Skip to content

DeFade — Multi-Chain Memecoin Analyzer

by defade.org · remote · no sign-in to list tools · v1.1.8 · published by org.defade

Rug pull risk and on-chain forensics for tokens on Solana and six EVM chains.

Changes · 1

15 tools: 1 change things and 14 only read.

Scanned Oct 21, 2026

16 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http defade https://api.defade.org/mcp

Findings

Matches of fixed checks, with the text they matched.

16 warn
  • The input schema at properties.address.description contains a 44-character base64 string.

    Matched text

    inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

    What this check looks for
  • The server marks "get_token_scan" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "get_token_scan" says "get": a word for reading.

    What this check looks for
  • The input schema at properties.address.description contains a 44-character base64 string.

    Matched text

    inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

    What this check looks for
  • The input schema at properties.address.description contains a 44-character base64 string.

    Matched text

    inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

    What this check looks for
  • The input schema at properties.address.description contains a 44-character base64 string.

    Matched text

    inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

    What this check looks for
  • The input schema at properties.address.description contains a 44-character base64 string.

    Matched text

    inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

    What this check looks for
Show 10 more findings
  • The input schema at properties.address.description contains a 44-character base64 string.

    Matched text

    inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

    What this check looks for
  • The input schema at properties.address.description contains a 44-character base64 string.

    Matched text

    inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

    What this check looks for
  • The input schema at properties.address.description contains a 44-character base64 string.

    Matched text

    inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

    What this check looks for
  • The input schema at properties.address.description contains a 44-character base64 string.

    Matched text

    inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

    What this check looks for
  • The input schema at properties.address.description contains a 44-character base64 string.

    Matched text

    inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

    What this check looks for
  • The input schema at properties.address.description contains a 44-character base64 string.

    Matched text

    inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

    What this check looks for
  • The input schema at properties.address.description contains a 44-character base64 string.

    Matched text

    inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

    What this check looks for
  • The input schema at properties.address.description contains a 44-character base64 string.

    Matched text

    inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

    What this check looks for
  • The input schema at properties.address.description contains a 44-character base64 string.

    Matched text

    inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

    What this check looks for
  • The description contains "every other tool", wording about other tools or servers.

    Matched text

    description: "...ludes. Not for anything about a token — every other tool takes an address; this one reports on t..."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

15 tools

Changes things 1Claude Code: ask
  • get_token_scanRun a full DeFade scan on one token contract.2 findings

    Why it is in this group

    • The name "get_token_scan" says "get": a word for reading.
    • The description's first verb is "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The input schema at properties.address.description contains a 44-character base64 string.

      Matched text

      inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

      What this check looks for
    • Warn

      The server marks "get_token_scan" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "get_token_scan" says "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Run a full DeFade scan on one token contract. On Solana: token metadata, holder distribution, creator history (wallet age, previous token launches) and the headline risk verdict. On an EVM chain: the contract and market read only (token metadata with the owner and the mint, blacklist, whitelist and proxy flags, market, pairs and warnings), with no holders, creator or score; call get_rug_score there for the verdict. Start here for any "is this token safe", "is this a rug pull" or "should I buy this" question, then call get_rug_score for the verdict: the safety score here weighs only holders, creator and authorities. On Solana returns risk.score as a SAFETY score where 100 is clean and low numbers are dangerous, with a rating label. For the inverse — a rug pull probability where high means dangerous — call get_rug_score. Not for a single module in isolation (call that module's tool directly), price or market-cap questions (get_token_price), or checking the caller's own quota (get_usage). Arguments: address and chain; one API unit on any chain.

    Annotations the server declares

    • title: Scan a token
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 14Claude Code: allow
  • get_dev_trackerWhat the token's creator has done with their supply: the share they still hold, what left through sales versus transfers, and where the transfers went.1 finding

    Why it is in this group

    • The name "get_dev_tracker" says "get": a word for reading.

