What shipped.
When and why.

API:

• New GET /api/v1/tokens/{mint}/bundle — bundle intelligence for a token. It resolves the token's bundle cohort — the same-slot "bundle" wallets that bought together (≥3 wallets buying in one slot = is_bundle) — and, the headline, how much of supply that cohort still holds. The bundle block returns wallet_count, bundle_kind (atomic_tx | same_slot | none), held_ratio, held_pct_of_supply (net tokens held ÷ supply, clamped 0–1 — the rug/insider read), fully_exited, buy_volume, and tokens_held. Crucially this is computed from confirmed on-chain trades (token_trades), not a pre-execution shred feed — it's the incumbents' headline "current held %" signal done the correct confirmed-data way, with bundle_kind atomicity added on top. Honest about its inputs: held_pct_of_supply is a swap-derived net proxy (clamped), tokens_held is that same net proxy rather than a holder census, and buy_volume is cumulative buy volume — not distinct tokens, so it can exceed supply. Field-gated across all tiers (funnel-hook, same as buyer-quality / cap-table): BASIC/TRADER get the scalar bundle block only, PRO adds the top-10 wallets (flags only), and ULTRA returns the full cohort enriched with KOL/alpha identity (kol_name, win_rate, bot_confidence). Full reference on the API docs.

SDKs:

• A new bundle-holdings method ships across all 7 SDKs — madeonsol-x402 1.19.0 (npm), the MCP server mcp-server-madeonsol 1.17.0 (tool madeonsol_token_bundle), the Eliza plugin @madeonsol/plugin-madeonsol 1.16.0, solana-agent-kit-plugin-madeonsol 1.16.0, madeonsol 1.20.0 (PyPI), the bare TypeScript madeonsol 2.18.0, and the Rust crate madeonsol 0.20.0. Additive only, no breaking changes.

Site:

• The API docs now list and let you try /tokens/{mint}/bundle alongside cap-table and buyer-quality.

API — PnL accuracy:

• KOL leaderboard & wallet PnL are now cost-basis realized PnL, not net SOL flow. Before, a trader mid-accumulation — bought a lot, sold a little — showed a large "loss" because the full cost was charged against partial proceeds. Now only the cost of the sold portion counts, so /api/v1/kol/leaderboard, /api/v1/kol/{wallet}/pnl, and the wallet endpoints report realized PnL that reflects actual round-trips. Accumulators no longer read as losers, and the leaderboard ranks on true realized PnL.

• Unrealized PnL on still-held positions. /api/v1/kol/{wallet}/pnl and the wallet endpoints now include unrealized_pnl_sol + total_pnl_sol — the mark-to-market value of tokens a wallet is still holding, priced from our own data, alongside realized. Held inventory is valued, not counted as a loss.

• USDC/USDT-quoted trades are now captured. Swaps priced in USDC/USDT rather than SOL — a growing share on pump.fun & PumpSwap stable pairs — are now recorded and counted in PnL, volume, and firehose data instead of being dropped.

API — beyond pump.fun:

• Wallet PnL, token flow, and cap-table now cover bonk (LetsBonk) & bags launchpad tokens, not just pump.fun — a wallet's bonk/bags trades now show up in /api/v1/wallet/{address}/pnl, /api/v1/tokens/{mint}/flow, and the cap-table.

• Deployer-hunter now surfaces bonk deploys. GET /api/v1/deployer-hunter/{wallet} gains a launchpad_tokens field listing a deployer's bonk (Raydium LaunchLab) tokens from our own on-chain index, alongside the existing pump.fun pump_tokens.

• Almost-bonded now covers bonk (LetsBonk). GET /api/v1/tokens/almost-bonded widened past pump.fun to include bonk/LetsBonk (Raydium LaunchLab) tokens approaching graduation, with live bonding-curve progress_pct computed from the LaunchLab curve. Each token now carries a launchpad field (pumpfun or launchlab) so you can tell the venue apart. Read straight from our firehose — no external API.

Payments:

• Card payments are live. You can now subscribe to PRO or ULTRA with a credit or debit card via Stripe Checkout, right alongside the existing crypto rails — one-off USDC/SOL, or on-chain USDC auto-renew. Card is the default at checkout, renewals are automatic, and you can upgrade, downgrade, update your card, or cancel anytime from the Stripe billing portal (linked in the developer dashboard). Non-EU buyers are shown their local currency at checkout via Stripe Adaptive Pricing.

• EUR is now the canonical price. Plans are billed in euro — PRO €43/mo (€430/yr), ULTRA €131/mo (€1,310/yr) — with the dollar figure shown as a live "≈ $49 / ≈ $149" reference that floats with the daily rate. The crypto rails price off the same fixed euro amount, converted to USDC/SOL at the day's rate, so every method quotes the same price. The checkout pay button shows what you'll actually send per rail (e.g. "~0.67 SOL (€43/mo)").

Site:

• Pricing, checkout, the developer dashboard, blog, and SDK docs now show "€X (≈ $Y)" with card, USDC, and SOL all offered (card first). Product structured data and page metadata were updated to the euro prices.

API:

• New GET /api/v1/stream/sessions (PRO/ULTRA) — list your live WebSocket sessions across both the event stream and the DEX firehose. Each entry carries its id, service, tier, subscribed channels, connected_at, remote_ip, and messages_sent. It reflects in-memory connection state, not historical logs, so every id it returns is one you can act on.

• New DELETE /api/v1/stream/sessions/{id} (PRO/ULTRA) — force-close one of your own live sessions and release its connection slot immediately. This is the self-serve fix for a 4002 Connection limit reached lockout when a redeploy on your side (e.g. an old and new instance briefly running at once) leaves a half-open socket holding your slot — no need to email support or wait for the server-side reaper. The socket is closed with code 4002; you can only terminate sessions belonging to your own key.

API:

• New GET /api/v1/tokens/almost-bonded (PRO/ULTRA) — pre-bond pump.fun tokens approaching graduation, so you can catch them before they bond. Each token carries its live bonding-curve progress_pct (from on-chain real_token_reserves depletion) and, uniquely, its velocity (velocity_pct_per_min = Δprogress/min) plus a linear eta_minutes projection — "95% and accelerating" ranks above "92% stalled". Enriched with deployer reputation (deployer_tier) so you can filter to elite/good deployers only. Filters: min_progress/max_progress (default 80–99.99% band), min_velocity_pct_per_min, max_age_minutes, deployer_tier, authority_revoked, min_liq. Sort by velocity_desc (default), progress_desc, or eta_asc. Self-hosted from our firehose — no external API.

• Trending / momentum sorts on GET /api/v1/tokens (PRO/ULTRA). The token directory now accepts four new sort values — mc_change_5m_desc, mc_change_1h_desc, volume_1h_desc, and trending (recent volume × momentum) — turning it into a reputation-aware momentum board. Combine with deployer_tier and max_mev_share_pct to surface clean-volume movers from trusted deployers and screen out bot-driven wash-pump volume.

Content:

• New builder's hub: Solana Memecoin Data API for Builders. A pillar guide for teams embedding our data in a product — what the KOL-flow, deployer-reputation, coordination, and DEX-firehose layer actually is, the build-vs-buy math, the four ways to pull it in (REST, WebSocket, webhooks, MCP/SDKs), and when to white-label it on Enterprise. It anchors a B2B-embedder content cluster, interlinked with the gRPC streaming, Geyser-plugin, and self-hosting cost guides.

Site:

• In-article "embed our data" CTA. Data-service blog posts now surface a compact data-services call-to-action partway through the article, not only in the footer band — so readers building on Solana data hit the Enterprise / white-label path before they finish reading, instead of scrolling past it at the end.

API:

• New GET /api/v1/tokens/{mint}/flow?window=1h|24h (PRO/ULTRA) — a per-token trade-flow aggregate computed straight from the trade firehose, the "organic vs fake volume" read for a single mint. Returns unique_wallets, unique_buyers, unique_sellers, buy_count, sell_count, total_trades, buy_sol, sell_sol, net_sol, and trades_per_wallet. trades_per_wallet is a wash-trading proxy: a high trade count concentrated across very few wallets is the classic synthetic-volume tell, while a low ratio across many wallets reads as organic demand. Counts and flows only — no holder data. Self-hosted from our firehose, no external API.

• deployer_sol_balance on deployer-hunter alerts. GET /api/v1/deployer-hunter/alerts items now carry deployer_sol_balance (number | null) — the deployer wallet's SOL balance captured at alert time. null for rows alerted before 2026-06-21. The field was already on the deployer:alert webhook payload; it's now on the REST feed too.

SDKs:

• A new tokenFlow method ships across all 7 SDKs — madeonsol 2.15.0 (TypeScript), madeonsol-x402 1.16.0 (TS) and 1.17.0 (Python), the MCP server 1.14.0, the Eliza and Solana Agent Kit plugins 1.13.0, and the Rust crate madeonsol-rs 0.17.0 — and the deployer-alert types gain the deployer_sol_balance field. Additive only, no breaking changes.

API:

• CORS is now enabled on every /api/v1 endpoint. Browser and frontend apps — dashboards, widgets, in-app panels — can call the keyed API directly with their Authorization: Bearer token, no server-side proxy required. Preflight OPTIONS requests return immediately, and the Access-Control-Allow-* headers ride every response. Auth is Bearer-token (not cookies), so direct browser calls are safe.

Platform:

• Enterprise tier. For tools, funds, and platforms embedding our data in production: an uptime SLA, dedicated rate limits beyond Ultra's 100k/day, white-label and redistribution rights, custom endpoints, and a priority support channel. See Pricing or email [email protected].

SDK (1.12.1):

• Fixed copy-trade & alpha methods in the Eliza and Solana Agent Kit plugins. They were calling retired paths (/copy-trade/rules, /alpha/wallet/{w}) and 404ing; they now hit the live routes (/copytrade/subscriptions, /alpha/{w}). copyTradeCreate also takes the correct body — source_wallets[] + sizing_amount — instead of the old single-source_wallet shape.

Every token price we serve — on the /tokens endpoints, wallet PnL, positions, and the KOL feed — now comes straight from on-chain pool and bonding-curve reserves, the same source our market-cap engine trusts.

We retired the older trade-derived estimate, which could be thrown off by network fees, Jito tips, and rent on small trades, and we revived pricing for pre-graduation pump.fun tokens so brand-new launches get a real price instead of a gap. The result: roughly 98% of trade prices now land inside the minute's actual traded range, and the rare order-of-magnitude bad-price tail is gone.

A focused security pass on the keyless x402 surface — the path where agents and scripts pay per request with no API key.

• Method precheck. Unsupported HTTP methods are rejected before any payment is requested, so you're never charged for a request that was never going to succeed.
• Per-IP rate limiting. The keyless surface now enforces the same in-memory per-IP limits as the keyed API — a single caller can't hammer it.
• Strictly read-only. The x402 path exposes data endpoints only; no state-changing route is reachable without a key.
• Consistent validation. Every x402 endpoint validates mint and wallet inputs identically to the keyed /api/v1 routes, and the OpenAPI spec now matches actual behavior — including string-or-array batch mints and Solana path-param examples.

Two onboarding upgrades: the API now tells you exactly how to unlock a gated endpoint, and the dashboard runs your first call for you.

API:

• Tier-gated endpoints now return an actionable 403. When a free or under-tier key calls a PRO/ULTRA endpoint, the response is no longer a bare error string — it carries an upgrade block with the required_tier, monthly price, the new daily/burst limits, a one-line note of what unlocks, and a direct upgrade_url. SDK clients (and humans curling) see the path out inline instead of bouncing to the docs. Applied across every tier-gated route — token risk, cap tables, wallet PnL/positions, sniper feeds, copy-trade, KOL coordination, and more.

Site:

• "Run your first call" on the /developer dashboard — generate a key and fire a real request against live data in one click, no code or curl needed. Returning key-holders get the same one-click sample call.
• The Quick Start snippet now pre-fills your actual key, so it's copy-paste-run.
• API pricing CTAs added across the Intelligence pages (KOL Tracker, Deployer Hunter, Wallet Scanner, Token Lookup, Scout Leaderboard, Daily Alpha) — a reminder that the free tier is 200 calls/day, no card.

