# DeFade — Multi-Chain Memecoin Analyzer (remote · api.defade.org) Rug pull risk and on-chain forensics for tokens on Solana, Ethereum, Base and Robinhood. - Trust score: 72/100 (medium) - Change this week: +2 - Registry status: active - Liveness: live - Owner verified: no - Last scored: 2026-09-20 ## Components - remote · `api.defade.org`: 72/100 (this document), [markdown](https://verifymcp.io/servers/org-defade-defade/api.md), [page](https://verifymcp.io/servers/org-defade-defade/api) ## Channel facts - Endpoint: `https://api.defade.org/mcp` - Transports: `streamable-http` - Auth: `none` - Version: `1.1.7` ## Trust breakdown How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog) Scored 2026-09-20. - **Endpoint Security**: 80/100 - The endpoint's TLS certificate is valid, in date, and uses a strong key. - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. - HTTPS is enforced; there's no plaintext access path. - The HSTS (Strict-Transport-Security) header is present. - DNSSEC check failed: this domain isn't protected by DNSSEC. - **Transport & Reachability**: 100/100 - Verified streamable-http transport via a live MCP handshake. - **Schema Quality & AI Usability**: 63/100 - AI-judged instruction clarity (excellent). - Context-footprint check failed: tool/resource definitions use about 6645 tokens (~443/item across 15 items; 15 tools + 0 resources), over budget; trim descriptions and params. - Usage-examples check failed: none of the tools include examples. - **Stability & Change Management**: 16/100 - Stability check failed: schema churn in the 23 days we've observed: 11 tool removals, 0 breaking changes, 0 auth/transport breaks, 8 additions. - **Tool Coverage**: 100/100 - 100% of tools have a non-trivial description (not blank, and not just the tool's name). - 100% of tool parameters carry a description. - Structured output schemas are declared (100% of tools); any adoption earns full credit. - **Tool Safety**: 100/100 - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured. - We read all 15 captured tool definition(s), and no name or description among them implies an irreversible operation. - An AI judge read all 16 captured unit(s) of tool text and found none that tries to manipulate the model reading it. - **Capabilities**: 60/100 - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. ## Install ### How do I install the DeFade — Multi-Chain Memecoin Analyzer MCP server? DeFade — Multi-Chain Memecoin Analyzer is a hosted endpoint at https://api.defade.org/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation. ### Claude ```bash claude mcp add --transport http org-defade-defade 'https://api.defade.org/mcp' ``` ### Cursor ```json { "mcpServers": { "org-defade-defade": { "url": "https://api.defade.org/mcp" } } } ``` ### VS Code ```json { "servers": { "org-defade-defade": { "type": "http", "url": "https://api.defade.org/mcp" } } } ``` ### Codex ```toml [mcp_servers.org-defade-defade] url = "https://api.defade.org/mcp" ``` ### opencode ```json { "$schema": "https://opencode.ai/config.json", "mcp": { "org-defade-defade": { "type": "remote", "url": "https://api.defade.org/mcp", "enabled": true } } } ``` ### OpenClaw ```bash openclaw mcp add org-defade-defade --url 'https://api.defade.org/mcp' --transport streamable-http ``` ### Hermes ```yaml mcp_servers: org-defade-defade: url: "https://api.defade.org/mcp" ``` ### Netclaw ```json { "McpServers": { "org-defade-defade": { "Transport": "http", "Url": "https://api.defade.org/mcp" } } } ``` ### Vellum ```bash assistant mcp add org-defade-defade -t streamable-http -u 'https://api.defade.org/mcp' ``` ### Other ```json { "mcpServers": { "org-defade-defade": { "type": "http", "url": "https://api.defade.org/mcp" } } } ``` The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs. ## Changelog Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims. ### 2026-09-20 (score 72, +1) No change was recorded against any check on this day. Stability & Change Management went from 12 to 16. ### 2026-09-17 (score 71, +1) No change was recorded against any check on this day. Stability & Change Management went from 2 to 6. ### 2026-09-06 (score 70, 0) - [security] The server rewrote its instructions, which are the text every model session reads - [security] Tool “get_liquidity” rewrote its description, which is the text the model reads - [security] Tool “get_whales” rewrote its description, which is the text the model reads - [security] Tool “get_token_price” rewrote its description, which is the text the model reads - [security] Tool “get_dev_tracker” rewrote its description, which is the text the model reads - [security] Tool “get_fee_fingerprint” rewrote its description, which is the text the model reads - [security] Tool “get_funding_sources” rewrote its description, which is the text the model reads - [security] Tool “get_lookalike_clusters” rewrote its description, which is the text the model reads - [security] Tool “get_token_scan” rewrote its description, which is the text the model reads - [security] Tool “get_wallet_links” rewrote its description, which is the text the model reads - [functional regression] Schema quality: 388 → 443 - [functional] Server version: 1.1.5 → 1.1.7 - [functional] Server version: 1.1.4 → 1.1.5 - [cosmetic] “get_token_price” added an optional parameter “timeframe” - [cosmetic] “get_fee_fingerprint” reworded the description of “chain” ### 2026-09-04 (score 70, 0) - [security regression] Tool “get_bundles” was removed - [security regression] Tool “get_funding_origin” was removed - [security regression] Tool “get_insider_network” was removed - [security regression] Tool “get_snipers” was removed - [security regression] Tool “get_sybil_cluster” was removed - [security] The server rewrote its instructions, which are the