    Findings

    • Warn

      The input schema at properties.address.description contains a 44-character base64 string.

      Matched text

      inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

      What this check looks for
    Description, as the server wrote it
    What the token's creator has done with their supply: the share they still hold, what left through sales versus transfers, and where the transfers went. Read the state carefully: still holding is neutral, a dev who simply sold out is statusColor gray — the standard launch pattern, not a rug — fully exited on a fresh token is a warning, and transferred out to fresh wallets (red) is the single strongest rug signal DeFade tracks. The creator is the wallet that created the mint on Solana and the contract deployer on EVM chains; creatorSource says how it was identified, and creatorInferred true means it may be a launchpad authority rather than a person, so weigh the verdict accordingly. Not for wallets other than the creator (get_whales, get_wallet_links); the creator's earlier launches are already served by get_token_scan's creator block (tokenCreations, recentTokens). Arguments: address and chain — the deployer is read from the contract creation on that chain, so a 0x address needs its chain; one API unit on any chain.

    Annotations the server declares

    • title: Dev wallet tracking
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_fee_fingerprintWallets whose transactions pin an identical fee setting — compute-unit price or Jito tip on Solana, priority fee or legacy gas price on EVM chains — one operator's bot settings sho…1 finding

    Why it is in this group

    • The name "get_fee_fingerprint" says "get": a word for reading.

    Findings

    • Warn

      The input schema at properties.address.description contains a 44-character base64 string.

      Matched text

      inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

      What this check looks for
    Description, as the server wrote it
    Wallets whose transactions pin an identical fee setting — compute-unit price or Jito tip on Solana, priority fee or legacy gas price on EVM chains — one operator's bot settings showing up across every wallet it drives. This is the shared-CONFIGURATION member of the "who is really behind this token" family (proven transfers: get_wallet_links; funding origin: get_funding_sources; behavioural twins: get_lookalike_clusters), not a timing link: it never proves bundling, and two wallets can match days apart. Use it to corroborate get_lookalike_clusters, and to catch the operator who sold their launch wallets and re-entered through fresh ones; read a match as corroboration, never as proof of coordinated buying. Groups are strongest first; pending true means no bundle scan has run for this token yet, so nothing has looked rather than nothing was found. Arguments: address and chain; one API unit on any chain, because it reads what the bundle scan already computed.

    Annotations the server declares

    • title: Shared fee-setting fingerprint
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_funding_sourcesMulti-hop tracing of where the money behind this token's key wallets actually came from, walking each funding chain back and tiering the source by whether it is a KYC'd exchange.1 finding

    Why it is in this group

    • The name "get_funding_sources" says "get": a word for reading.

    Findings

    • Warn

      The input schema at properties.address.description contains a 44-character base64 string.

      Matched text

      inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

      What this check looks for
    Description, as the server wrote it
    Multi-hop tracing of where the money behind this token's key wallets actually came from, walking each funding chain back and tiering the source by whether it is a KYC'd exchange. Use it to test whether several "unrelated" holders share one funding source. It answers provenance only — money in, one dimension: it does not build the wallet-to-wallet transfer graph (get_wallet_links), group look-alike behaviour (get_lookalike_clusters), or match shared bot fee settings (get_fee_fingerprint). Read coveragePct before the origins: it is the share of supply that could be attributed, the remainder (unknownCount wallets) could not be traced and is not evidence either way, and dexPct and bridgedPct are real states rather than attributions. Results are cached for 30 minutes (computedAt, fromCache). Not for the creator's own activity (get_dev_tracker) or launch-window buying (get_launch_bundles, get_launch_snipers). Arguments: address and chain — a 0x address needs its chain; on an EVM chain this call costs 5 API units instead of 1, because the trace runs against paid indexers, so check get_usage before running it across many tokens.

    Annotations the server declares

    • title: Funding provenance
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_holdersHolder distribution for one token, with liquidity pools, burn addresses, lockers, exchange wallets and contracts classified out, so the top-holder list reflects actual holders.1 finding

    Why it is in this group

    • The name "get_holders" says "get": a word for reading.