A single, transparent safety score for any token — with the per-factor breakdown that produced it, not just an opaque number.

API:

• New GET /api/v1/tokens/{mint}/risk (PRO/ULTRA) — a 0–100 rug-risk / safety score with a band (safe / caution / danger) and an auditable factors[] array. Each factor carries its own status, points, and detail — mint/freeze authority, liquidity depth & thinness, Token-2022 transfer fee, LP burn, bundled/sniped open, deployer track record, KOL distribution, and blacklist. Unlike a black-box score, you can see exactly why a token landed where it did. The response also returns the raw inputs and a score_version. Composed from the same data layer as GET /token/{mint}, so there's no extra latency. Full reference on /api-docs#tools.

SDKs:

• madeonsol-x402 1.13.0 · madeonsol (PyPI) 1.14.0 · mcp-server-madeonsol 1.12.0 · @madeonsol/plugin-madeonsol 1.11.0 · solana-agent-kit-plugin 1.11.0 — all gain a token-risk method/tool. Additive only, no breaking changes.
• Bare TypeScript SDK madeonsol 2.13.0 and the Rust SDK madeonsol 0.14.0 — also updated with the token-risk method.

Site:

• Token Risk Score added to the pricing/feature cards, the /developer page, and the API docs.

Four new enrichment fields and three new filters — all computed from data we already hold, no new pipeline.

New fields on /token/{mint} and /token/batch:

• liquidity_to_mc_ratio — liquidity_usd ÷ market_cap. A structural depth gauge: low ratios flag thin pools where a single exit can crater price. Useful as a risk screen before sizing a position.
• launch_cohort_sol — total SOL committed by the token's first-20 buyers. A proxy for early conviction: high cohort SOL on a no-name deployer is a signal worth watching; high SOL with a dump-factory deployer is a counter-signal.
• launch_cohort_size — how many of the first-20 buyer slots are filled (0–20). Low size on an older token typically means it was abandoned early.

New fields on /tokens list response: liquidity_to_mc_ratio and deployer_tier are now returned per token — screen the whole list without a /token/{mint} roundtrip.

New filters on /tokens:

• min_liq_mc_ratio / max_liq_mc_ratio — keep only tokens within a liquidity-depth band.
• deployer_tier — filter to tokens from a specific deployer reputation tier (elite | good | moderate | rising | cold | unranked). Combine with min_liq_mc_ratio=0.05 to find elite-deployer tokens that still have meaningful liquidity.

New fields on /kol/leaderboard: median_hold_minutes_30d and percentile_early_entry_30d are now returned per KOL, surfacing hold-duration and timing discipline without a separate profile call.

All fields are additive — no breaking changes.

All seven SDKs updated with today's API additions. Additive only, no breaking changes.

madeonsol 2.12.0 · madeonsol-x402 1.12.0 · madeonsol-python 1.13.0 · madeonsol-rs 0.13.0 · mcp-server-madeonsol 1.11.0 · @madeonsol/plugin-madeonsol 1.10.0 · solana-agent-kit-plugin 1.10.1

• TypeScript / x402 — TokenResponseBody gains liquidity_to_mc_ratio, launch_cohort_sol, launch_cohort_size; TokenListParams gains min_liq_mc_ratio, max_liq_mc_ratio, deployer_tier; KolLeaderboardEntry gains median_hold_minutes_30d, percentile_early_entry_30d; new getSignalPerformance(name) method.
• Python — tokens_list() now accepts min_liq_mc_ratio, max_liq_mc_ratio, and deployer_tier keyword args.
• Rust — all three structs (TokenResponseBody, TokensListParams, KolLeaderboardEntry) updated with typed fields.
• MCP — madeonsol_tokens_list tool gains the three new filter params; new madeonsol_signal_performance tool added.
• Plugins — getTokensList() / tokensList() extended with the three new filter params.

We don't just claim the data's clean — we continuously verify it and show you the result. /api-status now reports live data-quality SLOs alongside service uptime:

• On-chain accuracy — a rolling sample of served tokens is re-checked against on-chain supply (FDV ≡ price × supply). A stale-supply or phantom-price market cap is caught within minutes, not on your bug report.
• Field correctness — every served field on the core data endpoints is validated against its contract (never-null where it shouldn't be, values in range) on a fast cadence.
• Quality drift — per-field null-rates are tracked against a trailing baseline, so a slow degradation surfaces before it crosses a hard line.
• Serve-time integrity — the exact bytes we send you are audited the instant they leave the API.

Each is shown as adherence over a trailing window with its sample count — honest, on-chain-grounded (no external aggregators), and self-correcting as history accrues. The same checks page us internally the moment something slips.

Also for developers: subscribing to an unknown or tier-gated WebSocket channel now returns a channels_rejected warning naming what was dropped and why — instead of silently delivering nothing. (Tried dex:trades and got silence? The DEX firehose is a separate ULTRA endpoint — the warning now points you there.)

You shouldn't have to trust a signal on faith. Every signal we serve now self-reports how well it actually works — measured out-of-sample, refreshed daily, and shown openly.

• Public Signal Scorecard — per-signal hit rate by bucket, lift over base, and sample size. Starts with dump-cluster detection and deployer runner-rate; more to come.
• Inline on tokens/{mint}/buyer-quality — responses now include a signal_stats block so a raw value explains itself: dump_cluster_count=17 comes back as "98% of such tokens dumped vs 75% base (1.3× lift), n=190, 14d out-of-sample."
• New GET /api/v1/signals/{name}/performance — the full backtest as JSON (dump_cluster_count | runner_rate), so bots can weight signals programmatically instead of guessing. ?history=true returns the per-day series for drift.

How it stays honest: rolling train/test split (signals graded only on data they weren't built from — no lookahead), a ≥15 early-buyer filter so sparse tokens can't inflate the numbers, and peak-timing labels (dump <15 min, runner ≥60 min). The numbers will move with the market — that's the point.

Also shipped:

• WS deployer:bond now carries runner_rate, labeled_tokens, and recent_bond_rate (previously only on deployer:alert) — read deployer quality straight off a graduation event, no REST round-trip.
• Token market caps — fixed a class of stale-supply phantom MCs (idle tokens whose on-chain supply had drifted after we stopped tracking them). /tokens and /token/{mint} now reconcile supply against the live chain daily, so a dead token can't report an impossible market cap.

Every deployer signal now carries the deployer's runner-rate — the fraction of their tokens (with a real first-20 buyer cohort) that ran (peak ≥60 min after deploy) vs dumped (peak under 15 min). It's a validated as-of read on the next launch: out-of-sample across 8,635 auto-labeled tokens it moved P(runner) monotonically from 10.5% (deployers who never produce runners) to 75.5% (deployers who consistently do), against a 27.6% base — and it adds signal within tier, separating a 0%-runner "elite" pump-and-dump factory from a genuine builder the tier alone scores the same.

New fields (additive, no breaking changes):

• deployer-hunter/alerts + deployer-hunter/{wallet} — runner_rate, labeled_tokens (the confidence denominator — gate on ≥3), and avg_time_to_bond_minutes.
• sniper/recent + WS sniper:deploys — deployer_runner_rate, deployer_labeled_tokens, snapshotted onto the pre-confirmation deploy.
• WS deployer:alert / deployer:bond — runner_rate, labeled_tokens.

Refreshed every 6 hours. One counter-intuitive note from the validation: fast bonders skew dump, not runner — a deployer who bonds in under 30 min runs 12% of the time vs 40% for those taking 6 h+. Slow bond = organic demand.

Also fixed: WS min_mc_usd / max_mc_usd band filtering now works on deployer:alert, deployer:bond and token:graduations. It previously matched the field on none of those channels and silently dropped every event when a band was set.

All seven SDKs updated for today's API additions — additive only, no breaking changes:

• TypeScript madeonsol-x402 1.11.0 and bare madeonsol 2.11.0 — token:graduations added to the typed channel union (no more casting to subscribe), new GraduationEvent payload interface, buyer-quality breakdown typed with dump_cluster_count + recycled_early_buyer_count.
• Rust madeonsol 0.12.0 — same two breakdown fields on AlphaBuyerQualityBreakdown (previously serde dropped them silently) + GraduationEvent struct.
• Python madeonsol-x402 1.12.0 — channel/event registries updated; string subscribe already worked, docs now match.
• mcp-server-madeonsol 1.10.3 — buyer-quality tool description corrected (full breakdown is returned on all tiers, not PRO+) and now mentions the dump-cluster fields.
• @madeonsol/plugin-madeonsol and solana-agent-kit-plugin-madeonsol 1.9.2 — README documentation for both features (payloads pass through unchanged).

Pump.fun graduations (bonding curve complete → PumpSwap migration) are now pushed in real time, two ways:

token:graduations channel on the WebSocket stream (PRO + ULTRA) — every graduation, whether or not the deployer is tracked. This closes the gap left by deployer:bond, which only covers tracked deployers. Payload carries token_mint, name/symbol, time_to_bond_minutes, deployer_wallet, deployer_tier (unranked when unknown), market_cap_usd at bond, and bonded_at. The deployer_tier array filter applies if you only want graded deployers.

In-band dex:graduations frames on the DEX firehose (ULTRA) — subscriptions that scope mints via token_mint(s) receive the graduation for those mints on the same connection and sub_id as the trade flow. If you're watching an open position, the bond arrives in the stream you're already reading — no separate connection, no polling recent-bonds.

Detection rides the hardened three-layer bond pipeline (instruction parser on dual-region gRPC, pool-state confirmation, curve-confirm reconciler) — the same source of truth as deployer-hunter stats. Events fire from the real-time paths only, so a graduation frame is always seconds-fresh, never a stale backfill.

Two new fields in the buyer-quality breakdown (single + batch endpoints, all tiers, no score impact):

dump_cluster_count — how many of the token's first-20 buyers are on a rolling dump-cluster list: wallets whose recent first-20 appearances (5+) are exclusively on tokens that peaked within 15 minutes of deploy. This shipped only after surviving out-of-sample validation on 8,300+ auto-labeled launches with a strict temporal split: 3+ such wallets in a cohort predicted a sub-15-minute peak 94% of the time (vs 61% base rate), rising to 99% at 5+. Controls confirmed it's the composition that matters — raw sniper-wallet activity in a cohort predicts nothing (61%, exactly base).

recycled_early_buyer_count — first-20 buyers with 5+ recent first-20 appearances of any kind. On its own it's noise, but the combination is informative in both directions: a heavily recycled cohort with dump_cluster_count 0 historically leaned runner (39% dump — 22 points below base).

The list is rebuilt daily over a trailing 42-day window — validation showed wallet churn kills any static list within ~2 weeks, so the ensemble rolls. Individual wallets are never exposed.

replay: N on a firehose subscription backfills the N most recent trades matching your filters from a server-side buffer — it is not connection-scoped, so it covers trades from before your connection existed. Until today that buffer held only ~30 seconds of firehose history (it was sized for reconnect gaps); it now holds roughly 5–6 minutes at typical volume (2–3 minutes at peak). Subscribing to a mint at alert time with replay: 500 now recovers the in-flight trade history, not just the last half-minute.

Semantics worth knowing (now also in the API docs): replayed trades arrive newest-first flagged "replay": true, followed by a replay_done frame — sort by block_time client-side. The per-subscription cap stays at 500 trades; async filters (token age, market cap, deployer tier) are skipped on replay since they evaluate against live state. No client or SDK changes required.

A delivery audit found that most streaming customers were getting stuck in the same invisible traps — connected but never receiving events. All of them are now dismantled:

The server tells you when you're not subscribed. A WebSocket connection delivers nothing until you send {"type":"subscribe","channels":[...]} — previously, getting that wrong meant silence with no feedback. Now the connected frame includes a subscribe example and the full channel list, and if no channels are active after 10 seconds the server sends a hint frame with exactly what to send. Same on the DEX firehose.

Token lifecycle is no longer hostile to long-running clients.

