# MemePump MCP server: Solana token safety checks for AI assistants

- **What it is:** A hosted, read-only MCP server that checks Solana tokens: risk score, honeypot signal, liquidity lock, mint and freeze authority, holder concentration and wallet clusters.
- **Endpoint:** https://memepump.org/api/mcp (Streamable HTTP, stateless JSON, POST only)
- **Auth:** None needed. An optional MemePump API key as `Authorization: Bearer msk_live_...` gives higher rate limits and a monthly quota. No OAuth.
- **Tools:** check_token_safety, get_token_holders, explain_risk_signals (all read-only)
- **Cannot do:** Trade, sign, send or move funds, hold or ask for wallet keys, or give financial advice.
- **Cost:** Free to call without a key (rate limited per IP). API keys have a free plan of 1000 calls per 30 days and paid plans for more.
- **Data sources:** RugCheck analysis for the safety report; Solana RPC holder data for holders and clusters.
- **Registry:** org.memepump/memepump

## Agent quickstart

### 1. Discover
- MCP server card: https://memepump.org/.well-known/mcp/server-card.json
- llms.txt: https://memepump.org/llms.txt
- This page as markdown: https://memepump.org/mcp.md
- Pricing as markdown: https://memepump.org/pricing.md
- Official MCP Registry name: org.memepump/memepump

### 2. Authenticate
- **No key (default).** POST to https://memepump.org/api/mcp with no Authorization header. Limited per IP address (10 requests, 4 safety lookups and 2 holder lookups per minute) and across all anonymous clients together.
- **API key (optional).** A human creates a key at https://memepump.org/dashboard/signup and gives it to the agent as `Authorization: Bearer msk_live_...`. Limits become 120 requests and 20 holder lookups per minute, and each successful lookup counts against the key's monthly quota. A wrong or inactive key returns HTTP 401; the agent should not retry it.

### 3. Minimal call sequence
Check a token before anything else.

```json
check_token_safety({
  "mint": "So11111111111111111111111111111111111111112"
})
```
Returns: risk_score, risk_level, honeypot, lp_locked, mint_authority_enabled, freeze_authority_enabled, top_holder_pct, top_holders_pct, holder_concentration_risk, total_holders, total_liquidity_usd, rugged, warnings, checked_at, report_url, disclaimer.

If concentration or warnings call for a closer look, list the holders.

```json
get_token_holders({
  "mint": "So11111111111111111111111111111111111111112",
  "limit": 10
})
```
Returns: holders (rank, address, percentage, holder_type, label, risk_score, cluster_id), clusters, top_10_concentration_pct, cluster_count, disclaimer.

To explain a field to the user in plain words, read the definitions.

```json
explain_risk_signals({})
```
Returns: signals: each signal with its meaning and its limits.

### 4. Limits and quotas
- Without a key: 10 requests, 4 check_token_safety calls and 2 get_token_holders calls per minute, per IP address. Clients that share an IP share the limit. All anonymous clients together are also capped at 120 requests, 6 check_token_safety calls and 4 get_token_holders calls per minute; use an API key for steady use.
- With a key: 120 requests, 60 check_token_safety calls and 20 get_token_holders calls per minute, plus the plan's monthly quota (free plan: 1000 calls per 30 days, a hard cap).
- check_token_safety and get_token_holders count one call each on a key when they succeed. explain_risk_signals and failed lookups are not counted.
- Safety reports are cached for up to 4 hours; checked_at and cached tell the agent how fresh a result is.
- mint must be a base58 address of 32 to 44 characters. get_token_holders returns at most 25 holders.

### 5. Errors the agent must handle
| Where | Signal | Meaning | Agent should |
|---|---|---|---|
| HTTP 429 | Rate limit | Too many requests from this IP or key. | Wait Retry-After seconds, then retry once. |
| HTTP 401 | Bad API key | The Bearer key is unknown or inactive. | Stop and tell the human; do not guess keys. |
| Tool result isError | Quota used up | The key's monthly calls are used up. | Tell the human; it resets on the date in the message. |
| Tool result isError | Data unavailable | The upstream data source had nothing for this token right now. | Retry later; do not invent a verdict. |
| Tool result isError | Invalid mint | The mint is not a valid Solana address. | Ask the human for the correct mint address. |

### 6. Hand off to the human
- Give the human the verdict with its source: the data is RugCheck analysis and Solana holder data, automated and possibly delayed.
- State that the result is informational and not financial advice; a low risk score is not a guarantee.
- Link report_url so the human can open the same check in a browser.