    Findings

    • Warn

      The input schema at properties.address.description contains a 44-character base64 string.

      Matched text

      inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

      What this check looks for
    Description, as the server wrote it
    Holder distribution for one token, with liquidity pools, burn addresses, lockers, exchange wallets and contracts classified out, so the top-holder list reflects actual holders. Returns the classified top holders with each wallet's supply share in a single response — no pagination. Use it to answer how concentrated the supply is and whether a few wallets could collapse the chart. Not for what large holders are doing right now (get_whales), whether holders are secretly one actor (get_wallet_links or get_lookalike_clusters), or pool depth and locks (get_liquidity). Arguments: address and chain; one API unit on any chain.

    Annotations the server declares

    • title: Holder distribution
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_launch_bundlesBundle detection for one token: coordinated buys in the launch window plus delayed sweeps, accounted on peak net exposure rather than raw buy count, so wallets that bought and flip…1 finding

    Why it is in this group

    • The name "get_launch_bundles" says "get": a word for reading.

    Findings

    • Warn

      The input schema at properties.address.description contains a 44-character base64 string.

      Matched text

      inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

      What this check looks for
    Description, as the server wrote it
    Bundle detection for one token: coordinated buys in the launch window plus delayed sweeps, accounted on peak net exposure rather than raw buy count, so wallets that bought and flipped are not counted as holders. Heavy bundling that is still held is one of the strongest rug predictors. Use it for any "was this launch bundled" question. Not for lone fast buyers with no coordination (get_launch_snipers), clusters that formed after launch (get_lookalike_clusters), or the creator's own selling (get_dev_tracker). Arguments: address and chain; one API unit on any chain.

    Annotations the server declares

    • title: Launch-window bundles
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_launch_snipersBots that bought in the first block or first seconds of this token's launch, and whether they are connected to the deployer.1 finding

    Why it is in this group

    • The name "get_launch_snipers" says "get": a word for reading.

    Findings

    • Warn

      The input schema at properties.address.description contains a 44-character base64 string.

      Matched text

      inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

      What this check looks for
    Description, as the server wrote it
    Bots that bought in the first block or first seconds of this token's launch, and whether they are connected to the deployer. The window is the first 120 seconds after the first transaction; at most 30 rows are returned and totalEarlyBuyers carries the full count. Migration-crank MEV bots are excluded and named rather than silently dropped. Check reachedGenesis: when false the walk did not reach the true first transaction, the result is partial, and it is cached for an hour instead of two. Use it to tell an organic launch from a pre-arranged one. Not for coordinated multi-wallet launch buying (get_launch_bundles) or the deployer's funding of other wallets (get_wallet_links). Arguments: address and chain; one API unit on any chain.

    Annotations the server declares

    • title: First-block snipers
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_liquidityLiquidity pool analysis for one token: which DEX holds the deepest pool, its depth in USD, and whether the LP tokens are burned, locked or still in someone's hands.1 finding

    Why it is in this group

    • The name "get_liquidity" says "get": a word for reading.

    Findings

    • Warn

      The input schema at properties.address.description contains a 44-character base64 string.

      Matched text

      inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

      What this check looks for
    Description, as the server wrote it
    Liquidity pool analysis for one token: which DEX holds the deepest pool, its depth in USD, and whether the LP tokens are burned, locked or still in someone's hands. lpStatus is the verdict — LP BURNED, LP LOCKED, LP UNLOCKED, PARTIALLY BURNED, LP NOT LOCKABLE, BONDING CURVE (still on a launchpad curve, no pool yet) or NO LP FOUND, with combinations spelled out — and lpBurnPct, lpLockPct and poolLocks carry the evidence. Use it to answer whether liquidity is locked, how deep it is, and whether the position could be pulled: LP UNLOCKED means it can be pulled at any time. Cached for about two minutes. A token with no pool returns empty liquidity data, which is itself a warning on a token that is trading. Not for price or volume (get_token_price), market cap (get_token_scan) or holder concentration (get_holders). Arguments: address and chain — pools live per chain, so a 0x address needs the chain it trades on, and a Base pool is not found under ethereum; one API unit on any chain.

