loophole tape: Solana token safety

loophole tape — Solana token safety and pump.fun rug checks, free to $0.025 a call

Base URL: https://api.loopholetape.com Payment: x402 v2, scheme exact, USDC on Solana mainnet (solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp) or Base (eip155:8453). Solana payments are settled by https://facilitator.payai.network, Base payments by Coinbase's facilitator https://api.cdp.coinbase.com/platform/v2/x402. Every 402 lists both networks in accepts[]; pay whichever your wallet supports. The facilitator pays the network fee on either chain; a caller needs only USDC. No account or API key required. Version: 0.9.0 (schema 2.0)

Check one mint for $0.005, or up to five caller-selected mints for $0.01 total. Every result carries calibrated probabilities, P(rug within 5 minutes) for checks younger than 30 seconds and P(true graduation) at any age, fitted on our own capture and validated out of time; the validation tables are public at /v1/calibration. Get observed creator exits, early-wallet selling, drains, migration state, concentration and buyer flow in a compact JSON result. Use it before a swap or to monitor a position. Findings carry first-observed times and evidence; no_flags_observed means no documented flags were observed, not that a token is safe.

Free coverage, free watch availability, no charge for unchanged watched events. New paid checks require full live coverage for every mint and feed lag no greater than five seconds. An unpaid request with well-formed mints returns the ordinary 402 quote; when the payment (or prepaid key) arrives, uncovered mints are refused unpaid before verification with live_examples (mints covered right now) and the free /v1/radar to pick from, and eligibility is checked again after verification. Stale feeds and malformed mints are refused before payment. The existing full card remains $0.025 and the existing free routes remain free.

Local MCP server: one command, pays from your own wallet

loopholetape-mcp is a small local MCP server (stdio) for Claude Desktop, Claude Code, Cursor and any other MCP client. It lists this API's tools and pays the paid ones per call in USDC, signed on your machine, from a Solana wallet or a Base (EVM) wallet. Most MCP clients cannot sign an x402 payment; this does it for them. No account, no subscription.

Claude Desktop: download loopholetape-mcp-0.1.0.mcpb and open it. The wallet key is optional; the app keeps it in the system keychain.

Any MCP client (Node.js 20 or newer):

{

"mcpServers": { "loopholetape": { "command": "npx", "args": ["-y", "https://github.com/gosadu/loophole-tape/releases/download/mcp-v0.2.0/loopholetape-mcp-0.2.0.tgz"], "env": { "SOLANA_KEYPAIR_PATH": "/absolute/path/to/a-small-wallet.json" } } } }

Claude Code: claude mcp add loopholetape -e SOLANA_KEYPAIR_PATH=/absolute/path/to/a-small-wallet.json -- npx -y https://github.com/gosadu/loophole-tape/releases/download/mcp-v0.2.0/loopholetape-mcp-0.2.0.tgz

What is free and what costs. token_safety is free for every Solana mint: mint and freeze authority, Token-2022 holder risks, the ten largest token accounts, the launch venue, and a verdict word with its reason. For a pump.fun launch in its first hours it also buys the $0.01 verdict with calibrated rug and graduation odds; depth=free never pays, and nothing is bought when the paid answer would add nothing. The other paid tools cost $0.001 to $0.04 a call and say so in their description. radar, market_regime, check_coverage and wallet_status are free. With no wallet and no key, the free tools work and a shared trial key answers a few paid calls a day.

What it will not do (enforced in src/server.mjs, one file, with tests; reviewed adversarially before the first release, and the review's findings are fixed in 0.1.0):

• sign a payment to any address other than this API's (9HkwyUhDMyjbpSpnyu5xuZ9vRaFQeajnJsavhie7XcsT on Solana, 0x25d408eF54e60F3006bD13d5A040d525E2F359c2 on Base), in any asset other than USDC, on any network other than Solana mainnet or Base, or (on Solana) with your own wallet as the fee payer;
• sign more for one call than the tool's listed price or LOOPHOLETAPE_MAX_USD_PER_CALL (default $0.05; the payment library caps one payment at $1 on top);
• sign more in one UTC day than LOOPHOLETAPE_MAX_USD_PER_DAY (default $1): every payment is counted in ~/.loopholetape-mcp/spend.json under a lock *before* it is signed, settled or not, so the cap survives restarts, crashes and several copies of the server sharing that directory; if the file cannot be read or written, paid calls are refused rather than uncounted;
• write, log or send the key. A pasted public address is refused (the key must be the 64-byte secret), so no wallet is ever derived from public text.

Use a dedicated wallet that holds a few dollars of USDC. It needs no SOL and no ETH: the facilitator pays the network fee on both chains.

Build it yourself: npm ci --ignore-scripts && npm test && npm run build reproduces dist/loopholetape-mcp.mjs from src/server.mjs and the pinned dependencies. Registry names: com.loopholetape/solana-token-safety (official MCP registry) and loopholetape/solana-token-safety (Smithery). Smithery also runs a hosted copy; a key given to that copy sits in Smithery's runtime, not on your machine, so install locally when the key should stay local.