text every model session reads - [security] Tool “get_dev_tracker” rewrote its description, which is the text the model reads - [security] Tool “get_fee_fingerprint” rewrote its description, which is the text the model reads - [security] Tool “get_holders” rewrote its description, which is the text the model reads - [security] Tool “get_liquidity” rewrote its description, which is the text the model reads - [security] Tool “get_rug_score” rewrote its description, which is the text the model reads - [security] Tool “get_smart_money” rewrote its description, which is the text the model reads - [security] Tool “get_token_price” rewrote its description, which is the text the model reads - [security] Tool “get_token_scan” rewrote its description, which is the text the model reads - [security] Tool “get_whales” rewrote its description, which is the text the model reads - [functional] Server version: 1.1.2 → 1.1.4 - [functional] New tool “get_funding_sources” - [functional] New tool “get_launch_bundles” - [functional] New tool “get_launch_snipers” - [functional] New tool “get_lookalike_clusters” - [functional] New tool “get_wallet_links” ### 2026-09-03 (score 70, −2) - [security regression] Tool “get_api_usage” was removed - [security regression] Tool “scan_token” was removed - [security] The server rewrote its instructions, which are the text every model session reads - [security] Tool “get_bundles” rewrote its description, which is the text the model reads - [security] Tool “get_dev_tracker” rewrote its description, which is the text the model reads - [security] Tool “get_fee_fingerprint” rewrote its description, which is the text the model reads - [security] Tool “get_funding_origin” rewrote its description, which is the text the model reads - [security] Tool “get_holders” rewrote its description, which is the text the model reads - [security] Tool “get_insider_network” rewrote its description, which is the text the model reads - [security] Tool “get_liquidity” rewrote its description, which is the text the model reads - [security] Tool “get_rug_score” rewrote its description, which is the text the model reads - [security] Tool “get_smart_money” rewrote its description, which is the text the model reads - [security] Tool “get_snipers” rewrote its description, which is the text the model reads - [security] Tool “get_sybil_cluster” rewrote its description, which is the text the model reads - [security] Tool “get_token_price” rewrote its description, which is the text the model reads - [security] Tool “get_whales” rewrote its description, which is the text the model reads - [functional regression] Schema quality: 157 → 360 - [functional improvement] Tool “get_bundles” now declares an output schema - [functional improvement] Tool “get_dev_tracker” now declares an output schema - [functional improvement] Tool “get_fee_fingerprint” now declares an output schema - [functional improvement] Tool “get_funding_origin” now declares an output schema - [functional improvement] Tool “get_holders” now declares an output schema - [functional improvement] Tool “get_insider_network” now declares an output schema - [functional improvement] Tool “get_liquidity” now declares an output schema - [functional improvement] Tool “get_rug_score” now declares an output schema - [functional improvement] Tool “get_smart_money” now declares an output schema - [functional improvement] Tool “get_snipers” now declares an output schema - [functional improvement] Tool “get_sybil_cluster” now declares an output schema - [functional improvement] Tool “get_token_price” now declares an output schema - [functional improvement] Tool “get_whales” now declares an output schema - [functional] First check of Tool coverage: 100 - [functional] Server version: 1.0.1 → 1.1.2 - [functional] New tool “get_token_scan” - [functional] New tool “get_usage” - [cosmetic] “get_bundles” reworded the description of “address” - [cosmetic] “get_bundles” reworded the description of “chain” - [cosmetic] “get_dev_tracker” reworded the description of “address” - [cosmetic] “get_dev_tracker” reworded the description of “chain” - [cosmetic] “get_fee_fingerprint” reworded the description of “address” - [cosmetic] “get_fee_fingerprint” reworded the description of “chain” - [cosmetic] “get_funding_origin” reworded the description of “address” - [cosmetic] “get_funding_origin” reworded the description of “chain” - [cosmetic] “get_holders” reworded the description of “address” - [cosmetic] “get_holders” reworded the description of “chain” - [cosmetic] “get_insider_network” reworded the description of “address” - [cosmetic] “get_insider_network” reworded the description of “chain” - [cosmetic] “get_liquidity” reworded the description of “address” - [cosmetic] “get_liquidity” reworded the description of “chain” - [cosmetic] “get_rug_score” reworded the description of “address” - [cosmetic] “get_rug_score” reworded the description of “chain” - [cosmetic] “get_smart_money” reworded the description of “address” - [cosmetic] “get_smart_money” reworded the description of “chain” - [cosmetic] “get_snipers” reworded the description of “address” - [cosmetic] “get_snipers” reworded the description of “chain” - [cosmetic] “get_sybil_cluster” reworded the description of “address” - [cosmetic] “get_sybil_cluster” reworded the description of “chain” - [cosmetic] “get_token_price” reworded the description of “address” - [cosmetic] “get_token_price” reworded the description of “chain” - [cosmetic] “get_whales” reworded the description of “address” - [cosmetic] “get_whales” reworded the description of “chain” - [cosmetic] Tool “get_bundles” changed its title: Bundle detection → Launch-window bundles - [cosmetic] Tool “get_fee_fingerprint” changed its title: Fee fingerprint → Shared fee-setting