• POST /v1/stream/token is idempotent while your current token has more than 6 hours left — the same token is returned, so multi-process clients no longer invalidate each other's tokens on every mint.
• When a token does rotate, the previous token stays valid for 60 seconds — in-flight reconnects survive the swap.
• Expiring tokens are now rotated server-side and pushed in-band as a {"type":"token_refresh"} frame. Healthy connections are never hard-closed at the 24-hour mark anymore.
• The mint endpoint got its own rate bucket (10/min), exempt from the shared REST quota — heavy REST usage can no longer lock you out of minting a streaming token.

Webhook owners are notified when their endpoint breaks. Ten consecutive failed deliveries still auto-pause a webhook, but now the owner gets an email explaining what failed and how to resume — previously the pause was silent.

Coordination alert latency, measured: in a live end-to-end test today, a coordination signal reached the subscriber's WebSocket 570ms after the triggering on-chain trade (rule create → KOL convergence → push).

Subscription housekeeping: when a paid plan lapses, copy-trade and coordination rules are now deactivated alongside webhooks and streaming tokens (previously they kept firing into the void), and they re-enable from the dashboard after renewal.

Housekeeping release across four packages — no API surface changes:

• Pricing tables corrected in the package READMEs (they showed retired tiers; the real lineup is BASIC free / PRO $49/mo / ULTRA $149/mo, annual two-months-free): @madeonsol/plugin-madeonsol 1.9.1, solana-agent-kit-plugin-madeonsol 1.9.1, mcp-server-madeonsol 1.10.2, madeonsol-x402 (PyPI) 1.11.1.
• The ElizaOS plugin's npm page now links to its GitHub repository (missing repository field added).
• GitHub mirror repos synced + re-topiced for discoverability.

One-line WebSocket streaming across all SDKs. Until now every SDK handed you a token and left you to hand-roll the connection — open the socket, refresh the 24h token, reconnect on drop, parse heartbeats, type the events. The new managed client does all of it: client.stream() (TypeScript madeonsol-x402 1.10.0 / Python madeonsol-x402 1.11.0) and client.stream.connect() (bare madeonsol 2.10.0) return a stream you just subscribe-and-listen on, with auto-reconnect (backoff + jitter), token auto-refresh, heartbeat liveness, and typed events for all eight channels (KOL trades, coordination, first-touches, deployer alerts, wallet-tracker, copy-trade, price alerts, sniper deploys).

const stream = client.stream();               // x402
stream.on("kol:trade", (t) => console.log(t.token_symbol, t.action));
stream.subscribe(["kol:trades", "deployer:alerts"]);

The TypeScript clients use the native WebSocket on Node 22+ (with a lazy ws fallback) and zero required dependencies; the Python client is asyncio-based behind the optional madeonsol-x402[stream] extra.

Bare madeonsol SDK reaches full parity. Added the copy-trade namespace (client.copytrade — rules CRUD + signal history) that was the last gap versus madeonsol-x402.

New: public token pages at /token/[mint]. Every token now has a shareable, AI-citable page — live price, market cap, liquidity, rug-safety checks (mint/freeze authority, LP burn, Token-2022 transfer fees), deployer reputation, and which tracked KOL wallets are buying or selling. Reachable from a new Token Lookup entry in the Intelligence menu (paste any mint). Pages carry FAQ + breadcrumb structured data; only tokens with real substance (named, liquid, or with KOL activity) are indexed — the long tail stays noindex to protect crawl budget.

On-chain token naming. Names/symbols for non-pump tokens (Raydium/Meteora/established SPL) are now resolved on-chain — Metaplex metadata accounts and the Token-2022 metadata extension — and cached. mc-tracker resolves each new token at first sighting (off the price hot path), so the highest-search-demand tokens get named and indexed automatically.

Deployer Hunter: false "Unknown" deploy alerts fixed. A parser bug was mis-reading ordinary swaps (which log Instruction: CreateTokenAccount/CreateIdempotent) as brand-new deploys, surfacing already-bonded tokens — some over a year old — as fresh "Unknown" launches. Create detection is now anchored to genuine pump-program token creates (with InitializeMint2 proof), and the auto-discovery that had widened the listener to the whole DEX firehose was reset to the real pump programs. Existing false alerts were cleaned up and affected deployer tiers reconciled.

Universal Wallet API resilience. /v1/wallet/{address} no longer returns a 500 on very high-trade-count wallets — when the 90-day aggregation exceeds the query timeout it degrades gracefully (core flags returned with an enrichment_unavailable flag) and the response is briefly cached, so repeat polls on the same heavy wallet are instant instead of timing out.

15 new blog posts across three content clusters. Trading-bot comparisons (Bloom vs BullX, Bloom vs Trojan, Photon vs Axiom, Banana Gun vs Trojan) and tool reviews (Bullpen, MevX, TradeWiz, Cypherock X1, SafePal), plus a KOL/pump.fun guide set: filtering bot wallets from a KOL list, finding pump.fun tokens before KOLs tweet, why most pump.fun tokens die in the first hour, scoring a new token in 60 seconds, free vs paid KOL trackers, and Cielo vs Birdeye vs Solscan. All wired into hub/spoke internal links.

Sitemap fix — every blog post now indexable. The sitemap was only emitting the blog index page, not the ~360 individual posts (a stale-build artifact). Added hourly revalidation so all published posts now surface to search engines and AI crawlers. IndexNow notified on each new post.

Security: referral-earnings function locked down. The increment_referral_earnings Postgres function was callable by the anon/authenticated roles via PostgREST. Execute is now revoked from everything except the server-side service role (migration 158). No abuse observed — closed proactively after a health check flagged it.

Affiliate click attribution. Blog affiliate links now route through tracked /go/[slug]?source=blog/... redirects for per-post attribution, and admin clicks are excluded from affiliate stats to prevent self-click inflation.

Product structured-data fixes. Resolved Google Search Console warnings on tool pages (missing image and availability fields in the Product/Offer JSON-LD).

Fixed: ~75% of pump.fun graduations were being missed. pump.fun renamed its on-chain graduation instruction (Migrate → MigrateV2), and our parser's exact-match guard silently dropped every V2 migration — so most "bonded" events never fired. Detection now recognizes Migrate, MigrateV2, and future variants, restoring real-time bonded alerts across webhook, WebSocket, and Telegram. Verified live (a graduation recorded ~1 minute after it landed on-chain).

Authoritative catch-up reconciler. A new 5-minute backstop reconciles recently-deployed tokens against the bonding-curve complete flag on-chain — the single source of truth — recovering any graduation the live gRPC stream missed during reconnects, with zero false positives. Idempotent and silent (no duplicate or stale alerts).

Every graduation now counts, including unknown deployers. Detection is keyed on the graduation itself, not on whether we already track the deployer, so bonds from previously-unseen wallets are now recorded. This corrected lifetime bond stats network-wide and promoted ~390 deployers into tracked tiers (12,207 → 12,596).

Sniper Alerts come to PRO. The pre-confirm pump.fun deploy feed — previously ULTRA-exclusive — is now available on PRO, curated to elite + good-tier deployers (the high-signal launches). ULTRA keeps the full firehose: every deployer tier, the all scope, custom watchlists, and the /v1/sniper/by-deployer/{wallet} audit feed.

The curation runs at delivery time across all three channels (webhook, WebSocket, Telegram), so it applies consistently whether you consume sniper:deploy webhooks, the sniper:deploys WS channel, /alert sniper in Telegram, or the GET /v1/sniper/recent read API. Same ~500-800ms pre-confirm head start on both tiers.

Custom deployer watchlist (ULTRA). New GET/POST /v1/sniper/watchlist + DELETE /v1/sniper/watchlist/{wallet} (up to 50 deployers). Turn on "watchlist" scope to receive deploys from only the deployers you track, regardless of tier — works across the read API (?watchlist=true), webhook + WebSocket (sniper_scope: "watchlist"), and Telegram (/alert sniper watchlist). One source of truth across every channel.

Head-start instrumentation. We now reconcile each deshred detection against the confirmed stream and record confirmed_at on sniper_deploys, giving a measured per-deploy head start (currently ~415ms median / ~518ms p90 in production).

New ULTRA feature. Pre-confirmation pump.fun deploy alerts. New token launches surface in the feed ~500-800ms before they confirm on-chain — measured head start in production against our existing CONFIRMED-stream deployer alerts. Delivery on every channel: webhook (sniper:deploy event), WebSocket (sniper:deploys), and Telegram (/alert sniper elite,good). ULTRA-tier exclusive.

Payload. Each alert includes mint, deployer wallet, signature, slot, plus a snapshot of the deployer's reputation (tier, lifetime bond rate, last-10 outcome bitmap). Pre-execution detection — no balances, logs, or compute info in the payload. Honest caveat: ~1-3% of detected deploys can abandon before chain settlement; payloads include confidence: "deshred" so consumers can treat the alert as "buy intent observed", not a guaranteed deploy.

Read API (Ultra). Two new endpoints for backtesting and post-hoc auditing:

• GET /v1/sniper/recent — paginated deploy feed with filters: since, deployer_tier, min_bond_rate
• GET /v1/sniper/by-deployer/{wallet} — deploys filtered to a specific deployer wallet

Telegram. New /alert sniper command in @MadeOnSolAlphaBot. Scope options: elite, elite,good, all, or off. ULTRA-tier check enforced at the command level.

Operator playbook. Full sniper guide added to /developer (under the Sniper spotlight card): pre-built tx templates, priority fees + Jito tip sizing, low-latency infra placement, deployer reputation filtering, buy params, exit triggers, and realistic latency budgets. The head start only converts to fills if your stack is set up to execute inside it.

Bond detection sweep. mc-tracker now runs a 2-minute periodic sweep that catches PumpSwap graduations the gRPC stream missed. Previously, missed bonds were only detected on mc-tracker restart — now max detection delay is 2 minutes. Deployer-listener also enriches missing token metadata from pump.fun API before creating bond alerts.

Hot-token auto-poster. New X post type: every 4 hours, finds the token with the most KOL buyers in the last 30 minutes and posts with full enrichments — live MC, net SOL flow, token age, deployer tier + bond rate, buy/sell sentiment signal, and up to 5 KOL handles tagged. Repeat KOL detection highlights wallets that appeared in the previous hot pick.

Sentiment signals on X posts. Hot-token posts include a plain-language sentiment label based on KOL buy/sell ratio: "Strong accumulation", "Accumulating", "Leaning bullish", "Mixed signals", or "KOLs exiting".

Deploy validation hardened. Zero-downtime deploy script now runs deep checks before swapping nginx: API ping, status endpoint, static assets, and blog content. Failed validation aborts the swap and keeps the old slot running.

Resend webhook improvements. Bounce handler now correctly tracks all bounced addresses. Click tracking enabled for outbound emails.

5 new blog posts. What Is a Solana API, Light Terminal review, gRPC pipeline deep dive, deployer intelligence scoring, signal caller evaluation guide.

New tool. Light Terminal added to directory — social trading terminal with strategy marketplace, creator leaderboard, and automated limit orders on Solana.

Price Alert System — Sub-second token MC dip/recovery alerts. Set a drop % threshold on any tracked token; get notified via webhook or WebSocket when MC drops below baseline. Optional recovery tracking fires when MC bounces back. One-shot lifecycle (watching → dipped → recovered), 30-day auto-expiry. PRO: 5 alerts, ULTRA: 25. New API: 6 CRUD + events endpoints. New WS channel: price_alert:events. New TG command: /pricealert.