    Annotations the server declares

    • title: Liquidity analysis
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_lookalike_clustersClusters of wallets around one token that behave as a single actor — buys sized and timed alike so demand looks organic — even when no transfer or funding trail connects them.1 finding

    Why it is in this group

    • The name "get_lookalike_clusters" says "get": a word for reading.

    Findings

    • Warn

      The input schema at properties.address.description contains a 44-character base64 string.

      Matched text

      inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

      What this check looks for
    Description, as the server wrote it
    Clusters of wallets around one token that behave as a single actor — buys sized and timed alike so demand looks organic — even when no transfer or funding trail connects them. That behavioural inference is what separates it from get_wallet_links, which only reports proven links. Use it when supply looks distributed across many small wallets and the insider graph comes back clean; corroborate with get_fee_fingerprint. Not for proven transfer links (get_wallet_links), the funding source behind the wallets (get_funding_sources), or launch-window coordination (get_launch_bundles). Arguments: address and chain; on an EVM chain this call costs 5 API units instead of 1, because the trace runs against paid indexers.

    Annotations the server declares

    • title: Behavioural sybil clusters
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_rug_scoreRug pull probability for one token: a 0-100 score where HIGHER MEANS MORE DANGEROUS, a verdict label, and the individual signals that drove it.1 finding

    Why it is in this group

    • The name "get_rug_score" says "get": a word for reading.

    Findings

    • Warn

      The input schema at properties.address.description contains a 44-character base64 string.

      Matched text

      inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

      What this check looks for
    Description, as the server wrote it
    Rug pull probability for one token: a 0-100 score where HIGHER MEANS MORE DANGEROUS, a verdict label, and the individual signals that drove it. This is the opposite direction from get_token_scan's safety score. This is the verdict the DeFade website shows: call it, after get_token_scan, for every "is this safe", "is this a rug" or "should I buy" question, on every chain (on an EVM chain get_token_scan carries no score at all). When complete is false the score is partial: say so, and call again for the rest. Not for the evidence behind the number — it names the signals but does not list the wallets; for who is behind the risk call get_wallet_links, get_dev_tracker or get_launch_bundles. Arguments: address and chain; one API unit on Solana, five on an EVM chain, because there the score reads every module first — check get_usage before scoring many EVM tokens.

    Annotations the server declares

    • title: Rug pull probability
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_smart_moneyWallets with a track record of profitable entries that are holding or trading this token, classified from their historical trade win rates — a "verified" smart-money tag requires a…1 finding

    Why it is in this group

    • The name "get_smart_money" says "get": a word for reading.

    Findings

    • Warn

      The input schema at properties.address.description contains a 44-character base64 string.

      Matched text

      inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

      What this check looks for
    Description, as the server wrote it
    Wallets with a track record of profitable entries that are holding or trading this token, classified from their historical trade win rates — a "verified" smart-money tag requires a known win rate of 50% or better. Computed live from the current holder set and cached for about five minutes. Use it for the bullish side of a scan: who informed is in, and when they got in. Not for risk assessment — informed wallets present never offsets a rug signal, and a clean result is not a buy signal — and not for wallet size (get_whales). Arguments: address and chain; one API unit on any chain.

    Annotations the server declares

    • title: Smart money
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_token_pricePrice history for one token as OHLCV candles, plus the latest price, the window's high and low with their timestamps, and the percent change across the window — prices in USD (the …1 finding

    Why it is in this group

    • The name "get_token_price" says "get": a word for reading.

    Findings

    • Warn

      The input schema at properties.address.description contains a 44-character base64 string.

