://api.defade.org/mcp).
Is the DeFade — Multi-Chain Memecoin Analyzer MCP server safe to use?
DeFade — Multi-Chain Memecoin Analyzer scores 84 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the DeFade — Multi-Chain Memecoin Analyzer MCP server expose?
DeFade — Multi-Chain Memecoin Analyzer exposes 15 tools: get_token_scan, get_rug_score, get_holders, get_whales, get_liquidity, and 10 more. Their descriptions and schemas cost roughly 6,674 tokens of context every time the server is loaded.
Does the DeFade — Multi-Chain Memecoin Analyzer MCP server require authentication?
Its publisher declares no required credentials for DeFade — Multi-Chain Memecoin Analyzer. We have not been able to confirm that against the live endpoint, and a server can require authorisation without declaring it here.
Is the DeFade — Multi-Chain Memecoin Analyzer MCP server still maintained?
DeFade — Multi-Chain Memecoin Analyzer is still listed in the MCP registry, though our most recent checks did not reach this channel. We last reached this channel on 3 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.