fingerprint - [cosmetic] Tool “get_funding_origin” changed its title: Funding origin → Funding provenance - [cosmetic] Tool “get_insider_network” changed its title: Insider network → Proven insider links - [cosmetic] Tool “get_snipers” changed its title: Sniper bots → First-block snipers - [cosmetic] Tool “get_sybil_cluster” changed its title: Sybil clustering → Behavioural sybil clusters ### 2026-09-02 (score 72, −2) - [security regression] Stability: 0.13 → fail - [security regression] A breaking change shipped without a version bump: still 1.0.1 - [security regression] Tool “check_api_usage” was removed - [security regression] Tool “compare_holder_overlap” was removed - [security regression] Tool “get_bundles_pro” was removed - [security regression] Tool “get_socials” was removed - [security regression] Tool “get_trending” was removed - [security] Tool “get_bundles” rewrote its description, which is the text the model reads - [security] Tool “get_dev_tracker” rewrote its description, which is the text the model reads - [security] Tool “get_holders” rewrote its description, which is the text the model reads - [security] Tool “get_insider_network” rewrote its description, which is the text the model reads - [security] Tool “get_rug_score” rewrote its description, which is the text the model reads - [security] Tool “get_smart_money” rewrote its description, which is the text the model reads - [security] Tool “get_token_price” rewrote its description, which is the text the model reads - [functional regression] Schema quality: 138 → 157 - [functional] New tool “get_api_usage” - [cosmetic] Tool “get_bundles” changed its title: Launch bundle detection → Bundle detection ### 2026-09-01 (score 74, +1) - [security] Tool “compare_holder_overlap” rewrote its description, which is the text the model reads - [security] Tool “get_funding_origin” rewrote its description, which is the text the model reads - [security] Tool “get_insider_network” rewrote its description, which is the text the model reads - [security] Tool “get_sybil_cluster” rewrote its description, which is the text the model reads ### 2026-08-31 (score 73, 0) - [functional] Server version: 1.0.0 → 1.0.1 ## MCP tools (15) ### `get_token_scan` (~406 tokens) Scan a token Run a full DeFade scan on one token contract: token metadata, holder distribution, creator history (wallet age, previous token launches) and the headline risk verdict. Start here for any "is this token safe", "is this a rug pull" or "should I buy this" question. Returns risk.score as a SAFETY score where 100 is clean and low numbers are dangerous, with a rating label. For the inverse — a rug pull probability where high means dangerous — call get_rug_score. Not for a single module in isolation (call that module's tool directly), price or market-cap questions (get_token_price), or checking the caller's own quota (get_usage). Arguments: address and chain; one API unit on any chain. Input parameters: - `address` (string, required): The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… - `chain` (string): Chain the token is deployed on: solana (default), ethereum, base, robinhood. Required for any 0x address, because the same contract address can exist on several EVM chains. Omit it for Solana. An uns… Output parameters: - `analyzedAt` (string|null): ISO time of the scan itself. - `creator` (object|null): Deployer wallet: address, walletAgeDays, solBalance, totalTransactions, tokenCreations, recentTokens, riskLevel. - `holders` (object|null): Same body as get_holders: totalHolders, topHolders, concentration, protocolHoldings, lockedSupply, deferredUnlock, bundles. - `poweredBy` (string|null): Always "DeFade.org". - `risk` (object|null): The SAFETY score: score (0-100, 100 is clean), rating, color, flags. Opposite direction from get_rug_score. - `scanCount` (number|null): How many times DeFade has scanned this token: the lifetime figure the rug database shows when the token has a row there (scanWindow "all"), otherwise the last 24h (scanWindow "24h"). - `scanWindow` (string|null): "all" when scanCount is the lifetime rug-database figure, "24h" when it is the last 24 hours only. - `success` (boolean|null): Whether the scan completed. - `timestamp` (string|null): ISO time the response was assembled. - `token` (object|null): Token metadata: name, symbol, mint, supply, decimals, creator, mintAuthority, freezeAuthority, marketCap, liquidity. ### `get_rug_score` (~396 tokens) Rug pull probability Rug pull probability for one token: a 0-100 score where HIGHER MEANS MORE DANGEROUS, a verdict label, and the individual signals that drove it. This is the opposite direction from get_token_scan's safety score. Call this tool ONLY when the user explicitly asks for a rug probability or rug likelihood; every general "is this safe" or "should I buy" question goes to get_token_scan instead. Not for the evidence behind the number — it names the signals but does not list the wallets; for who is behind the risk call get_wallet_links, get_dev_tracker or get_launch_bundles. Arguments: address and chain; one API unit on any chain. Input parameters: - `address` (string, required): The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… - `chain` (string): Chain the token is deployed on: solana (default), ethereum, base, robinhood. Required for any 0x address, because the same contract address can exist on several EVM chains. Omit it for Solana. An uns… Output parameters: - `bundleSubScore` (number|null): The bundle component of the score. - `coverage` (string|null): "full" when the Pro signal set contributed, "free" when only the free signals did — a "free" score has seen less evidence. - `fusion` (object|null): Cross-signal wallet correlation; wallets list is empty on non-Pro keys. - `poweredBy` (string|null): Always "DeFade.org". - `proChecksLocked` (number|null): How many Pro-only checks were withheld. - `rugScore` (number|null): Rug probability 0 (safe) to 100 (critical). HIGHER IS MORE DANGEROUS. - `scoreLabel` (string|null): Null normally. "NEVER BONDED" when the human surfaces print that state instead of the percentage; rugScore is still the number. - `signals` (array|null): Each contributing signal: what fired, its weight and its explanation. - `timestamp` (string|null): ISO time the response was assembled. - `token`: The address that was scanned (on get_token_scan, the full token metadata object instead). - `verdict` (string|null): PROBABLY SAFE (<25), SOME RISK (25+), ELEVATED RISK (45+), HIGH RISK (60+), EXTREME RISK (75+); or a state that overrides the bands: RUGGED / DEAD, ABANDONED / DEAD, NEVER BONDED (a launchpad coin th… ### `get_holders` (~380 tokens) Holder distribution Holder distribution for one token, with liquidity pools, burn addresses, lockers, exchange wallets and contracts classified out, so the top-holder list reflects actual holders. Returns the classified top holders with each wallet's supply share in a single response — no pagination. Use it to answer how concentrated the supply is and whether a few wallets could collapse the chart. Not for what large holders are doing right now (get_whales), whether holders are secretly one actor (get_wallet_links or get_lookalike_clusters), or pool depth and locks (get_liquidity). Arguments: address and chain; one API unit on any chain. Input parameters: - `address` (string, required): The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… - `chain` (string): Chain the token is deployed on: solana (default), ethereum, base, robinhood. Required for any 0x address, because the same contract address can exist on several EVM chains. Omit it for Solana. An uns… Output parameters: - `bundles` (object|null): Shallow bundle detection over the real wallets: detected, bundlePct, groups. - `concentration` (object|null): top5, top10, top20 as percent of supply, counting real wallets only. - `deferredUnlock` (object|null): Supply that unlocks back to the deployer later: pct, unlockDate, cancelablePct. Null when none. - `lockedSupply` (object|null): pct plus a lockers array naming each escrow. - `poweredBy` (string|null): Always "DeFade.org". - `protocolHoldings` (object|null): What was excluded: count and totalPct. - `timestamp` (string|null): ISO time the response was assembled. - `token`: The address that was scanned (on get_token_scan, the full token metadata object instead). - `topHolders` (array|null): Top 20 accounts: rank, address, walletAddress, amount, percentage, solBalance, isProtocol, protocolLabel. - `totalHolders` (number|null): Holder count, estimated from the top accounts. ### `get_whales` (~444 tokens) Whale activity Wallets holding at least 1% of supply once pools, lockers, treasuries and custodial accounts are removed. Each row carries the balance, share of supply, any attribution label (known KOL, dev-linked stash, exchange), the 24-hour transaction count and recent buys and sells; the summary counts dangerous and active whales and gives a whale-risk verdict. One response, no pagination; cached for 15 minutes, so activity figures can lag by that much. A token with nothing above the threshold returns an empty list and largestHumanPct, so the empty state is explainable rather than silent. Use it after get_holders when the question is about who can dump and whether they are already dumping. Not for the full ranked holder list (get_holders), historically profitable wallets (get_smart_money), or the creator's own wallet (get_dev_tracker). Arguments: address and chain; one API unit on any chain. Input parameters: - `address` (string, required): The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… - `chain` (string): Chain the token is deployed on: solana (default), ethereum, base, robinhood. Required for any 0x address, because the same contract address can exist on several EVM chains. Omit it for Solana. An uns… Output parameters: - `poweredBy` (string|null): Always "DeFade.org". - `protocolAccounts` (array|null): Pools, lockers, treasuries and custodial accounts held out of the whale list, named. - `summary` (object|null): totalWhales, totalWhalePct, dangerWhales, activeWhales, whaleRisk, whaleThreshold, largestHumanPct, protocol and Streamflow-lock totals. - `terminalUsage` (object|null): Which trading terminals the whale cohort trades through (Pro keys). - `timestamp` (string|null): ISO time the response was assembled. - `token`: The address that was scanned (on get_token_scan, the full token metadata object instead). - `whales` (array|null): Each whale: address, balance, percentage of supply, attribution label (notable wallet, dev-linked, exchange), txCount24h, recent buys and sells. ### `get_liquidity` (~495 tokens) Liquidity analysis Liquidity pool analysis for one token: which DEX holds the deepest pool, its depth in USD, and whether the LP tokens are burned, locked or still in someone's hands. lpStatus is the verdict — LP BURNED, LP LOCKED, LP UNLOCKED, PARTIALLY BURNED, LP NOT LOCKABLE, BONDING CURVE (still on a launchpad curve, no pool yet) or NO LP FOUND, with combinations spelled out — and lpBurnPct, lpLockPct and poolLocks carry the evidence. Use it to answer whether liquidity is locked, how deep it is, and whether the position could be pulled: LP UNLOCKED means it can be pulled at any time. Cached for about two minutes. A token with no pool returns empty liquidity data, which is itself a warning on a token that is trading. Not for price or volume (get_token_price), market cap (get_token_scan) or holder concentration (get_holders). Arguments: address and chain — pools live per chain, so a 0x address