5 New API Endpoints:

• GET /kol/scouts/leaderboard — Scout leaderboard: top KOLs ranked by scout score and swarm attraction (ULTRA)
• GET /tokens/{mint}/kol-consensus — KOL buy/sell consensus on a token with exit rate and median entry MC (PRO+)
• GET /tokens/{mint}/peak-history — ATH market cap history with MC at bond and post-bond snapshots (PRO+)
• GET /kol/coordination/history — Historical coordination alert fires (ULTRA)
• GET /deployer-hunter/{wallet}/trajectory?include=daily_snapshots — Daily tier/bonding snapshots (extended)

Wallet Scanner Enrichments:

• Win rate, ROI, best/worst trade, AI-classified verdict ("Degen flipper", "Smart money", etc.)
• Biggest miss: scans all round-trip tokens, calculates missed SOL profit using pump.fun ATH
• Ticker symbols resolved via pump.fun API (was showing contract addresses)
• ATH market cap per token from pump.fun (was showing misleading current MC)
• All enrichments available via REST API (derived block on /wallet/{address}) and Telegram /wallet

SDK v1.9.0 — All 7 packages updated: TypeScript 2.8.0, Rust 0.10.0, x402-TS/Python/MCP/ElizaOS/SAK all 1.9.0.

Deployer Hunter bond detection rebuilt. 96%+ of bonds were being missed. New pipeline: mc-tracker emits pg_notify('pumpswap_bond') on graduation → deployer-listener resolves in near real-time. Zero extra gRPC bandwidth. 436 historical bonds backfilled.

7 new blog posts. CoinTracking vs CoinLedger vs Blockpit, How to Buy SOL on Binance/MEXC, Bitsgap review, CoinStats review, Chainstack RPC review, Sol Trading Bot review, MEXC vs Binance vs Bybit comparison.

11 new MCP servers added to directory (21 total): Phantom, Vybe Network, Flipside, Jupiter, Crossmint, DexScreener, OpenSVM, Memecoin Observatory, Rug Check, PumpSwap, Magic Eden.

Banner advertising system. 5 ad placements across the site (homepage, /tools, /best/[category], KOL Tracker, Deployer Hunter) with "Your project here" placeholders linking to /advertise. Pricing from $75-$150/mo, manually approved via email.

New tools. Monkey Tools, CoinStats API, NordVPN, Surfshark, ProtonVPN, Cryptohopper added to directory.

Other. Promo banner system (CoinStats 10% off). Wallet scan counter on /wallet. Telegram page redesigned. Re-engagement emails sent to 4 silent PRO subscribers.

Three additive surfaces shipped on top of yesterday's v1.8.0 wallet endpoints:

1. Wallet Scanner web page. New /wallet search page under Intelligence in the navbar — paste any Solana address, get the same KOL/Deployer/Alpha flag check plus the new enrichment block in one render. Free, no signup, unlimited scans. The results page (/wallet/{address}) is non-indexed but freely linkable, so the page works as a shareable lookup for tippers, scouts, and the curious.

2. Four API enrichments on /api/v1/wallet/{address}. Additive fields, zero breaking changes:

• top_tokens[] — most-traded tokens in the 90d window with realized PnL per token, plus current MC and peak MC (cross-joined with deployer_tokens for pump.fun launches).
• trading_style — average trade size (SOL), sniper rate (% trades placed in the first 10 buyers of a token), round-trip rate (% tokens with both buys and sells), median hold minutes, dominant action.
• deployer_breakdown — tier distribution of pump.fun deployers this wallet has bought from (ELITE / GOOD / RISING / MODERATE / COLD / unranked). Useful for spotting alpha-buyers vs random degens.
• recent_trades[] — last 10 trades regardless of window with token symbols joined in.

All four are nullable so old SDK consumers ignoring them keep working. Backed by 4 new STABLE SECURITY DEFINER SQL helpers (migration 150).

3. Telegram /wallet command in @MadeOnSolAlphaBot. Same flag-set, light 7-day stats, deeplink to the web profile. Free 3 scans/day per chat, paid tiers unlimited. Rate-limited via the existing rate_limit_buckets (key tg-wallet:{chat_id}).

SDK propagation: all 7 packages bumped to v1.8.1 with the new response fields in the type definitions. No method-signature changes.

madeonsol                          2.7.0  →  2.7.1   (bare TypeScript)
madeonsol-x402                     1.8.0  →  1.8.1   (npm)
madeonsol-x402                     1.8.0  →  1.8.1   (PyPI)
mcp-server-madeonsol               1.8.0  →  1.8.1
@madeonsol/plugin-madeonsol        1.8.0  →  1.8.1   (Eliza)
solana-agent-kit-plugin-madeonsol  1.8.0  →  1.8.1
madeonsol (crates.io)              0.9.0  →  0.9.1   (Rust)

Bonus: stale middleware redirect /wallet → /best/wallets removed (was from a pre-scanner time when the path didn't exist — 113 GSC impressions that previously went to the listicle now land on the real scanner).

All 7 official SDKs ship the new Universal Wallet API surface — same shape across TypeScript, Python, Rust, MCP server, ElizaOS plugin, and Solana Agent Kit plugin.

madeonsol                          2.6.3  →  2.7.0   (bare TypeScript)
madeonsol-x402                     1.7.3  →  1.8.0   (npm)
madeonsol-x402                     1.7.3  →  1.8.0   (PyPI — pip install madeonsol-x402)
mcp-server-madeonsol               1.7.4  →  1.8.0
@madeonsol/plugin-madeonsol        1.7.3  →  1.8.0   (Eliza)
solana-agent-kit-plugin-madeonsol  1.7.3  →  1.8.0
madeonsol (crates.io)              0.8.2  →  0.9.0   (Rust)

Each SDK now exposes 4 new typed methods: wallet.stats(address), wallet.pnl(address), wallet.positions(address), wallet.trades(address, params?) (naming varies slightly per language convention). Full type definitions for every response shape — WalletStats, WalletPnl, WalletOpenPosition, WalletClosedPosition, WalletTrade, etc. — exported from each package so SDK consumers get autocomplete and compile-time validation.

The endpoints themselves shipped separately (see the entry below) — this release is the SDK propagation pass. /api/x402/wallet/* mirrors are wired into the x402 SDKs at the same prices ($0.005 / $0.02 / $0.01 / $0.005). OpenAPI spec bumped to v1.3.0 with full schemas for every wallet endpoint, so downstream code generators stay in sync.

Test status: 221 cases passed / 0 failed across REST matrix (200), WS events (5+6), SDK smoke tests (10), velocity-shape regression guard (7), and the new wallet-endpoint regression suite (17/17 — all filter combinations).

Audit triggered by an end-of-day "is the DB secured?" check found five tables with row-level security disabled and the Supabase anon role (the public key shipped to every browser) granted full CRUD via PostgREST: mv_early_buyer_pnl, sniper_wallets_cache, bundler_wallets_cache, token_blacklist, and early_buyer_pnl_refresh_state. Per-wallet realized PnL and the internal moderation blacklist were readable; cache tables and refresh-state were also DELETE/TRUNCATE-able.

Migration 148 enables RLS on all five tables (deny-by-default) and revokes privilege grants as defense in depth. No code changes needed — all endpoints continued working. Regression guard added for future RLS changes.

Four new Pro/Ultra endpoints under /api/v1/wallet/{address} let you pull profile data for any Solana wallet — not just the 1,058 we curate as KOLs. Same FIFO cost-basis math, same response shape, but the address space is everyone we've seen trade through our DEX firehose (90-day window, ~38 days of historical data right now).

GET /api/v1/wallet/{address} — cheap stats lookup. Returns total_trades, buys/sells split, SOL in/out, unique tokens, first/last seen, plus cross-product flags (is_kol, is_alpha_tracked with bot_confidence + win rate + net PnL, is_deployer with tokens deployed). Backed by a get_wallet_stats() SQL function that reads the existing idx_token_trades_wallet_time — sub-100ms on a wallet with 1,123 trades across 324 tokens. No materialised view, no new ingestion pipeline.

GET /api/v1/wallet/{address}/pnl — full PnL with the same shape as /api/v1/kol/{wallet}/pnl: realized + unrealized SOL, profit factor, avg + median hold minutes, max drawdown, daily PnL curve (UTC), closed positions (sorted by pnl desc) with ROI %, open positions with current price fetched live from our market-cap tracker. Cached in wallet_analyses with dynamic TTL — 5 min for wallets active in the last 24h, 1 hour for 1–7d old, 24 hours for dormant. Cache hits are free against your daily quota.

GET /api/v1/wallet/{address}/positions — open lots only, leaner response for client UIs that don't need the full PnL summary. Shares the /pnl cache so if you've recently called /pnl for this wallet the /positions call is a cache hit immediately.

GET /api/v1/wallet/{address}/trades — paginated raw trades. Cursor-based on (block_time, id) for stable DESC ordering. Filters: action (buy/sell), token_mint, since/until Unix timestamps, limit (1–500, default 100). Response includes next_cursor + has_more.

Honest about the data window. Cost basis is only observable inside the 38-day data window (we started capturing every DEX swap on 2026-04-12). A wallet that bought a token 60 days ago and sells it today gets the sell counted but no matching cost basis — overflow sells are silently discarded rather than inventing a realized PnL number. notes.cost_basis_observable_from in the response surfaces the cutoff so clients can warn users when relevant.

Why this matters for SDK users. Pre-1.8 you could only get rich PnL data for hand-curated KOL wallets. Now any wallet works — feed an address from a Twitter pump screenshot, a deployer's wallet, a trader who DM'd you, and get the same shape back. The four endpoints will land in the next SDK release across all 7 packages.

Suite addition: a new scripts/test-wallet-endpoints.mjs runs as part of /testapi covering every filter combo (action, token_mint, since/until, cursor pagination, limit clamp, invalid inputs, unknown wallets, cache hits). 17/17 green on first prod run.

Heads up if you build on top: open-position counts are bounded by mc-tracker's price coverage — mints without a current price in our cache return unrealized_sol: null rather than a fabricated zero. Same with the new MC clamp shipped earlier today on kol_trades (see below): if mc-tracker's quoted price is 5× the swap-implied rate, the MC and price fields land as null on that trade rather than letting a momentary phantom-pool number poison history.

When a KOL trade lands, kol-tracker fetches the current market cap from mc-tracker and writes it into kol_trades.market_cap_usd_at_trade. That value is now sanity-clamped: if mc-tracker's quoted per-token price is more than 5× higher than the swap-implied rate (sol_amount / token_amount × sol_usd), the MC and price fields are nulled before writing to the row.

This was triggered by a 2026-05-19 autopost that announced $MC: $72.4K → $57.9M MC — the high-MC number came from two trades where mc-tracker quoted a price 16× and 182× the actual swap rate, briefly during a graduation-moment when a phantom routing wallet became the primary pool. The two bad rows poisoned the 6-hour band-crosser query downstream.

The clamp is inflation-only. Creator-fee PumpSwap tokens where the trader receives ~0.15% of bought tokens have implied price way higher than headline — those are not clamped because the headline is correct, the implied is the distorted one.

Downstream protection: webhook deliveries, WebSocket kol:trade events, the Telegram bot's "@ MC $X" line, copy-trade signal payloads, charts, and the X autopost all read the same market_cap_usd_at_trade column. One clamp at the write boundary protects every consumer.

In the first 5 minutes of running, the clamp fired exactly once on a HENRY token (different mint than the headline-named one) where mc-tracker briefly quoted $0.0087/tok vs implied $0.001/tok (8.4×). The good first-delivery from the redundant multi-region gRPC streams had already inserted the correct row; the clamp on the second delivery was a correct no-op.

The MadeOnSol Alpha Bot moves from broadcast-only to interactive for the free tier. Previously, free users got the /digest once per day plus on-demand lookups (/token, /wallet, /deployer) and nothing else — real-time fan-out was paid-only. That made the bot feel like a newsletter and drove a 37% pause rate among linked free users.

/alert kol and /alert deployer are now open to the free tier, with two server-side caps and full user-set filters:

• /alert kol — up to 30 KOL trades per day matching your own rule. Set your own min_sol threshold (e.g. /alert kol 5 for buys ≥ 5 SOL), scope to a specific KOL (/alert kol "Casino"), token mint, or wallet. Same filter grammar as the paid tiers.
• /alert deployer elite,good — up to 3 deployer launches per day matching the tiers you picked. All five deployer tiers (elite, good, moderate, rising, cold) are selectable.