## Human oversight
| You can | How |
|---|---|
| Nothing to approve | Every tool is read-only: the server cannot buy, sell, sign, send or move funds and never asks for a wallet or private key, so there is no action for a human to approve. |
| See what the agent used | With an API key: the dashboard at https://memepump.org/dashboard shows plan and calls used, and GET https://memepump.org/api/v1/account/usage returns calls used and remaining. |
| Revoke access | Rotate the key in the dashboard (Rotate key) and the old key stops working at once; or remove the connector in the AI client. Without a key there is nothing to revoke. |
| Control tool calls in the client | Many clients ask before each tool call; that is the client's setting, not something MemePump enforces. |

## Tools (https://memepump.org/api/mcp)
| Tool | What it does | Hints |
|---|---|---|
| check_token_safety | Looks up a Solana token by mint address and returns a safety report built from third-party on-chain analysis: a 0 to 100 risk score (0 is lowest risk) with a risk level, whether the token shows honeypot or rug signals, whether liquidity is locked, whether the mint and freeze authorities are still active, top-holder concentration, total liquidity in USD and a list of warnings. Read-only and informational; not financial advice. | read-only, idempotent, reads external data |
| get_token_holders | Lists the largest holders of a Solana token by mint address with each holder's share of supply, a holder type label and a risk score, and reports whether wallets look linked through a common funder or frequent transfers (cluster flags), plus supply-concentration summary figures. Read-only and informational; not financial advice. | read-only, idempotent, reads external data |
| explain_risk_signals | Returns plain-language definitions of the signals found in a token safety report: risk score bands, honeypot signal, liquidity lock, mint authority, freeze authority, holder concentration and wallet clusters, with what each one can and cannot show. Static reference text; makes no network lookup. | read-only, idempotent, no network |

## Install
- ChatGPT: Add https://memepump.org/api/mcp as a custom MCP connector (developer mode, depending on your plan). No sign-in is needed.
- Claude (claude.ai): Settings, Connectors, add custom connector https://memepump.org/api/mcp.
- Claude Code: `claude mcp add --transport http memepump https://memepump.org/api/mcp`, or `/plugin marketplace add airdropfi/memepump-claude-plugin` then `/plugin install memepump@memepump-plugins`.
- Cursor: Add the url to mcp.json, or use https://github.com/airdropfi/memepump-cursor-kit.
- Gemini CLI: `gemini extensions install https://github.com/airdropfi/memepump-gemini-extension`.
- Any client: Remote server, transport streamable-http, URL https://memepump.org/api/mcp.
- Direct HTTP: `curl -s https://memepump.org/api/mcp -H 'content-type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'`
- Registry: org.memepump/memepump

## Prompts to copy
- Is this Solana token a rug? Mint: So11111111111111111111111111111111111111112
- Check these three mints and tell me which has an active mint authority.
- Who holds most of this token, and do any wallets look linked?
- Explain what a honeypot signal and an active freeze authority mean in a token report.

## FAQ
### Does the MCP server trade or hold my keys?
No. It is read-only: it has no trading, signing or transfer tools and never asks for a wallet or private key.

### Do I need an account or an API key?
No. Anonymous calls work and are rate limited per IP. A key is optional and raises the limits.

### Is it free?
Calling without a key is free. API keys start on a free plan of 1000 calls per 30 days; paid plans are listed on the API page.

### Where does the data come from?
The safety report is RugCheck analysis of on-chain data; holders and clusters come from Solana RPC data. MemePump does not run its own scam detection model.

### Does a low risk score mean a token is safe?
No. A low score only means the automated checks found fewer red flags. It cannot see intent, future changes or off-chain facts. The output is informational, not financial advice.

### Which chains does it cover?
Solana only.

Not financial advice. Informational only. Automated analysis of public on-chain data from third-party sources; it can be incomplete, delayed or wrong. Not financial, investment or legal advice, and a low risk score does not mean a token is safe.

Human page: https://memepump.org/mcp