Skip to content
anlyon.devby Anlyon

A.U.G.U.R Foresight · Bundle Forensics

com.augur-trade/foresight-forensicsaugur-trade.comstreamable-httpv3.0.0Scanned

Who is behind a launch: bundles, insiders, airdrops, serial devs. Solana pump.fun + 18 EVM chains.

4 tools: 4 change things.

Tools: 0 delete, 0 irreversible, 4 write, 0 read.
  • Reads private data · 0
  • Reads text others write · 4
  • Can send data out · 0
  • No findings

Anlyon alternative

4 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

4 tools

Changes things 4Claude Code: ask
  • bundle_forensicsWho bundled a Solana pump.fun launch: every block-0 wallet labelled sniper bot / bundle / dev-linked, supply bought and still held, holders who got tokens by transfer, serial-dev c…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Who bundled a Solana pump.fun launch: every block-0 wallet labelled sniper bot / bundle / dev-linked, supply bought and still held, holders who got tokens by transfer, serial-dev check, top-10 concentration, RugCheck — plus a back-tested skip/pass verdict. The rug guard MAD snipers use before every buy. Skip rules were tested on 2,221 real caller calls (held-out: stop-outs 10%→5%, rugs 16%→11%): creator launched another coin in the prior 24 h; top-10 wallets >35%; block-0 wallets that also bundled this creator's earlier launches; block-0 buys >20% of supply. Extra flags: RugCheck danger risks, insider wallets >15%, and >10% held by wallets that never bought on the curve (tokens moved in by transfer, the layered-bundle pattern of launch tools like Proxima). "ok:true" means no red flags were found, not that the coin is safe. When to use: To see WHO bundled a launch and get the skip/pass rug guard MAD snipers use; for a scored launch verdict use launch_scan (on the A.U.G.U.R Foresight · Wallets & Risk server, https://augur-trade.com/hub/mcp/risk). Price: $0.003 per call (10 free/day; after that a payment-required result lists x402 options). Errors: returns isError with a message for invalid input or an upstream failure (not charged).

    Annotations the server declares

    • title: Bundle forensics + rug guard
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • bundler_profileIs this Solana wallet a bundler?Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Is this Solana wallet a bundler? Every pump.fun launch it bought in the first 2 slots over the last 10 days, which creators it keeps bundling for, and whether it is a mass sniper bot or a dev's private bundle wallet. From our block-0 registry of every pump.fun launch (non-creator buys in slots 0–1 after creation). kind: "sniper bot" (≥50 launches in 7 days, buys everything), "dev wallet" (most of its block-0 buys are on one or two creators' coins — a private bundle wallet), "bundler", or "not seen". Use it on wallets bundle_forensics lists, or on any wallet you are about to copy. When to use: To check one wallet from bundle_forensics (sniper bot vs a dev's private bundle wallet); for trading performance use pump_wallet (on the A.U.G.U.R Foresight · Pump & LP server, https://augur-trade.com/hub/mcp/pump). Price: $0.002 per call (10 free/day; after that a payment-required result lists x402 options). Errors: returns isError with a message for invalid input or an upstream failure (not charged).

    Annotations the server declares

    • title: Bundler wallet profile
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • creator_launchesEvery pump.fun coin a Solana wallet created in the last 10 days, how many graduated, and the wallets that bundle its launches again and again (its private bundle crew).Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Every pump.fun coin a Solana wallet created in the last 10 days, how many graduated, and the wallets that bundle its launches again and again (its private bundle crew). Serial launchers (more than one coin a day) are the strongest rug signal in our tests: calls on coins whose creator launched another coin in the prior 24 h averaged −11% vs −5% after costs. Repeat block-0 wallets across a creator's launches are its own bundle wallets. When to use: For a dev's launch count and its repeat bundle crew; for graduation stats use pump_dev (on the A.U.G.U.R Foresight · Pump & LP server, https://augur-trade.com/hub/mcp/pump). Price: $0.002 per call (10 free/day; after that a payment-required result lists x402 options). Errors: returns isError with a message for invalid input or an upstream failure (not charged).

    Annotations the server declares

    • title: Creator launch history + bundles
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • evm_bundle_forensicsWho bundled an EVM token launch (Base, BSC, Ethereum, Arbitrum, Robinhood and 13 more): creation-tx airdrops to fake holders, first-seconds buys, scripted fixed-cadence buying, fre…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Who bundled an EVM token launch (Base, BSC, Ethereum, Arbitrum, Robinhood and 13 more): creation-tx airdrops to fake holders, first-seconds buys, scripted fixed-cadence buying, fresh-wallet and transfer-only holders, dev holdings, exchange-labelled holders, GoPlus contract flags — plus a skip/pass verdict. Replays every ERC-20 Transfer of the token from its first mint on the public RPC, so for young tokens (Base ~4 days, BSC ~6 h of history in budget) holder balances, buys and wallet-to-wallet hand-offs are exact. Launchpads (Four.meme, Uniswap v4 PoolManager, v2/v3 pairs from Dexscreener) are detected; vault/locker contracts that never bought are kept out of the wallet rules, while contracts that DID buy (smart wallets, bundler contracts) count as wallets. Older tokens fall back to GoPlus holders with 527 exchange wallets named. Skip rules: GoPlus honeypot/tax>10%/owner powers; top-10 wallets >35%; first ~2 s of buys >20%; >10% held by wallets that never bought; creation tx airdropping ≥10 wallets or >10%; scripted buying (≥5 buys ≥1% at a regular cadence taking ≥15%); fresh wallets / buyer contracts >15%. Heuristic on EVM (mirrors the back-tested Solana guard); "pass" is not a safety promise. When to use: Bundles and who holds an EVM token launch (Base/BSC first-class); for contract-only flags use evm_token_security (on the A.U.G.U.R Foresight · Wallets & Risk server, https://augur-trade.com/hub/mcp/risk). Price: $0.005 per call (10 free/day; after that a payment-required result lists x402 options). Errors: returns isError with a message for invalid input or an upstream failure (not charged).

    Annotations the server declares

    • title: EVM launch + bundle forensics
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write4
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 3.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http foresight-forensics https://augur-trade.com/foresight/mcp/forensics
claude mcp add --transport http foresight-forensics https://augur-trade.com/foresight/mcp/forensics

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [],
    "ask": [
      "mcp__foresight-forensics__bundle_forensics",
      "mcp__foresight-forensics__bundler_profile",
      "mcp__foresight-forensics__creator_launches",
      "mcp__foresight-forensics__evm_bundle_forensics"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as foresight-forensics. Review it before you use it.

Capability tags behind 4 rules
  • mcp__foresight-forensics__bundle_forensics untrusted-input
  • mcp__foresight-forensics__bundler_profile untrusted-input
  • mcp__foresight-forensics__creator_launches untrusted-input
  • mcp__foresight-forensics__evm_bundle_forensics untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.augur-trade/foresight-forensics/verify?hash=773e4381ddf31250486e15c99ebbe46dd527eee0107e91270b9569226fe318b5" | jq -e '.changed == false'

Pinned hash 773e4381ddf3, from Oct 25, 2026, 05:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.augur-trade/foresight-forensics/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for com.augur-trade/foresight-forensics
[![anlyon.dev](https://anlyon.dev/badge/com.augur-trade/foresight-forensics.svg)](https://anlyon.dev/servers/com.augur-trade/foresight-forensics)

Source: MCP Registry. Synced Oct 25, 2026, 05:17 UTC.