Both caps reset at 00:00 UTC. Hit one and the bot silently stops fanning out that rule type for the day — no scary "rate limit" message, just quiet — and resumes after midnight. The user-set filters (min SOL, KOL name, token mint, deployer tier) decide which trades make the cut; the bot doesn't second-guess your taste.

Paid features stay paid. Coordination alerts (/alert coord), copy-trade signals (/alert copytrade), and the wallet tracker (/watch) remain Pro/Ultra. Free users see those submenus but the toggle buttons are gated with a "requires Pro/Ultra" message. The 30/day kol_trade cap is also the main reason to upgrade — Pro removes it entirely.

If you're already linked, /menu → 🚨 Configure alerts → 📊 KOL trades to start. If you don't have a MadeOnSol account yet, madeonsol.com/developer takes about 30 seconds.

Five user-facing changes ship together — most of them long-overdue housekeeping around the API funnel.

New public /pricing route. Plans, limits, and feature matrix now live on a dedicated marketing page at madeonsol.com/pricing. The /developer page stays focused on its job — signing in, generating + managing keys, managing your subscription. All "see plans / free tier / starts free at…" CTAs across the site, the LLM docs, the Telegram bot, and changelog point at /pricing; action CTAs ("Generate your key", "Manage your subscription") keep pointing at /developer.

Public demo key on /api-docs. The try-it widget on /api-docs is now wired to a public demo key — no signup needed. Capped at 20 req/hr per IP across 3 endpoints (/kol/feed, /deployer-hunter/alerts, /token/{mint}). Validate the response shape in 10 seconds before signing up.

429 responses now carry upgrade info inline. Hitting the daily or burst cap used to return a bare 429 { error: "rate_limit_exceeded" } plus the standard Retry-After header. The body now includes the caller's current tier, the violated limit, the absolute resets_at ISO timestamp, and an upgrade_url pointing at /pricing. SDKs can surface "you're on Free, upgrade to Pro for 50× headroom" without a second /me round-trip. Retry-After is still set on every 429 (seconds-until-reset for daily, seconds-until-burst-window-rolls for burst).

Pro headline sharpened. The Pro tier was previously sold as "Telegram + full v1 API", which understated what it actually unlocks. The new headline across the pricing page, the bot's /upgrade message, the LLM docs, and the SDK READMEs is "Production webhooks + copy-trade signals" — HMAC-signed webhooks, per-rule copy-trade delivery, coordination alerts with custom thresholds, wallet tracker, and the WS streaming surface. The 10k req/day + 120 burst/min limits are still the same — only the framing changes.

Trader tier retired from sale. The $25/mo Trader tier (Telegram-only alerts) is no longer purchasable. Existing Trader subscribers keep their access through the end of their billing period — no forced migration. The lineup is now Free / Pro / Ultra everywhere. References to Trader in marketing surfaces (pricing page, bot upsells, LLM docs, this changelog going forward) are gone; the underlying database tier code and existing Trader subscriber flows are unchanged.

SDK surface sync — docs/marketing-URL patch (no API changes):

madeonsol                          2.6.1  →  2.6.2   (bare TypeScript)
madeonsol-x402                     1.7.1  →  1.7.2   (npm)
madeonsol-x402                     1.7.1  →  1.7.2   (PyPI — pip install madeonsol-x402)
mcp-server-madeonsol               1.7.0  →  1.7.2
@madeonsol/plugin-madeonsol        1.7.0  →  1.7.2   (Eliza)
solana-agent-kit-plugin-madeonsol  1.7.0  →  1.7.2
madeonsol (crates.io)              0.8.0  →  0.8.1   (Rust)

Every README, JSDoc, docstring, tool-description, error message, code-comment, and CLI hint across 30+ files now sends prospects to /pricing (public, free-tier card visible without auth) instead of /developer (login-gated). Action-tone refs ("sign in", "manage your key") still point at /developer. Trader tier dropped from package README tier lists. Rust SDK README ULTRA annual price corrected ($1990 → $1490). No runtime behaviour changes; SDK types unchanged; ApiTier::Trader / "TRADER" union variant retained for grandfathered subscriber rows.

Two related changes shipped today.

/api/v1/kol/coordination now returns velocity fields alongside every cluster: mc_change_pct, volume_usd, mev_volume_pct (each keyed by 5m/15m/1h/2h/4h) and history_age_seconds. Same shape as /token/{mint} and /copytrade/signals. Lets coordination consumers tell whether a cluster is firing into a moving token or before the move, in one call instead of N follow-up /token/{mint} lookups. Sparse — only windows with enough mc-tracker history are populated.

SDK velocity-shape patch (1.7.1 / 2.6.1): the 1.7.0 / 2.6.0 release shipped TypeScript types and README examples for velocity in a velocity[window].mc_change_pct shape that didn't match the API's actual mc_change_pct[window] shape. Anyone reading client.token.get(...).velocity?.["1h"]?.mc_change_pct was getting undefined. Patched packages:

madeonsol         2.6.0  →  2.6.1   (bare TypeScript)
madeonsol-x402    1.7.0  →  1.7.1   (npm + PyPI)

mcp-server-madeonsol, plugin-madeonsol, solana-agent-kit-plugin (1.7.0) had only generic mentions and stay at 1.7.0. Rust SDK (madeonsol crate, 0.8.0) doesn't surface velocity yet — no patch needed. The fix is type-only; runtime API contract is unchanged.

Three new API surfaces, two long-deferred cleanups, and a defensive throttle for endpoint probers.

New endpoints:

GET /api/v1/me        → all tiers
GET /api/v1/tokens    → PRO+

GET /api/v1/me reads from the same in-memory counters that drive rate-limit enforcement — quota.daily.remaining is authoritative, no header parsing required. Returns tier, subscription block (status, billing_cycle, current_period_end, started_at), quota.daily (limit/used/remaining/resets_at), quota.burst (limit/used/remaining/window_seconds), and per-feature usage across webhooks, copy-trade wallets/rules, coordination rules, first-touch subscriptions, ws/dex connections, and wallet-tracker watchlist. Useful for self-throttling clients and quota-aware retry logic.

GET /api/v1/tokens is a filtered, sortable directory across every active mint we track — complements the single-mint /token/{mint} and the KOL-scoped /kol/tokens/{hot,trending}. Server-side filters: min_mc, max_mc, min_liq (default 2000 USD — set 0 to disable phantom-MC dust floor), active_h, primary_dex (pumpfun/pumpswap/raydium/meteora/orca/raydium_clmm), authority_revoked, exclude_token2022, min_lp_burnt_pct. Computed post-filters (over-fetches 3× and filters in app): min_volume_1h_usd, max_mev_share_pct, mc_change_1h_min_pct, mc_change_1h_max_pct. Sort: mc_desc / mc_asc / last_trade_desc / liquidity_desc / cumulative_volume_desc. Pagination response includes post_filtered: true so clients can detect when computed filters trim a page below limit.

// Momentum scanner: liquid mints up >20% in 1h, low bot share
const { tokens } = await client.token.list({
  min_liq: 10000,
  min_volume_1h_usd: 5000,
  max_mev_share_pct: 60,
  mc_change_1h_min_pct: 20,
  sort: "mc_desc",
});

Structured 400 on /token/{mint}: invalid mints now ship code: "invalid_mint", reason (specific diagnosis — "too short — got 8 chars, need 32-44", "contains '0' which isn't valid base58", etc.), received, received_length, expected_length, example, and a docs URL. No more trial-and-error.

Velocity / MEV-share fields added to every TokenResponseBody (catching the SDK up to the 2026-05-07 server-side ship): mc_change_pct, volume_usd, mev_volume_pct (each keyed by 5m/15m/1h/2h/4h) plus history_age_seconds on the parent. mev_volume_pct is unique to MadeOnSol — flag wash-pump patterns where headline volume is bot-driven (sandwich/Jito-bundle MEV) rather than organic demand. Note: the 1.7.0 typed shape was wrong (velocity[window] instead of field-keyed) — patched in 1.7.1 / 2.6.1, see entry above.

Per-IP 401 throttle: repeated authentication failures from the same IP now hit a 30-failure/min cap that short-circuits to a 429 with a tiny body — stops endpoint-fishing without DB lookups. Legitimate clients with a typo get 30 retries before the cap fires.

TRADER tier (Telegram) unlocks coordination + copy-trade alerts: the $25/mo Trader tier now includes 1 copy-trade wallet + 1 coordination alert rule, delivered exclusively over Telegram (/alert copytrade <wallet>, /alert coord on). REST/WS/webhook access for those endpoints stays PRO+ — the underlying rules are auto-created on direct DB write when a Trader user opts in via the bot. Default coord thresholds locked at min_kols=5, window=15min, cooldown=30min for Trader; PRO+ keep custom thresholds.

TG bot /start UX: new unlinked users now see one real sample alert appended to the welcome message (no rate-limit hit), the $25/mo price line moved out of the cold open into /upgrade, a "Just /pause anytime to silence" reassurance line was added, and the post-link flow renders a one-tap "🚨 Configure my alerts" keyboard instead of plain text.

Removed: the deprecated avg_entry_mc_usd / entry_mc_samples fields are now fully gone from leaderboard endpoints, SDK types, READMEs, openapi-spec, llms.txt, and MCP tool descriptions. If you were reading them, switch to per-trade market_cap_usd_at_trade (via the v1.6 MC enrichment).

SDK versions published:

madeonsol                          2.5.0  →  2.6.0   (bare TypeScript)
madeonsol-x402                     1.6.0  →  1.7.0   (npm)
madeonsol-x402                     1.6.1  →  1.7.0   (PyPI — pip install madeonsol-x402)
@madeonsol/mcp-server              1.6.0  →  1.7.0
@madeonsol/plugin                  1.6.0  →  1.7.0   (Eliza)
@madeonsol/solana-agent-kit-plugin 1.6.0  →  1.7.0
madeonsol (crates.io)              0.7.0  →  0.8.0   (Rust)

All packages add a me() method (or client.rest.me() in Python) and a tokensList() / token.list() / tokens_list() method, plus expose the velocity/MEV-share fields on token responses. The MCP server gains two new tools: madeonsol_me and madeonsol_tokens_list. The Eliza and Solana-Agent-Kit plugins gain matching meAction and tokensListAction.

The MC enrichment from the last release now becomes a first-class filter. Every signal surface — REST, WebSocket, per-rule alerts, the Telegram bot — accepts min_mc_usd and max_mc_usd so callers can scope every request or every alert rule to a specific market-cap band. "Show me only sub-$50K KOL trades". "Skip every coordination signal on tokens above $5M". "Auto-fire the copy-trade only when the source bought between $100K and $1M MC".

REST API — four endpoints accept the band:

/api/v1/kol/feed?max_mc_usd=50000           → only sub-$50K KOL trades
/api/v1/kol/coordination?min_mc_usd=100000  → skip micro-cap coordination
/api/v1/kol/first-touches?max_mc_usd=200000 → S-tier scout entries below $200K
/api/v1/copytrade/signals?max_mc_usd=500000 → drop signals above $500K

/kol/feed filters at the database layer (uses the existing idx_kol_trades_mc_at_trade partial index). The other three filter post-aggregate on whichever MC concept matches the endpoint — /coordination filters on the cluster's MC at the chronologically-first KOL buy, /first-touches on the at-touch MC, /copytrade/signals on the source trade's MC. Trades with unknown MC drop out when the band is set — the caller asked for a specific range, we don't pretend "unknown" matches.

WebSocket — subscribe-time bands on kol:trades, kol:first_touch, and kol:coordination. The server-side filter drops events that miss the band before pushing — saves bandwidth and lets your bot wake on relevant alpha only.

ws.send(JSON.stringify({
  type: "subscribe",
  channels: ["kol:trades"],
  filters: { min_mc_usd: 10000, max_mc_usd: 250000 },
}));

Per-rule alert tables now carry the band. Three user-rule tables — coordination_alert_rules, copytrade_subscriptions, kol_first_touch_subscriptions — gain min_mc_usd / max_mc_usd columns. The signal-evaluator reads them on every trade and drops triggers that fall outside the rule's band before the alert ever fires. Lets you persist "alert me on KOL coordination, but only on tokens under $50K MC" as the rule itself instead of post-filtering downstream.