Start here

1. Choose one to five pump.fun mints from your own workflow. Call GET /v1/check/coverage?mints=MINT1,MINT2 for free to see availability and exact prices. Coverage is also checked automatically by the paid route, so a separate preflight call is optional.
2. Call GET /v1/check/mint/MINT ($0.005) or GET /v1/check/watchlist?mints=MINT1,MINT2 ($0.01 total). A payable request returns the standard x402 402 challenge. Pay once to receive the compact check and a watch cursor.
3. Poll GET /v1/check/watch?mints=MINT1,MINT2&cursor=CURSOR every 15 seconds or slower for free. When data.has_new_events is true, pass the same cursor to the paid check for details and an updated cursor. Passing an unchanged cursor directly to the paid check also returns an unpaid no_new_events result.

Only these events advance a watch cursor: creator_sold, bundle_dumped, curve_drained, pool_drained, curve_closed_low, migrate_below_grad, and curve completion/migration/graduation transitions. Ordinary trades, ages and changing totals do not. Cursors bind to the exact mint set and expire after 24 hours. Calling the free watch without a cursor initializes a baseline; omit the cursor from a paid check when you want the current measurements regardless of new events.

The five-second eligibility limit is measured at result generation, before settlement. Settlement and network transit can add delay. meta.freshness_checked_at and feed_lag_at_generation_s record the eligibility check; result_age_s, feed_lag_s and is_stale are aged when the result is sent, including time spent settling. Compare t with your own clock after receipt; this is not a guarantee of delivery within five seconds.

Free history: the dataset on Hugging Face

Every pump.fun launch our recorder saw, one parquet file per UTC day, with what happened to each launch afterwards (graduation, rug flag with timing, peak curve reserve, creator, early holder structure) and a second table with the first 30 minutes of every graduation pool: https://huggingface.co/datasets/loopholetape/pumpfun-launches (CC BY 4.0). Days at least 7 days old are published there free; the newest 7 days are sold on the API as GET /v1/datasets/pumpfun_launches/{day} ($5.00). The dataset card lists the data's 17 known issues; read it before training on the files.

Try it without a wallet

A shared public trial key is published at /llms.txt (section "Try it without a wallet") and in /pricing. Send it as X-API-Key on any route priced $0.02 or less (launches, the compact check, the watchlist, the verdict, the screened list, the outcome labels, and since 2026-09-30 the rug and graduation lists, the creator and wallet cards, the pons curve card and its trades). It has tiny daily caps ($0.50 a day shared, $0.02 a day per caller IP, so one $0.02 answer is a caller's whole day) and answers carry X-Tape-Trial: 1 and a meta.trial block with the remaining amount; trial calls are never counted as payments. For your own budget buy a prepaid key: GET /v1/keys/trial ($0.10 of credit) or GET /v1/keys/new ($2.00).

No x402 client and no browser wallet? Buy a prepaid key with a plain USDC transfer (since 2026-09-30):

curl "https://api.loopholetape.com/v1/keys/transfer?usd=2"     # an exact amount, our address on Base and on Solana, a claim URL

send exactly that amount of USDC once, from any wallet or exchange, then:

curl "https://api.loopholetape.com/v1/keys/transfer/claim?quote=...&secret=...&tx= " curl -H "X-API-Key: lt_..." "https://api.loopholetape.com/v1/check/mint/ "

The amount carries a unique fraction of a cent, which is how the transfer is matched to your quote, so send it exactly. The key's credit is the amount received and does not expire. usd takes whole cents from 0.10 to 50; the quote stays payable for 7 days. A transfer that matches no quote buys nothing: write to agent@agent.loopholetape.com with the transaction.

Drop-in pre-buy filter for a self-built pump.fun bot: examples/python/pumpfun_bot_prebuy_filter.py asks the free coverage check, then the $0.01 verdict with your key, and returns (ok, reason); it fails open on any error so a slow check never blocks your bot. Outcome labels for grading your own signals: GET /v1/outcome/{mint} ($0.001) and GET /v1/outcome/batch?mints= (up to 40, $0.01) return, by the fixed public rule, whether a mint rugged or truly graduated and when. Free feeds: Atom feeds of graduation odds, Robinhood Chain ring flags and daily statistics at /feeds, usable by any RSS bot.

Pay on Solana, Base, Robinhood Chain or X Layer

Every paid route offers four x402 accepts entries: USDC on Solana mainnet and USDC on Base eip155:8453 (both settled by the Coinbase CDP facilitator since 2026-09-23), USDG on Robinhood Chain eip155:4663 (facilitator.naven.network) and USD₮0 on X Layer eip155:196 (PayAI facilitator). USDG and USD₮0 are not default assets in the x402 SDKs, so allow them in your client's spend controls if you want those entries. Clients that pay the first entry can reorder the quote with ?rail=solana|base|usdg|xlayer (or the X-Rail header); the order is Solana, Base, USDG, USD₮0 by default.

In a browser, no client needed: open any paid URL (for example a mint from the free radar) in a browser with a Solana wallet such as Phantom or Solflare; the page asks the wallet to pay the exact amount and then s