pumpfun-mcpSAFE
Free, read-only pump.fun + Solana MCP server — token discovery, on-chain bonding-curve & holder analysis, creator fee-claim tracking, SNS resolution, KOL signals, and swap quotes. No API keys.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
@three-ws/pumpfun-mcp
Free, read-only pump.fun + Solana MCP server — token discovery, on-chain analysis, and live 3D snapshots. No API keys.
Install · Quick start · Tools · Configuration · three.ws
A free, read-only Model Context Protocol server for pump.fun and Solana. It gives Claude — or any MCP client — live token discovery, on-chain bonding-curve and holder analysis, creator fee-claim tracking, Solana Name Service resolution, KOL signals, read-only swap quotes, and shareable live 3D token snapshots. Every Solana RPC and pump.fun API call runs server-side on the canonical three.ws backend, so the data is live and on-chain while the client stays zero-config: no API keys, no RPC URL, no wallet.
I
6e00e7aef182OBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add pumpfun-mcp -- npx -y @three-ws/[email protected]
Exposed tools (22)
20 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
get_bonding_curve | read | Bonding curve analysis: real reserves, virtual reserves, and graduation progress (on-chain). |
get_creator_profile | read | All tokens by a creator wallet, with rug-pull risk flags. |
get_graduated_tokens | read | Tokens that graduated from the bonding curve to their PumpSwap (pump_amm) pool. |
get_king_of_the_hill | read | Highest-market-cap token still on the bonding curve. |
get_new_tokens | read | Most recently launched pump.fun tokens. |
get_token_details | read | Full details for a specific pump.fun token by mint address. |
get_token_holders | read | Top holders of a token with concentration analysis (on-chain). |
get_token_trades | read | Recent buy/sell history for a token. |
get_trending_tokens | read | Top pump.fun tokens by market cap. |
kol_leaderboard | read | Top KOL traders ranked by P&L for a given time window. Returns wallet, pnlUsd, winRate, trades, rank. |
pumpfun_bot_status | read | Returns the configuration and health status of the pump.fun indexer backend. Always available; does not require PUMPFUN_BOT_URL. |
pumpfun_first_claims | read | First-ever pump.fun creator fee claims in a time window: a cash-out signal. Returns creators who have never claimed before, with creator wallet, mint, lamports, and timestamp. |
pumpfun_list_claims | read | List recent pump.fun fee-claim events for a creator wallet (on-chain, no indexer needed). Returns signature, mint, lamports, and Unix timestamp for each claim. |
pumpfun_quote_swap | read | Read-only price quote for a pump.fun (PumpSwap) AMM swap on a GRADUATED coin. No signing or tx |
pumpfun_vanity_mint | read | Generate a Solana keypair whose address ends/starts with a vanity pattern. Returns publicKey + secretKey (base58). Caller must save the secret key immediately; it is never stored. Hard timeout: 60 s. |
pumpfun_watch_claims | read | Return all pump.fun fee-claim events for a creator wallet within a look-back window (durationMs). Use this for batch collection after a delay; for a creator\ |
pumpfun_watch_whales | read | Collect whale trades on a pump.fun token for a short window (max 10 s). Returns all trades whose USD value meets minUsd. |
search_tokens | read | Search pump.fun tokens by name, symbol, or mint address. |
sns_resolve | read | Resolve a .sol Solana Name Service domain to its owner wallet address. |
sns_reverseLookup | read | Reverse-lookup a Solana wallet address to its primary .sol domain name. |
social_cashtag_sentiment | write | Score social-post sentiment for a cashtag using a deterministic lexicon. Returns score (-1..1), positive/negative/neutral percentages, and example posts. |
social_x_post_impact | write | Correlate an X (Twitter) post to a memecoin price impact. Fetches post metadata via oEmbed (no API key) and computes price delta from the pump.fun bonding curve in a ±windowMin window around the post. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (2 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (3)
.nojekyll
process.env.PUMPFUN_MCP_URL = 'http://127.0.0.1:1/pump-fun-mcp';
@modelcontextprotocol/sdk
Gates applied: no_behavioural_pass.
6e00e7aef182full audit observations/trust-audit/mcp-server/nirholas__pumpfun-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 6e00e7aef182 | SAFE | B | 89 | first audit |
Questions
What is the pumpfun-mcp MCP server?
Free, read-only pump.fun + Solana MCP server — token discovery, on-chain bonding-curve & holder analysis, creator fee-claim tracking, SNS resolution, KOL signals, and swap quotes. No API keys.
What tools does pumpfun-mcp expose?
22 in total: 20 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is pumpfun-mcp safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does pumpfun-mcp need?
No credential environment variables were found in its source, so it appears to need none.
How does pumpfun-mcp run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @three-ws/pumpfun-mcp at 0.2.7.
How current is this page?
The grade is for one exact copy of the source (6e00e7aef182), read on 2026-10-10. The repository is watched and re-audited when it changes.