Telegram bot — global per-user MC band. New /mc command sets a band that overlays on top of every alert the bot delivers to you, regardless of which underlying rule fired:

/mc 50k-1m   → only alerts on tokens between $50K and $1M MC
/mc -500k    → only alerts on tokens at or below $500K
/mc 200k-    → only alerts on tokens at or above $200K
/mc          → show current band
/mc clear    → remove the band

The outbox poller filters at delivery time using the user's pref. Daily digests (no per-token MC) are unaffected; alerts whose extracted MC is unknown still deliver (we don't penalise missing data on the noise-filter side).

SDKs — bumped:

• madeonsol (npm, bare) → 2.5.0
• madeonsol-x402 (npm + PyPI) → 1.6.0
• mcp-server-madeonsol → 1.6.0
• @madeonsol/plugin-madeonsol → 1.6.0
• solana-agent-kit-plugin-madeonsol → 1.6.0
• madeonsol (Rust crate) → 0.7.0

All min_mc_usd / max_mc_usd params are optional — the SDK call signatures stay backwards-compatible. Param fields also live on the coordinationAlerts.create/update and firstTouchSubscriptions.create/update methods so persistent rules carry the band end-to-end.

Cleanup — avg_entry_mc_usd removed. The deprecated avg_entry_mc_usd and entry_mc_samples fields on /kol/leaderboard and /alpha/leaderboard are gone. They were a 2026-05-06 experiment that the new MC band on requests subsumes — instead of asking for "the avg entry MC for this KOL", filter the trade feed by max_mc_usd and you get the actual sub-set you cared about.

Coverage breadth (since 1.5.0): Moonshot bonding curve indexed in kol-tracker + dex-stream. Meteora CPAMM (DAMM v2) pool state subscription. USD1 added to the recognised quote-mint set. Phantom-pool rejection and a /price/{mint} trades_24h ReferenceError fix on the side.

Ops note: Backup format upgraded for improved restore reliability. No customer-visible change.

The big one. Every call to /api/v1/token/{mint} now returns a per-window breakdown of how the market cap moved and what kind of volume drove it.

{
  "token": {
    "mint": "...",
    "market_cap": 423000,
    "mc_change_pct": { "5m": 8.2, "15m": 31.4, "1h": 62.1, "2h": 75.0, "4h": 87.0 },
    "volume_usd":     { "5m": 42000, "15m": 118000, "1h": 340000, "2h": 500000, "4h": 920000 },
    "mev_volume_pct": { "5m": 18.4, "15m": 22.1, "1h": 27.3, "2h": 31.8, "4h": 34.2 },
    "history_age_seconds": 14400
  }
}

Window choice. 5m / 15m / 1h / 2h / 4h matches memecoin lifecycle: 5m and 15m for entry timing, the 1h-2h-4h gradient is where pumps separate from fades. We deliberately skipped 6h and 24h because most memecoins don't survive that long — the survivors are a different product surface.

Volume is split into organic and MEV. volume_usd excludes sandwich and Jito-bundle bot churn (mc-tracker tags these per-trade via the existing MEV detector). mev_volume_pct surfaces the MEV share as a separate field so traders can flag wash-pump patterns. A token with volume_usd.4h: 920k and mev_volume_pct.4h: 35% is materially different from the same headline volume at 5%. Nobody else surfaces this.

Reorg-safe. mc-tracker consumes from dex-stream's CONFIRMED-commitment Yellowstone subscription (~1-3s lag from chain head, vs shred's sub-150ms). Cumulative volume counters are stable across reorgs at this commitment depth.

Coverage. Window keys are only present when the token has been tracked long enough — a 1-hour-old token only returns 5m, 15m, and 1h (not 2h or 4h). history_age_seconds reports our in-memory ring's coverage so SDKs can branch cleanly without probing for missing keys.

Heads-up after first deploy. mc-tracker's history ring rebuilds in memory; expect roughly a 4-hour warmup before all windows are populated for tokens that existed before deploy. Subsequent restarts hydrate cumulative counters from the persisted columns and warm up faster (the ring itself is rebuilt from scratch but counters carry).

Backed by migration 129 (18 new columns on token_prices), mc-tracker's new in-memory velocity ring (24-byte tuples per token, sparse, 60s append rate-limit, 4h trim), and a projectMcDeltas helper in mc-enrichment.ts.

Also enriched with the same shape (REST):

• POST /api/v1/token/batch — same per-mint deltas as the single-mint endpoint, batched up to 50 mints/call.
• GET /api/v1/copytrade/signals — every signal now carries the source token's current mc_change_pct, volume_usd, mev_volume_pct alongside the existing market_cap_usd_at_trade. Lets copy-trade clients see at a glance whether the signal token is still pumping or already faded.

WebSocket + webhook payloads — every event with a token_mint now carries velocity:

• mc:update broadcast (consumed by ws-streaming WS subscribers + webhook-worker push customers) now includes mc_change_pct, volume_usd, mev_volume_pct, history_age_seconds. ~300B → ~500B per payload, well under the 7,500B budget.
• kol:trade — token's velocity context attached at emit time (the trader bought into a token already up 62% in 1h with 18% MEV share, or into a flat token).
• kol:coordination — cluster trigger token's velocity context.
• deployer:alert + deployer:bond — the launching token's velocity right at alert time.
• wallet_tracker:event — tracked-wallet trade target token's velocity context.
• copytrade:signal — same velocity fields as the REST endpoint, on every fire.

Telegram alerts now render velocity: Every paid TG alert template (KOL trades, deployer launches, deployer bonds, KOL coordination clusters, wallet activity, copy-trade signals) carries one extra line:

📈 +62.1% / 1h · vol $340K · 🤖 18% MEV

The MEV badge only fires when ≥10% of the window's volume is sandwich/bundle activity — that's the signal that a headline pump may be wash-traded rather than organic. Window picked automatically from the most informative one available (1h preferred, falls back to 15m → 5m → 2h → 4h).

Two ergonomics fixes driven by 7-day audit-log review.

Token endpoints — clearer error on tickers. /api/v1/token/{mint}, /api/v1/tokens/{mint}/buyer-quality, and /api/v1/tokens/{mint}/cap-table now return a richer 400 when the path isn't a base58 mint:

{
  "error": "Invalid token mint address",
  "hint": "Pass a Solana base58 mint address (32-44 chars). Tickers like 'BTC', 'ETH', or 'XRP' aren't supported because they aren't Solana-native assets. For SOL, use the wrapped SOL mint: So11111111111111111111111111111111111111112.",
  "received": "BTC"
}

The audit log showed users hitting /token/SOL, /token/BTC, /token/AAPL, /token/CRO, /token/XRP and burning rate-limit on cryptic 400s. The hint text points them at the wrapped SOL mint and explains why the rest don't have Solana-native equivalents.

/api/v1/deployer-hunter/{wallet} — 404 → 200 with is_deployer: false. Untracked wallets used to return 404 with { "error": "Deployer not found" }. They now return 200 with:

{
  "is_deployer": false,
  "wallet": "<echoed>",
  "deployer": null,
  "pump_stats": null,
  "pump_tokens": [],
  "pump_error": null
}

Backwards compatible — clients checking if (response.deployer) still see falsy. Branch on is_deployer going forward. The change matches user intent: "is this wallet a deployer?" is a feature, not an error.

The MC-at-trade-time work that landed yesterday now flows through every signal surface — every paid endpoint, every WebSocket event, every webhook, every Telegram alert, and the leaderboards.

REST endpoints — new fields:

• GET /api/v1/copytrade/signals — market_cap_usd_at_trade, price_usd_at_trade (joined from the source kol_trades row by tx_signature), plus current market_cap_usd/last_price_usd from token_prices. No more separate /token round-trip after every signal.
• GET /api/v1/kol/coordination — market_cap_usd_at_first_buy (cap at the cluster's chronologically-first KOL buy) + current market_cap_usd/last_price_usd per token. Distinguishes coordinated accumulation at micro-cap from late-stage chasing.
• GET /api/v1/kol/alerts/recent — consensus_cluster alerts now match fresh_token_kol_buy's shape: market_cap_usd_at_first_buy + current MC fields.
• GET /api/v1/kol/first-touches — market_cap_usd_at_first_buy, price_usd_at_first_buy (joined via tx_signature), plus current market_cap_usd/last_price_usd. Lets the scout-tier filter combine with cap band ("S-tier scouts entering at <$50K MC").
• GET /api/v1/kol/leaderboard — avg_entry_mc_usd + entry_mc_samples per KOL, computed live from buys in the period. Surfaces who's playing micro-cap vs mid-cap.
• GET /api/v1/alpha/leaderboard — same avg_entry_mc_usd + entry_mc_samples per wallet (null + 0 for non-KOL wallets).
• GET /api/v1/deployer-hunter/stats — avg_mc_at_alert_usd_30d per tier (elite/good/rising) + sample count. Shows whether elite deployers launch at micro-cap or already-pumped.

WebSocket + webhook payloads — three event types newly carry MC:

• kol:first_touch (live + replay) — market_cap_usd_at_trade + price_usd_at_trade flow through via the updated record_kol_first_touch Postgres trigger.
• kol:coordination — triggering_trade.market_cap_usd_at_trade + price_usd_at_trade.
• copytrade:signal — market_cap_usd_at_trade + price_usd_at_trade on every signal.

Telegram bot — five surfaces newly enriched:

• copytrade:signal alerts: bought 5 SOL of $TOKEN at $50K MC
• kol:coordination alerts: Latest in: X (5 SOL at $50K MC) on the triggering trade line
• /token <mint> adds a current-MC line: 📈 MC $50K · liq $10K · on pumpswap
• /wallet <addr> shows @ $50K MC on each recent trade
• /digest top-tokens-by-KOL-interest now includes avg $50K MC per token

Website:

• KOL leaderboard table: new Avg Entry MC column with sample-count tooltip (micro-cap vs mid-cap trader signal).
• KOL profile token-PnL table: new Avg Buy MC column.

Pipeline reliability fixes shipped alongside (root causes that dropped accuracy):

• mc-tracker flushDirty now chunks at 500 rows per tx — eliminated the ~9% flush-failure rate from statement_timeout on large UPSERTs.
• Eager-fetch hint from kol-tracker: when /mc/<mint> misses for a KOL trade, mc-tracker preemptively fetches mint supply + (if tx_signature provided) synthesizes a swap event from the tx, eliminating the bootstrap-lag window.
• Bags.app pool support: activity-based authority bypass (liquidity_usd ≥ $5K AND swap_count ≥ 3) admits real Bags pools whose Meteora-wrapped non-PDA authorities previously failed phantom-pool detection.
• PumpSwap canonical pool-state subscription: Pool state account (245B, owner pAMMBay…) decoded via the official IDL → token.pumpswap_canonical[quote_mint] registry. Pool entries whose pool_address doesn't match the canonical token-vault get flagged is_canonical=false and excluded from primary selection / VWAP / last_price propagation. Closes the creator-fee redirect-treasury contamination class.
• Multi-hop Jupiter routes (≥2 underlying DEXes in one tx) are now tagged dex=jupiter so mc-tracker's existing jupiter filter rejects them at handleSwap entry — no more phantom router-as-pool entries (the Apple $46M-MC bug class).
• Stablecoin filter: KOL trades where token_mint ∈ {SOL, USDC, USDT} are dropped before insert — no more "$KOL bought 100 SOL of USDC" noise on the feed.

Tools: SDK packages already at 1.4.0 from yesterday's bump pick up the new fields automatically (untyped-access). A 1.5.0 release with full TS type extensions across all 5 SDKs ships next session.

Every KOL trade now ships with the token's market cap at the exact moment the swap fired. Sourced live from our in-memory price tracker (the same one that powers /api/v1/token/{mint}), not from a Dexscreener round-trip — so the number reflects the real cap during a fast-moving wave, not whatever the chart settled at later.

REST: GET /api/v1/kol/feed, GET /api/v1/kol/alerts/recent, GET /api/v1/kol/{wallet} — each trade gains market_cap_usd_at_trade and price_usd_at_trade (USD; nullable for tokens we don't track yet).