needs the chain it trades on, and a Base pool is not found under ethereum; one API unit on any chain. Input parameters: - `address` (string, required): The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… - `chain` (string): Chain the token is deployed on: solana (default), ethereum, base, robinhood. Required for any 0x address, because the same contract address can exist on several EVM chains. Omit it for Solana. An uns… Output parameters: - `dex` (string|null): Which DEX holds the deepest pool. - `lpBurnPct` (number|null): Percent of LP tokens burned; lpLockPct is the percent locked. - `lpStatus` (string|null): Headline pool verdict: LP BURNED, LP LOCKED, LP UNLOCKED, PARTIALLY BURNED, LP NOT LOCKABLE, BONDING CURVE, NO LP FOUND, or a spelled-out combination. - `poolLocks` (array|null): Per-pool lock detail with lpLockable and an lpNote in words. - `poweredBy` (string|null): Always "DeFade.org". - `risk` (string|null): Liquidity risk label; lpEvidence carries the on-chain evidence behind it. - `timestamp` (string|null): ISO time the response was assembled. - `token`: The address that was scanned (on get_token_scan, the full token metadata object instead). - `totalLiquidityUsd` (number|null): Combined USD depth across pools; pools lists them and poolCount counts them. ### `get_launch_bundles` (~375 tokens) Launch-window bundles Bundle detection for one token: coordinated buys in the launch window plus delayed sweeps, accounted on peak net exposure rather than raw buy count, so wallets that bought and flipped are not counted as holders. Heavy bundling that is still held is one of the strongest rug predictors. Use it for any "was this launch bundled" question. Not for lone fast buyers with no coordination (get_launch_snipers), clusters that formed after launch (get_lookalike_clusters), or the creator's own selling (get_dev_tracker). Arguments: address and chain; one API unit on any chain. Input parameters: - `address` (string, required): The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… - `chain` (string): Chain the token is deployed on: solana (default), ethereum, base, robinhood. Required for any 0x address, because the same contract address can exist on several EVM chains. Omit it for Solana. An uns… Output parameters: - `bundles` (array|null): Each bundle: its wallets, what they spent, what they still hold, how they were funded. - `hiddenBundleCount` (number|null): Bundles the shallow detector does not see. - `poweredBy` (string|null): Always "DeFade.org". - `summary` (object|null): Totals across detected bundles, accounted on peak net exposure. - `timestamp` (string|null): ISO time the response was assembled. - `token`: The address that was scanned (on get_token_scan, the full token metadata object instead). ### `get_launch_snipers` (~417 tokens) First-block snipers Bots that bought in the first block or first seconds of this token's launch, and whether they are connected to the deployer. The window is the first 120 seconds after the first transaction; at most 30 rows are returned and totalEarlyBuyers carries the full count. Migration-crank MEV bots are excluded and named rather than silently dropped. Check reachedGenesis: when false the walk did not reach the true first transaction, the result is partial, and it is cached for only 10 minutes instead of 2 hours. Use it to tell an organic launch from a pre-arranged one. Not for coordinated multi-wallet launch buying (get_launch_bundles) or the deployer's funding of other wallets (get_wallet_links). Arguments: address and chain; one API unit on any chain. Input parameters: - `address` (string, required): The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… - `chain` (string): Chain the token is deployed on: solana (default), ethereum, base, robinhood. Required for any 0x address, because the same contract address can exist on several EVM chains. Omit it for Solana. An uns… Output parameters: - `migrationCrankersExcluded` (array|null): Migration-crank MEV bots filtered out as infrastructure, named. - `poweredBy` (string|null): Always "DeFade.org". - `reachedGenesis` (boolean|null): Whether the walk reached the true first transaction. When false, partial is true and small snipers may be missing. - `snipers` (array|null): Wallets that bought inside the launch window, capped at 30 rows. - `stats` (object|null): Cohort totals for the window. - `terminals` (object|null): Trading terminals the launch cohort came through; activeTerminals is who trades it now. - `timestamp` (string|null): ISO time the response was assembled. - `token`: The address that was scanned (on get_token_scan, the full token metadata object instead). - `totalEarlyBuyers` (number|null): How many were found in total; windowSeconds and firstTxTime describe the window. ### `get_wallet_links` (~487 tokens) Proven insider links The graph of proven on-chain links between wallets around one token — who funded whom, who transferred to whom, and coordinated timing — typically the deployer's supply fanned out to look like organic demand. Use it when the holder list looks distributed and you want to know whether it really is. This is the hard-evidence member of the four "who is really behind this token" tools — a link counts only when a transfer or a shared funder is on chain: wallets that merely behave alike are get_lookalike_clusters, where the money first entered the chain is get_funding_sources, and identical bot fee settings are get_fee_fingerprint. Scope: the top 25 real holders are traced (pools, lockers and exchanges excluded), connections is capped at 50 rows with connectionsTotal as the full count, and an empty graph means no on-chain link was found among them — not proof they are independent, so follow up with get_lookalike_clusters. Not for the creator wallet's