snitches on bundles, dev dumps and clusters before you ape.
Paste a mint and get the full audit right here. 13 checks scored 0 to 100 from DexScreener and the chain, every finding shown, every skipped check listed.
Try with an example: BONK, or the newest pump.fun launch
Heuristics, not financial advice. A low score does not mean safe.
New launches, quick-scored.
The latest pump.fun token profiles on DexScreener, scored with the 10 quick checks. Open a row for the full audit with launch history: bundle, dev wallet and clusters.
Quick scores skip the history checks, so coverage is at most 69%. A quick score is a first look, not a verdict.
One scoring engine, three ways in.
A CLI, a local dashboard and an MCP server on the same code. Read only: no wallet, no keys, no trading.
--watchLive feed with history
Polls DexScreener for new Solana profiles, scores each one, re-checks what it saw and keeps every score in a local JSONL file.
check <mint>Full report
Every check with points, findings and coverage. Write it out as markdown or a single-file HTML report.
--alertRule based alerts
Discord, Telegram or any webhook, driven by rules like score<25 and liq>10k. Parsed by hand, never eval.
uiLocal console
Live table with score rings, coverage and filters. Click a token and every check opens next to it.
mcpAgent ready
check_token, scan_latest, explain_score and token_history over stdio for Claude, Cursor and other MCP clients.
rate limitsPolite by default
Stays under DexScreener's 60 and 300 requests per minute, spaces RPC calls at 10 per second, retries 429 and 5xx with backoff.
Thirteen checks. Weights add up to 100.
A check that cannot run is skipped and lowers coverage. Skipped is never counted as safe. Under 25 is low, 25 to 49 medium, 50 and up high.
| Check | What raises points | Weight |
|---|---|---|
| Mint authority | Mint authority still set, supply can be inflated | 15 |
| Freeze authority | Freeze authority set, holder accounts can be frozen | 12 |
| Bundled launch | 3 or more wallets bought in the creation slot or the next 2; full weight while they still hold 5% | 12 |
| Dev wallet | Creator sold or moved 20% (half) or 50% (full) of the launch bag | 10 |
| Holder concentration | Top 10 accounts, excluding a likely pool, hold 25% to 50% or more | 10 |
| Holder clusters | Top holders whose first SOL came from the same funder hold 3% to 15% or more | 9 |
| Liquidity | Under $5,000 or no pair | 7 |
| Sell pressure | Sells at least 3x buys with 10 or more sells, 5m or 1h | 6 |
| Website and socials | No website and no social links | 5 |
| Mutable metadata | Metaplex metadata can still be changed | 4 |
| Name and symbol | Copies a well known token, zero-width or look-alike characters | 4 |
| Pair age | Younger than 10 minutes | 3 |
| Link sanity | Not https, URL shorteners, X links that are not a profile | 3 |
Same answer in your shell.
The site runs the CLI's scoring code. Install it for watch mode, alerts, history and your own RPC. Below: a scan of the latest launches, then a full check on the worst one, example data from the test fixtures.
npx snitch-cli --watch
Let your agent check before it buys.
Run snitch mcp and your agent gets four tools. Results are JSON, failures come back as tool errors, logs stay on stderr.
check_tokenScore one mint with every checkscan_latestScore the newest Solana profilesexplain_scorePlain explanation of each point and each skiptoken_historyScore over time from the local store
{
"mcpServers": {
"snitch": {
"command": "npx",
"args": ["-y", "snitch-cli", "mcp"],
"env": { "SNITCH_RPC": "https://your-rpc.example" }
}
}
}
A local console for the live feed.
snitch ui serves one page on 127.0.0.1:4747 and runs the watcher in the background. Nothing opens by itself.
Example data from the test fixtures.
Questions.
Does a low score mean a token is safe?
No. The score counts red flags that show up in public data. A low score means none of these heuristics fired, not that the token is safe. This is not financial advice.
How does the website check a token?
Your browser reads DexScreener directly and sends read-only Solana RPC calls through a small proxy at /api/rpc (allowed methods only, cached for 15 seconds). The scoring code is the same file the CLI runs. A full audit takes about 30 RPC calls; when the public RPC rate limits, the affected checks are shown as skipped, never as passed.
Which data sources does it use?
DexScreener's documented public endpoints for profiles and pairs, and standard Solana JSON-RPC calls (getAccountInfo, getTokenLargestAccounts, getSignaturesForAddress, getTransaction, getMultipleAccounts). No API keys.
Do I need my own RPC?
The history based checks make roughly 30 RPC calls per token. The public endpoint works for light use; for watch mode use a private RPC. Set SNITCH_RPC and SNITCH_RPC_RPS.
Can it trade or touch my wallet?
No. It only reads public data. There is no wallet, no signing and no key handling anywhere in the code.
Why was a check skipped?
Data was missing or capped, for example a mint with more than 3,000 signatures where the creation transaction was not reached. Skips lower coverage and are listed in every report.
Check before you ape.
Open source, MIT, runs on Node 18 or newer.