WebSocket: the kol:trade event payload includes both fields automatically — ULTRA WS subscribers see them with no client change.

SDKs: bumped — npm madeonsol 2.3.0, madeonsol-x402 1.4.0, @madeonsol/plugin-madeonsol 1.4.0, solana-agent-kit-plugin-madeonsol 1.4.0, mcp-server-madeonsol 1.4.0, PyPI madeonsol-x402 1.4.0, crates.io madeonsol 0.5.0. TypeScript and Rust SDKs surface the new fields as typed optionals; Python passes them through in the response dict.

TG alerts: KOL ALERT messages now read e.g. Goyim bought 5.05 SOL of $WURK at $18K MC, with sells correctly labeled sold.

Storage: persisted on kol_trades (migration 126) so historical "show KOL trades that hit MC < $X" queries work end-to-end. Backfilled trades skip the enrichment to avoid stamping current state on old block_times.

Two days after launch, the bot got a UX pass driven by the friction we watched in production. Fifteen slash commands collapse into a single button hub; the deep-link signup is replaced by a 1-tap Mini App; three new free lookup commands work without an account.

/menu hub (new) — five buttons replace the wall of slash commands: 📊 Discover (lookups + digest), 🚨 Configure alerts (tap-to-toggle, no grammar), 👁 Wallet tracker, 👤 Account (tier, usage, pause/resume), ❓ Help. Power-user CLI commands all still work — they're just hidden from the slash autocomplete.

Free lookup commands (new, no signup) — /token <mint> returns unique KOL buyer count, still-in vs exited split, momentum (buyers in 1h / 15m / 5m), total SOL bought vs sold, deployer tier, and the latest 5 KOL buyers. /wallet <addr> returns KOL identity (name, strategy, X followers) if tracked, plus 7-day buys/sells/unique-tokens, SOL in vs out, and the latest 5 trades. /deployer <addr> returns tier, bond rate, last-10 streak, avg time-to-bond, peak MC of best token, and recent launches with bond status.

1-tap Mini App signup (new) — old flow: visit /developer in a browser → click Connect Telegram → follow the deep link back into the bot → confirm. Three context switches, two browser tabs. New flow: open the bot → tap "Create free account (1 tap)" → sign in via Google or email inside the Telegram Mini App → done. TG chat binds via a signed HMAC token; webview auto-closes via WebApp.close(); works on iOS / Android / desktop. Existing accounts are detected and re-bound on the same screen.

Tap-to-toggle coordination presets — /menu → Configure alerts → 🧬 Coordination now offers 🟢 Strict (5 KOLs / 15 min) · 🟡 Moderate (4 / 10) · 🔴 Aggressive (3 / 5) · 🔇 Off. Persists into coordination_alert_rules under name='tg-bot' so the same rule shows up in the WebSocket subscription.

📤 Share as image — every /token output now ships with a Share-as-image button that posts a 1200×630 PNG (rendered server-side via next/og) with our brand baked in. Drop straight into X, Discord, or your group chat.

Inline confirms for destructive actions — /menu → Account → 🔌 Unlink now morphs into a Yes / Cancel inline keyboard instead of asking the user to type /unlink. One tap to ask, one tap to confirm.

Slim slash-menu — BOT_COMMANDS registered with Telegram trimmed to 6: start, menu, digest, sample, upgrade, help. Everything else still works when typed manually.

Alpha-wallet bot detection improved (migration 124) — mv_alpha_wallets.bot_confidence now flags as high when tokens-per-active-hour > 5, when win rate ≥ 1.0 over ≥10 samples, or when the burner pattern (>10 tokens in under 6 active hours) is met. Filters out the obvious bot 100%-winrate wallets from the homepage scout list.

Landing page refresh: the Telegram landing page (since removed) led with the free commands and the 1-tap onboarding. Pricing on /solana-api updated to reflect the free lookups in the BASIC tier and the tap-to-toggle config in the TRADER tier.

Five live alert streams pushed to your Telegram DM in under 2 seconds end-to-end: KOL trades, Pump.fun deployer launches and bonds, KOL coordination clusters, copy-trade signals, and wallet-tracker events. Same pg_notify pipeline our WebSocket customers already use — Telegram is just another delivery target.

@MadeOnSolAlphaBot (new) — open the bot, run /digest for top tokens & scouts (last 24h), or /sample for one delayed real alert. Both work free, no signup. Connect your account at /developer → "Connect Telegram" to enable real-time delivery.

/alert grammar — /alert kol N (catch-all min SOL), /alert kol "Casino" 1 (per-KOL), /alert kol mint <mint> 1 (per-token), /alert kol wallet <addr> 1 (per-wallet), /alert deployer elite,good, /alert tracker on, /alert copytrade on, /alert coord on. Append off to disable any rule. /rules lists everything active, /delete <id> removes one.

Alert enrichment — every KOL alert ships with the trader's 7-day win rate; deployer alerts ship with the full track record (lifetime bond rate, last-10 outcome streaks, avg time-to-bond, peak market cap of the deployer's best token); coordination alerts ship with score 0-100, cluster avg win rate, exited count, and top 5 names.

Group mode (Ultra) — add the bot to a Telegram group, link from an Ultra account (/start link_<token> in the group), alerts broadcast to everyone in the chat. Per-chat rate gate auto-throttles to Telegram's 20 msg/min group cap.

Pricing: free /digest + 1 daily /sample for everyone; Trader $25/mo unlocks real-time KOL + deployer alerts; Pro / Ultra add copy-trade, coordination, wallet tracker, group-mode broadcasting.

Three bot tokens already provisioned (@MadeOnSolAlphaBot, @MadeOnSolAlpha2Bot, @MadeOnSolAlpha3Bot) — single bot today, sharded fan-out kicks in at 3k+ users. Outbox delivery uses FOR UPDATE SKIP LOCKED row claiming, per-chat 1msg/sec gate, global 25/sec token bucket. Daily /digest cron + 7d tg_outbox retention sweep run via pg_cron.

Landing page: /telegram (since removed). Docs: /help inside the bot.

New product surface for tracking the moment a tracked KOL first buys a token — backtested as a meaningful leading indicator of multi-KOL coordination. 38d / 491k buys / 72,549 events analyzed; conditioning on top scouts (S-tier) lifts ≥3-follower hit rate from ~14% baseline to ~50%.

GET /api/v1/kol/first-touches (new) — every first KOL buy, filterable by min_scout_tier (S/A/B/C), min_kol_winrate_7d, min_n_touches, strategy, token_age_max_min, min_first_buy_sol, mint_suffix, plus since / before cursors. preset=scout and preset=fresh_launch shortcuts apply curated filter sets. include=followers_4h attaches retrospective follower counts for events ≥4h old. ULTRA gets the KOL wallet field; PRO/BASIC get name + scout context.

WebSocket kol:first_touches (new) — sub-second push on the same channel infrastructure as kol:coordination. Filterable at subscribe time on min_scout_tier, mint_suffix, min_first_buy_sol, kol, min_n_touches. PRO + ULTRA. Median lead time before the second KOL is 12 seconds, so the WS surface is the only one fast enough for automated trading.

POST /api/v1/kol/first-touches/subscriptions (new, ULTRA) — webhook delivery with HMAC-SHA256 signing. Up to 10 per-rule subscriptions with independent filter sets. Mirrors coordination/alerts.

mv_kol_scout_score materialized view — per-KOL aggregate over a rolling 30d window: n_first_touches_30d, avg_followers_4h, swarm_3plus_pct, swarm_5plus_pct, scout_tier. Refreshes hourly via pg_cron with advisory-lock guard. Stable across non-overlapping halves at n≥30 (Pearson r=0.78).

Public scout leaderboard at /kol/scouts — sortable table of top scouts with per-scout detail at /kol/scouts/[wallet] showing recent first-touches and follower outcomes.

SDKs: madeonsol-x402 (npm) → 1.3.1, madeonsol-x402 (PyPI) → 1.3.1, @madeonsol/plugin-madeonsol → 1.3.1, mcp-server-madeonsol → 1.3.1, and solana-agent-kit-plugin-madeonsol → 1.3.1 all expose firstTouches() plus firstTouchSubscriptions{List,Create,Get,Update,Delete} (Ultra). Bare madeonsol (npm) and the Rust SDK on crates.io ship in a follow-up release.

Resolved a silent-failure mode that turned up on 2026-04-23: a PRO user (1ff470bd…) had 2,310 copy-trade signals fire over a week with 0 delivered — their WebSocket had been disconnected for days and no surface flagged it. Customers can't tell the difference between "no alpha to deliver" and "delivery is broken", so we built one.

• ws_sessions table (migration 110) — every WS connect/disconnect on ws-streaming and dex-stream writes a row with user_id, tier, channels[], connected_at / disconnected_at, close_code, close_reason, messages_sent, remote_ip. 60-day retention.
• coordination_alert_signals table (migration 111) — per-fire history for kol:coordination, parallel to copytrade_signals. Tracks delivered, delivered_at, delivery_error per dispatch (was previously fire-and-forget).
• Admin push-delivery breakdowns (migration 112 + /admin/api) — three new SECURITY DEFINER functions (admin_copytrade_delivery_breakdown, admin_coord_delivery_breakdown, admin_first_touch_delivery_breakdown) bucket fires by failure mode (ws_not_connected / ws_not_subscribed / webhook_err / no_status / delivered). The /admin/api page now shows per-customer delivery health with at-a-glance churn vs. broken-pipe distinction.

No customer-visible API changes — purely operational visibility.

refresh_bundler_sniper_caches() (introduced in migration 105) was full-scanning token_early_buyers on every run. Once that table crossed ~1M rows, the cron job started timing out at 60s — both the 2026-04-20 and 2026-04-21 runs failed silently.

Migration 109 rewrites the function to be incremental:

• Watermark column on early_buyer_pnl_refresh_state tracks the max block_time covered by the last refresh.
• Bundler cache — append-only by definition (a wallet that did a same-block multi-token buy stays flagged), so we only scan buys in new blocks.
• Sniper cache — must handle additions and removals (a fresh slow-sell can drop a wallet's quick-flip ratio below 0.8). Builds a candidate set of wallets with new early-buy rows or new sells, recomputes qualification across each candidate's full history, then upserts/deletes against the cache.
• First-run path preserved as a one-time bootstrap with elevated statement_timeout and work_mem.

Post-fix: cron runs in 2–4s instead of timing out. New index idx_early_buyers_first_buy_at supports the candidate-discovery query.

Audit of 30d api_audit_log surfaced concrete gaps on the most-used paid routes — missing filters, silent response bugs, no batch support. High-priority fixes shipped together:

/kol/feed — token_image_url now returned (was selected in the query but dropped from the mapped response — silent bug; UI consumers were missing token icons). Added ?before=<ISO> cursor pagination with next_before so polling clients stop re-fetching the same top rows.

/token/{mint} — enriched with first_seen_at, age_seconds, is_blacklisted, and blacklist_category (stablecoin / wrapped_sol / lst / rug). Joins against token_first_seen + token_blacklist, saving consumers a follow-up call.

POST /token/batch (new) — bulk lookup of up to 50 mints in one request. Same per-mint shape as GET /token/{mint}. Cuts request volume 10–20× for sniper workflows that previously polled per-mint.

POST /tokens/batch/buyer-quality (new) — bulk buyer-quality scoring for up to 50 mints. Shares the LRU cache with the single-mint endpoint — repeat calls return cache_hits=N at near-zero cost.

/deployer-hunter/alerts — new filters: ?min_kol_buys=N, ?alert_type=, ?priority=high|medium|low. ?before=<ISO> cursor pagination (was only offset-paginated). Joined deployer payload now includes best_token_peak_mc.

/deployer-hunter/recent-bonds — ?since=<ISO> for incremental polling + next_since cursor (without it, every poll re-returned the same rows). Added ?tier=, ?peak_mc_min=, and token_image_url in the response.