own sales and transfers (get_dev_tracker) or for market data of any kind. Arguments: address and chain; one API unit on any chain. Input parameters: - `address` (string, required): The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… - `chain` (string): Chain the token is deployed on: solana (default), ethereum, base, robinhood. Required for any 0x address, because the same contract address can exist on several EVM chains. Omit it for Solana. An uns… Output parameters: - `connections` (array|null): Wallet-to-wallet transfers that tie the cohort together; connectionsTotal is the count before truncation. - `insiderCount` (number|null): Wallets in the connected cohort; insiderHoldingPct is the supply they hold. - `locked` (boolean|null): True on non-Pro keys, in which case only reason, upgradeUrl and message are present. - `nodes` (array|null): Graph nodes; clusters groups them. - `poweredBy` (string|null): Always "DeFade.org". - `timestamp` (string|null): ISO time the response was assembled. - `token`: The address that was scanned (on get_token_scan, the full token metadata object instead). - `totalTransfers` (number|null): Transfers behind the graph, moving transferredPct of supply. - `walletConnections` (object|null): Per-wallet connection counts. ### `get_smart_money` (~383 tokens) Smart money Wallets with a track record of profitable entries that are holding or trading this token, classified from their historical trade win rates — a "verified" smart-money tag requires a known win rate of 50% or better. Computed live from the current holder set and cached for about five minutes. Use it for the bullish side of a scan: who informed is in, and when they got in. Not for risk assessment — informed wallets present never offsets a rug signal, and a clean result is not a buy signal — and not for wallet size (get_whales). Arguments: address and chain; one API unit on any chain. Input parameters: - `address` (string, required): The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… - `chain` (string): Chain the token is deployed on: solana (default), ethereum, base, robinhood. Required for any 0x address, because the same contract address can exist on several EVM chains. Omit it for Solana. An uns… Output parameters: - `activeBuys` (array|null): Other tokens the smart wallets are currently buying. - `poweredBy` (string|null): Always "DeFade.org". - `summary` (object|null): analyzed, smartMoneyCount, verifiedCount, experiencedCount, activeTraderCount, retailCount, smartMoneyPct, avgWinRate, signal. - `timestamp` (string|null): ISO time the response was assembled. - `token`: The address that was scanned (on get_token_scan, the full token metadata object instead). - `wallets` (array|null): Profiled holders, each classified smart money, verified, experienced, active trader or retail, with win rate. ### `get_dev_tracker` (~473 tokens) Dev wallet tracking What the token's creator has done with their supply: the share they still hold, what left through sales versus transfers, and where the transfers went. Read the state carefully: still holding is neutral, a dev who simply sold out is statusColor gray — the standard launch pattern, not a rug — fully exited on a fresh token is a warning, and transferred out to fresh wallets (red) is the single strongest rug signal DeFade tracks. The creator is the wallet that created the mint on Solana and the contract deployer on EVM chains; creatorSource says how it was identified, and creatorInferred true means it may be a launchpad authority rather than a person, so weigh the verdict accordingly. Not for wallets other than the creator (get_whales, get_wallet_links); the creator's earlier launches are already served by get_token_scan's creator block (tokenCreations, recentTokens). Arguments: address and chain — the deployer is read from the contract creation on that chain, so a 0x address needs its chain; one API unit on any chain. Input parameters: - `address` (string, required): The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… - `chain` (string): Chain the token is deployed on: solana (default), ethereum, base, robinhood. Required for any 0x address, because the same contract address can exist on several EVM chains. Omit it for Solana. An uns… Output parameters: - `creatorSource` (string|null): How the dev wallet was identified; creatorInferred is true when it may be a launchpad authority rather than a person. - `currentHoldingPct` (number|null): Percent of supply the dev holds now. - `lastActivity` (number|null): Unix seconds of the dev's most recent move of this token. - `poweredBy` (string|null): Always "DeFade.org". - `recentSells` (array|null): Transactions behind each bucket, newest first, capped. - `status` (string|null): One-line verdict: STILL HOLDING, PARTIAL EXIT, FULLY EXITED, TRANSFERRED OUT, SOLD & TRANSFERRED, DISTRIBUTED, LOCKED and similar. - `statusColor` (string|null): green, yellow, gray or red. A dev selling out is gray: the standard launch pattern, not a rug. - `timestamp` (string|null): ISO time the response was assembled. - `token`: The address that was scanned (on get_token_scan, the full token metadata object instead). - `totalMintedPct` (number|null): Genesis allocation as percent of supply; totalBoughtPct, totalSoldPct, totalTransferredPct, totalLockedPct, totalLiquidityPct alongside. - `transferRecipientAnalysis` (array|null): What large recipients did with the tokens: address, amountPct, stillHeldPct, verdict. - `transferRecipients` (number|null): Distinct wallets that received a transfer. ### `get_funding_sources` (~505 tokens) Funding provenance Multi-hop tracing of where the money behind this token's key wallets actually came from, walking each funding chain back and tiering the source by whether it is a KYC'd exchange. Use