      Matched text

      inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

      What this check looks for
    Description, as the server wrote it
    Price history for one token as OHLCV candles, plus the latest price, the window's high and low with their timestamps, and the percent change across the window — prices in USD (the *Usd fields), volume as the market source quotes it. Aggregated from DEX market sources and cached for about a minute. Intervals with no trades are omitted rather than zero-filled, so consecutive candles can sit more than one step apart. The optional timeframe argument sets the candle size and with it how far back the window reaches: 15m (the default) covers about the last 2.5 days, 1H about 10 days, 4H about 40 days and 1D up to a year of daily candles, back to the token's first trade if it is younger; there is no start or end argument, the size fixes the window. Use 1D for "what did it peak at", "how far is it down from the top" or any price history question; use the default for the market context around a risk verdict. A token with no liquidity pool returns candles: [] and totalCandles: 0 rather than an error. Not for risk of any kind — market data carries no forensic signal — and not for pool depth or lock status (get_liquidity) or market cap (get_token_scan's token block). Arguments: address, chain and timeframe — a 0x address needs its chain; one API unit on any chain regardless of timeframe.

    Annotations the server declares

    • title: Token price
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_usageReport the calling API key's plan, rate limits and how much of its monthly allowance is left.1 finding

    Why it is in this group

    • The name "get_usage" says "get": a word for reading.

    Findings

    • Warn

      The description contains "every other tool", wording about other tools or servers.

      Matched text

      description: "...ludes. Not for anything about a token — every other tool takes an address; this one reports on t..."

      What this check looks for
    Description, as the server wrote it
    Report the calling API key's plan, rate limits and how much of its monthly allowance is left. Takes no arguments. Use it when a call fails on quota, or when the user asks what their DeFade plan includes. Not for anything about a token — every other tool takes an address; this one reports on the key itself.

    Annotations the server declares

    • title: API usage
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_whalesWallets holding at least 1% of supply once pools, lockers, treasuries and custodial accounts are removed.1 finding

    Why it is in this group

    • The name "get_whales" says "get": a word for reading.

    Findings

    • Warn

      The input schema at properties.address.description contains a 44-character base64 string.

      Matched text

      inputSchema.properties.address.description: "...44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed..."

      What this check looks for
    Description, as the server wrote it
    Wallets holding at least 1% of supply once pools, lockers, treasuries and custodial accounts are removed. Each row carries the balance, share of supply, any attribution label (known KOL, dev-linked stash, exchange), the 24-hour transaction count and recent buys and sells; the summary counts dangerous and active whales and gives a whale-risk verdict. One response, no pagination; cached for 15 minutes, so activity figures can lag by that much. A token with nothing above the threshold returns an empty list and largestHumanPct, so the empty state is explainable rather than silent. Use it after get_holders when the question is about who can dump and whether they are already dumping. Not for the full ranked holder list (get_holders), historically profitable wallets (get_smart_money), or the creator's own wallet (get_dev_tracker). Arguments: address and chain; one API unit on any chain.

    Annotations the server declares

    • title: Whale activity
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.1.8. Values in angle brackets are yours to fill in.

claude mcp add --transport http defade https://api.defade.org/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__defade__get_rug_score",
      "mcp__defade__get_holders",
      "mcp__defade__get_whales",
      "mcp__defade__get_liquidity",
      "mcp__defade__get_launch_bundles",
      "mcp__defade__get_launch_snipers",
      "mcp__defade__get_wallet_links",
      "mcp__defade__get_smart_money",
      "mcp__defade__get_dev_tracker",
      "mcp__defade__get_funding_sources",
      "mcp__defade__get_lookalike_clusters",
      "mcp__defade__get_fee_fingerprint",
      "mcp__defade__get_token_price",
      "mcp__defade__get_usage"
    ],
    "ask": [
      "mcp__defade__get_token_scan"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as defade. Review it before you use it.