All additions backward-compatible. /api-docs, /solana-api, openapi-spec, and llms.txt updated to match. Filter matrix verified 30/30 on the green slot before deploy.

Mirrored the new endpoint surface into every official SDK so consumers can call the new filters and batch routes through typed methods.

• madeonsol (TypeScript) → 2.1.0 (npm) — kol.feed() before cursor + next_before, KolTrade.token_image_url. deployer.alerts() before / alert_type / priority / min_kol_buys. deployer.recentBonds() since / tier / peak_mc_min + next_since. New client.token namespace: get(), batch(), batchBuyerQuality().
• madeonsol (Rust) → 0.3.0 (crates.io) — same additions on types.rs + api/{kol,deployer}.rs; new api/token.rs with Token::{get, batch, batch_buyer_quality} registered as client.token.
• mcp-server-madeonsol → 1.2.1 — three new MCP tools (madeonsol_token_get, madeonsol_token_batch, madeonsol_tokens_batch_buyer_quality) + new filter params on madeonsol_kol_feed and madeonsol_deployer_alerts. Strategy enum corrected to scalper / day_trader / swing_trader / hodler / mixed (matches the live mv_kol_scores classifier).
• @madeonsol/plugin-madeonsol → 1.2.0 — getToken, getTokenBatch, getTokenBuyerQualityBatch + new filter args. Bug fixes: getAlphaLinked now hits /alpha/{w}/linked (was 404'ing on /alpha/wallet/{w}/linked); getTokenCapTable + getTokenBuyerQuality now use plural /tokens/ paths.
• solana-agent-kit-plugin-madeonsol → 1.2.0 — same additions + same path-bug fixes on alphaWallet, alphaLinked, tokenCapTable, tokenBuyerQuality. New tokenGet, tokenBatch, tokenBuyerQualityBatch functions.
• madeonsol-x402 (npm) → 1.2.0 — KolFeedParams.before, DeployerAlertsParams.{before, alert_type, priority, min_kol_buys}, next_before in response, strategy enum corrected.
• madeonsol-x402 (PyPI) → 1.2.0 — kol_feed(before=...) and deployer_alerts(before=, alert_type=, priority=, min_kol_buys=).

All changes backward-compatible — new params are optional, new fields are additive, new methods don't change existing signatures. Existing consumers continue to work without modification.

@triton-one/yellowstone-grpc moved to a native N-API client where ClientDuplexStream extends stream.Duplex and has no .cancel() method, so every reconnect path was silently no-op'ing on teardown, leaving the subscription + TCP socket dangling. wallet-tracker (which reconnects on every wallet_watchlist_changes pg_notify) had accumulated 97 sockets to Kaldera, saturating the per-account limit and causing dex-stream subscribe attempts to be rejected with GenericFailure.

• Replaced state.stream.cancel() → state.stream.destroy() across all 15 call sites in wallet-tracker, kol-tracker, dex-stream, and deployer-listener.
• dex-stream no longer auto-shuts when no client is subscribed — rapid subscribe/unsubscribe churn was tripping Kaldera anti-abuse for extended windows. Now matches kol-tracker's always-on pattern, so the all-DEX firehose is ready the moment a ULTRA client connects.
• Tightened pg pool idleTimeoutMillis (30s → 10s) and tagged application_name across the three gRPC services for cleaner DB-side observability.

Post-fix, wallet-tracker dropped from 97 → 4 sockets and dex-stream subscribes cleanly to both gRPC regions (~15k tx per 30s heartbeat).

Routine semver-patch sweep: 17 npm packages updated (Next 16.2.4, React 19.2.5, @supabase/supabase-js 2.104.1, Tailwind 4.2.4, @x402/* 2.10.0, Resend 6.12.2, Vitest 4.1.5, others). Plus one one-major bump worth flagging:

@supabase/ssr 0.9.0 → 0.10.2 — v0.10 propagates cache headers to setAll to prevent CDN caching of auth responses, and now respects user-provided auth options in createBrowserClient. No API signature changes — middleware.ts, supabase/client.ts, supabase/server.ts compile unchanged.

@solana/kit 5.5 → 6.8 deferred: would dedupe-invalidate against @x402/svm → @solana-program/[email protected] which peer-requires @solana/kit@^5. Risk of runtime break in the x402 subscription payment path; waiting for upstream compute-budget v6 support.

Site

• Added middleware rule that strips trailing ), )., ,, ;, ] from paths and 301-redirects. Rescues clicks from auto-linkified URLs in emails, terminals, and IDE tooltips that over-greedy grabbed trailing punctuation (affected /developer), /developer). among others).

SDKs — all x402 / ElizaOS variants

• @madeonsol/plugin-madeonsol → 1.1.2 (npm)
• madeonsol-x402 (npm) → 1.1.2 (npm)
• madeonsol-x402 (PyPI) → 1.1.3 (PyPI)

Reworded every (free at madeonsol.com/developer) pattern in error messages, JSDoc, and docstrings to an em-dashed form — — free at https://madeonsol.com/developer — — so no terminal or email auto-linkifier grabs a trailing paren. No behaviour or API changes.

New: Official Rust SDK (crates.io)

cargo add madeonsol

Full-surface async client built on tokio + reqwest with rustls — no OpenSSL dependency, cross-compiles cleanly. Covers the same endpoint set as the TypeScript SDK: KOL feed/leaderboard/coordination/pairs/hot/trending/entry-order/timing/pnl, deployer alerts and leaderboards, wallet tracker, alpha wallet intelligence, and x402 discovery. Typed response structs, structured error surfacing, and the same msk_ Bearer auth as every other SDK.

TypeScript SDK v2.0.0 (npm) — correctness release

The major bump is a breaking response-type realignment:

• KolTrade.signature → tx_signature (and sibling fields on DeployerAlert, WalletEvent, coordination wallet rows) — now matches the actual REST payload. Previous versions had drifted from the live API shape.
• MadeOnSolError.message now surfaces the server's error field from the response body instead of the generic HTTP status text — real diagnostics in catch blocks.
• Response types across KOL, deployer, wallet, and alpha endpoints audited against the live API and corrected.

Upgrade: npm install madeonsol@latest. If you were reading signature off trade objects, rename to tx_signature. No other call-site changes.

The /kol/coordination endpoint got three upgrades and a new companion API for real-time push alerts.

Richer response (backward-compatible)

• Peak-density window: response now includes peak_window_start, peak_window_end, peak_kols, peak_buys — the densest window_minutes slice inside the full period. A cluster where 8 KOLs bought across 4 hours is very different from one where 8 KOLs bought in a 15-minute window. Now you can tell.
• Exits: exited_count flags KOLs that net-sold the token after buying — a quiet but strong de-weight signal for copy-trading.
• Coordination score: coordination_score (0-100) is a composite over peak density, freshness, exits, avg winrate, and strategy diversity. Use ?min_score=70 to filter for only high-conviction clusters.
• New filters: ?window_minutes=1-60 (default 15), ?min_score=0-100 (default 60), ?include_majors=true|false (filter WIF/BONK/POPCAT noise, default false).
• Majors are blacklisted via the coordination_excluded_mints table — contact us if you want a specific mint added.

New: Coordination Alerts API (PRO/ULTRA — 5 endpoints)

Push alerts fire within ~1s of a qualifying trade (pg_notify, not cron-poll). Delivered via WebSocket (kol:coordination, user-scoped) and/or per-rule HMAC-signed webhook.

POST   /api/v1/kol/coordination/alerts
GET    /api/v1/kol/coordination/alerts
GET    /api/v1/kol/coordination/alerts/{id}
PATCH  /api/v1/kol/coordination/alerts/{id}
DELETE /api/v1/kol/coordination/alerts/{id}

Rule fields: name, min_kols (2-50), window_minutes, min_score, include_majors, cooldown_min (60 default — de-dupe per (rule, token)), score_jump_break (10 default — re-fire inside cooldown if score jumps by N), delivery_mode (webhook / websocket / both), webhook_url. Webhook secret returned once on create — store it securely.

Limits: PRO 5 rules. ULTRA 20 rules.

SDKs

All six SDKs (TypeScript 1.11.0, Python 1.1.0, MCP 1.1.0, ElizaOS 1.1.0, Solana Agent Kit 1.1.0, madeonsol-x402 TS 1.1.0) expose the new fields on kolCoordination() and add coordinationAlerts{List,Create,Get,Update,Delete}.

Full surface on /api-docs#kol.

API

• Every response now returns X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, and X-Request-Id. Useful for client-side backoff and for support — paste the X-Request-Id in any bug report and we can trace it end-to-end.
• Error envelopes now include a _rid watermark for the same reason.

SDKs

• All six SDKs (TypeScript, Python, MCP, ElizaOS, Solana Agent Kit, LangChain) now support KOL entry-order queries, wallet compare, and alerts/recent.

Site

• Live platform stats on the homepage, /developer, and /solana-api — pulled from the public stats endpoint and cached for 5 minutes.

New mv_kol_scores materialized view backs the entire KOL surface. Three net-new endpoints, five enriched.

• GET /kol/coordination — multi-KOL convergence signals with cluster avg winrate + distinct-strategy filters (PRO+).
• GET /kol/hot — trending KOLs by recent momentum.
• GET /kol/compare — side-by-side stats for up to 10 wallets.
• GET /kol/leaderboard now supports sort=pnl|winrate|profit_factor|roi|early_entry (PRO+) and a strategy filter.
• GET /kol/{wallet} adds include=pnl_by_token (PRO/ULTRA).

Trade retention extended to 180 days across all KOL endpoints. Full surface on /api-docs#kol.

wss://ws.madeonsol.com/dex (ULTRA-only) now supports:

• Multi-subscription: subscribe to multiple filter sets over a single connection.
• Replay: request the last N seconds on reconnect to bridge any gap.
• Server-side filters: min_sol, token_age_max_min, min_market_cap, min_kol_tier.
• Alt gRPC endpoint: redundant stream on a second provider for failover.

Catches roughly every swap on every major Solana DEX with sub-second latency. See DEX stream docs.

Webhook deliveries now sign <timestamp>.<body> with HMAC-SHA256 under the X-MadeOnSol-Signature header, and include X-MadeOnSol-Timestamp. Reject any delivery older than ~5 minutes to defeat replay. v1 signatures keep working during the transition. Verify examples in the webhooks docs.

• XSS + SSRF hardening across all user-supplied URL inputs.
• Scheme whitelist (http: / https: only) on every outbound fetch.
• Input size caps + NaN guards on all numeric query params.
• RLS enabled on all sensitive tables.
• Tightened access on public-facing routes.

• API dropdown got bordered cards for scannability.
• The "API" section is now labelled Solana API end-to-end — the product covers the entire Solana data stack, not just MadeOnSol-specific data.

• POST /wallet-tracker/watch — add any Solana wallet to your watchlist.
• GET /wallet-tracker/summary — aggregate stats for your tracked wallets.
• GET /wallet-tracker/trades — unified recent swaps + transfers feed.
• BASIC: 10 wallets. PRO: 50. ULTRA: 100 + live WS events.

Powers the new /developer dashboard wallet panel. Full reference on /api-docs#wallet-tracker.

• New human_wallets signal separates organic traders from bundle/sniper bots using our mv_alpha_wallets bot-confidence classifier.
• Buyer quality scoring revamped: base score = avg 7d winrate of non-bot buyers with ≥3 tokens, + KOL bonuses, − bundle/bot penalties.
• GET /tokens/{mint}/buyer-quality and GET /tokens/{mint}/cap-table now return richer breakdowns (PRO+).
• Homepage refreshed to lead with real numbers instead of copy.

• GET /kol/{wallet} — full KOL wallet profile with PnL stats and trade history.
• GET /tokens/trending — tokens gaining KOL attention right now.
• First version of /api-docs, llms.txt, and an OpenAPI spec for AI agents.

Production 502 outage traced to proxy_buffer_size too small for large PostgREST responses on mv_kol_scores. Fix: the health-monitor cron now automatically bumps proxy_buffer_size (capped at 128k) when it detects "upstream sent too big header" in nginx error logs, reloads nginx, and posts to system_health_checks.