it to test whether several "unrelated" holders share one funding source. It answers provenance only — money in, one dimension: it does not build the wallet-to-wallet transfer graph (get_wallet_links), group look-alike behaviour (get_lookalike_clusters), or match shared bot fee settings (get_fee_fingerprint). Read coveragePct before the origins: it is the share of supply that could be attributed, the remainder (unknownCount wallets) could not be traced and is not evidence either way, and dexPct and bridgedPct are real states rather than attributions. Results are cached for 30 minutes (computedAt, fromCache). Not for the creator's own activity (get_dev_tracker) or launch-window buying (get_launch_bundles, get_launch_snipers). Arguments: address and chain — a 0x address needs its chain; on an EVM chain this call costs 5 API units instead of 1, because the trace runs against paid indexers, so check get_usage before running it across many tokens. Input parameters: - `address` (string, required): The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… - `chain` (string): Chain the token is deployed on: solana (default), ethereum, base, robinhood. Required for any 0x address, because the same contract address can exist on several EVM chains. Omit it for Solana. An uns… Output parameters: - `computedAt` (string|null): When this was computed; fromCache says whether it was served from a stored result. - `coveragePct` (number|null): Share of supply attributed to an origin; dexPct and bridgedPct are real states but not attribution. - `origins` (array|null): Where holder supply was funded from, as { name, share }, biggest first. - `poweredBy` (string|null): Always "DeFade.org". - `risk` (object|null): Verdict with label and severity. - `tiers` (array|null): The same supply grouped by certainty tier, as { tier, share }. - `timestamp` (string|null): ISO time the response was assembled. - `token`: The address that was scanned (on get_token_scan, the full token metadata object instead). - `walletCount` (number|null): Wallets resolved, with resolvedCount and unknownCount. ### `get_lookalike_clusters` (~404 tokens) Behavioural sybil clusters Clusters of wallets around one token that behave as a single actor — buys sized and timed alike so demand looks organic — even when no transfer or funding trail connects them. That behavioural inference is what separates it from get_wallet_links, which only reports proven links. Use it when supply looks distributed across many small wallets and the insider graph comes back clean; corroborate with get_fee_fingerprint on Solana. Not for proven transfer links (get_wallet_links), the funding source behind the wallets (get_funding_sources), or launch-window coordination (get_launch_bundles). Arguments: address and chain; on an EVM chain this call costs 5 API units instead of 1, because the trace runs against paid indexers. Input parameters: - `address` (string, required): The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… - `chain` (string): Chain the token is deployed on: solana (default), ethereum, base, robinhood. Required for any 0x address, because the same contract address can exist on several EVM chains. Omit it for Solana. An uns… Output parameters: - `bands` (array|null): Wallet clusters banded by how strongly they look like one operator. - `computedAt` (string|null): When this was computed; fromCache says whether it was served from a stored result. - `poweredBy` (string|null): Always "DeFade.org". - `risk` (object|null): Verdict for the token with label and severity. - `stats` (object|null): Totals across the bands: wallets clustered and the supply they hold. - `timestamp` (string|null): ISO time the response was assembled. - `token`: The address that was scanned (on get_token_scan, the full token metadata object instead). ### `get_fee_fingerprint` (~424 tokens) Shared fee-setting fingerprint Wallets whose transactions pin an identical compute-unit price or Jito tip — one operator's bot settings showing up across every wallet it drives. This is the shared-CONFIGURATION member of the "who is really behind this token" family (proven transfers: get_wallet_links; funding origin: get_funding_sources; behavioural twins: get_lookalike_clusters), not a timing link: it never proves bundling, and two wallets can match days apart. Use it to corroborate get_lookalike_clusters, and to catch the operator who sold their launch wallets and re-entered through fresh ones; read a match as corroboration, never as proof of coordinated buying. Groups are strongest first; pending true means no bundle scan has run for this token yet, so nothing has looked rather than nothing was found. Arguments: address, and chain only as solana (or omitted) — the fee settings it reads exist only on Solana, so any other chain is refused before a request is spent. One API unit. Input parameters: - `address` (string, required): The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… - `chain` (string): Only solana: this tool has no implementation on other chains, and any other value is refused before a request is spent. Omit it for solana. Output parameters: - `computedAt` (string|null): When this result was read. - `excluded` (array|null): Fee values suppressed as client defaults, with the wallet count each covered. - `groups` (array|null): One entry per fee setting shared by two or more wallets, strongest first: wallets, supplyPct bought, confidence. - `pending` (boolean|null): True when no bundle scan has run for this token yet: nothing has looked, not nothing was found. - `poweredBy` (string|null): Always "DeFade.org". - `stats` (object|null): Wallets seen, how many carried a readable fee setting, how many were linked, how many set none. - `timestamp` (string|null): ISO time the response was assembled. - `token`: The address that was scanned (on get_token_scan, the full token metadata object instead). ### `get_token_price` (~668 tokens) Token price Price history for one token as OHLCV candles, plus the latest price, the window's high and low with their timestamps, and the percent change across the window — prices in USD (the *Usd fields), volume as the market source quotes it. Aggregated from DEX market sources and cached for about a minute. Intervals with no trades are omitted rather than zero-filled, so consecutive candles can sit more than one step apart. The optional timeframe argument sets the candle size and with it how far back the window reaches: 15m (the default) covers about the last 2.5 days, 1H about 10 days, 4H about 40 days and 1D up to a year of daily candles, back to the token's first trade if it is younger; there is no start or end argument, the size fixes the window. Use 1D for "what did it peak at", "how far is it down from the top" or any price history question; use the default for the market context around a risk verdict. A token with no liquidity pool returns candles: [] and totalCandles: 0 rather than an error. Not for risk of any kind — market data carries no forensic signal — and not for pool depth or lock status (get_liquidity) or market cap (get_token_scan's token block). Arguments: address, chain and timeframe — a 0x address needs its chain; one API unit on any chain regardless of timeframe. Input parameters: - `address` (string, required): The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters… - `chain` (string): Chain the token is deployed on: solana (default), ethereum, base, robinhood. Required for any 0x address, because the same contract address can exist on several EVM chains. Omit it for Solana. An uns… - `timeframe` (string): Candle size, which also sets the window: 1m ≈ last 4 hours, 5m ≈ 20 hours, 15m ≈ 2.5 days (default), 30m ≈ 5 days, 1H ≈ 10 days, 4H ≈ 40 days, 1D ≈ up to 365 days. A token younger than the window ret… Output parameters: - `candles` (array|null): OHLCV candles, oldest first: ts (ms), open, high, low, close, volume and *Usd values. - `current` (object|null): Latest close as current.priceUsd. - `high` (object|null): Window high as priceUsd plus ts; low is the same shape. - `poweredBy` (string|null): Always "DeFade.org". - `priceChange` (number|null): Percent change from the first candle to the last. Null when it cannot be computed. - `timestamp` (string|null): ISO time the response was assembled. - `token`: The address that was scanned (on get_token_scan, the full token metadata object instead). - `totalCandles` (number|null): Number of candles; a token with no chart data answers 0. ### `get_usage` (~75 tokens) API usage Report the calling API key's plan, rate limits and how much of its monthly allowance is left. Takes no arguments. Use it when a call fails on quota, or when the user asks what their DeFade plan includes. Not for anything about a token — every other tool takes an address; this one reports on the key itself. Output parameters: - `credits` (object|null): Overage: balance, overageEnabled, costPerRequest. - `limits` (object|null): perMinute, perDay, perMonth; perMonth is null on grandfathered keys. - `tier` (string|null): The tier this key is on. web_mcp is the connector key included with a DeFade Pro web subscription; its allowance is the plan's monthly scans, reported in plan/limits.perMonth. - `units` (object|null): How metering works: one request is one unit except the heaviest EVM modules, listed in heavyOnEvm with heavyCost. - `usage` (object|null): today, total, thisPeriod, remainingThisPeriod, periodResetsAt. ## Diagnostics Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/org-defade-defade/api#diagnostics ## Score history - 2026-09-20: 72 - 2026-09-19: 71 - 2026-09-18: 71 - 2026-09-17: 71 - 2026-09-16: 70 - 2026-09-15: 70 - 2026-09-14: 70 - 2026-09-13: 70 - 2026-09-12: 70 - 2026-09-11: 70 - 2026-09-10: 70 - 2026-09-09: 70 - 2026-09-08: 70 - 2026-09-07: 70 - 2026-09-06: 70 - 2026-09-05: 70 - 2026-09-04: 70 - 2026-09-03: 70 - 2026-09-02: 72 - 2026-09-01: 74 - 2026-08-31: 73 - 2026-08-30: 73 - 2026-08-29: 72 - 2026-08-28: 72 ## Common questions ### What is the DeFade — Multi-Chain Memecoin Analyzer MCP server? DeFade — Multi-Chain Memecoin Analyzer is an MCP server listed in the public MCP registry as org.defade/defade. Rug pull risk and on-chain forensics for tokens on Solana, Ethereum, Base and Robinhood. This page covers its hosted endpoint (https://api.defade.org/mcp). ### Is the DeFade — Multi-Chain Memecoin Analyzer MCP server safe to use? DeFade — Multi-Chain Memecoin Analyzer scores 72 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm. ### What tools does the DeFade — Multi-Chain Memecoin Analyzer MCP server expose? DeFade — Multi-Chain Memecoin Analyzer exposes 15 tools: get_token_scan, get_rug_score, get_holders, get_whales, get_liquidity, and 10 more. Their descriptions and schemas cost roughly 6,332 tokens of context every time the server is loaded. ### Does the DeFade — Multi-Chain Memecoin Analyzer MCP server require authentication? No. We connected to DeFade — Multi-Chain Memecoin Analyzer without credentials and it answered, so anything it exposes is reachable by anyone who knows the address. ### Is the DeFade — Multi-Chain Memecoin Analyzer MCP server still maintained? DeFade — Multi-Chain Memecoin Analyzer is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced. ## Links - Remote endpoint: https://api.defade.org/mcp - Website: https://defade.org/ - Changelog RSS feed: https://verifymcp.io/servers/org-defade-defade/api.xml - Changelog JSON feed: https://verifymcp.io/servers/org-defade-defade/api.json - HTML version of this page: https://verifymcp.io/servers/org-defade-defade/api