AgentsBundles & Security

Bundles & Security

Coordinated-wallet detection, manipulation flags, and live security streams. All security signals are token-scoped on REST; per-wallet alerts arrive over WebSocket.

Token Bundles

GET /v1/token/{mint}/bundles/summary

Lightweight summary for badge rendering.

{
  "token_mint": "EPjFWd...",
  "bundle_count": 3,
  "open_bundle_count": 2,
  "bundled_supply_pct": 18.5,
  "bundled_value_usd": 24500.0,
  "bundled_realized_pnl_usd": 3200.0,
  "dominant_bundle_type": "SybilPoisoning"
}

GET /v1/token/{mint}/bundles

Full bundle list. Bundle types: JitoMev, JitoSequential, SameSlotBuyCohort, SameSlotSellCohort, MultiSlotBuyCohort, LaunchSlotBurst, MultiSell, SybilPoisoning, CexCoordinated, SyntheticSwarm, Synthetic. Status lifecycle: active → dormant / dumping / derisked / exited / rugged / merged.

{
  "bundles": [
    {
      "bundle_id": "bndl_abc123",
      "token_mint": "EPjFWd...",
      "bundle_type": "SybilPoisoning",
      "leader_wallet": "4mNqR...",
      "status": "active",
      "member_count_total": 8,
      "member_count_active": 6,
      "chain_balance_ui": 1250000.0,
      "realized_pnl_usd": 3200.0,
      "total_usd_invested": 5400.0,
      "total_usd_returned": 8600.0,
      "sold_pct": 50.0,
      "risk_score": 0.85,
      "evidence": ["..."]
    }
  ],
  "token_mint": "EPjFWd..."
}

GET /v1/token/{mint}/bundles/{bundle_id}

Detail call: {"bundle": Bundle, "members": BundleMember[]} — per-wallet chain balance, realized PnL, leader flag.

Wash Trades

GET /v1/token/{mint}/wash-trades

{
  "wash_trades": [
    {
      "wallet_address": "4mNqR...",
      "token_mint": "EPjFWd...",
      "trade_count": 14,
      "direction_flips": 12,
      "volume_usd": 2400.0,
      "net_exposure_pct": 3.2,
      "is_atomic": false,
      "detected_at": "2026-04-25 14:30:00"
    }
  ],
  "token_mint": "EPjFWd...",
  "count": 1
}

Funding Abuse

GET /v1/token/{mint}/funding-abuse

Early-buyer cohort funding-pattern analysis. See funding abuse on the human docs for full schema and reason codes (SEED_WAVE_HEAVY, FARM_FUNDED_FRESH_WALLETS, CEX_DISPERSED_ROOTS, FAST_FUND_TO_BUY, etc.).

Treat summary.suspicious and summary.reasons as the stable surface. summary.score is calibrated proprietarily.

Suspicious Activity

GET /v1/token/{mint}/suspicious-activity

Embeds the funding-abuse summary plus persisted flagged reasons.

{
  "token_mint": "EPjFWd...",
  "status": "suspicious",
  "flagged_reasons": ["High wash trade volume"],
  "flagged_time": "2026-04-25T12:00:00Z",
  "rugged_time": null,
  "live_activity_flags": ["SEED_WAVE_HEAVY", "FARM_FUNDED_FRESH_WALLETS"],
  "funding_abuse": { /* FundingAbuseSummary */ }
}

Wallet Entanglement

GET /v1/wallet/{address}/entanglement

Bundle clusters this wallet participates in.

{
  "wallet": "7xKXtg...",
  "clusters": [
    {
      "wallet_address": "7xKXtg...",
      "cluster_wallets": ["4mNqR...", "9aBcD..."],
      "token_mint": "EPjFWd...",
      "edge_count": 5
    }
  ],
  "cluster_count": 1
}

Live Security Streams

ChannelDescription
token:{mint}:securityToken security events: bundle detected, wash trade flagged, rug detected, suspicious activity, coordination alert
wallet:{addr}:securityWallet-scoped security events: malicious classification, rug profiteer detection, cascading alerts
const ws = new WebSocket('wss://api.conyr.ai/ws');
ws.onopen = () => ws.send(JSON.stringify({
  op: 'subscribe',
  channels: ['token:EPjFWd...:security', 'wallet:7xKXtg...:security']
}));
ws.onmessage = (e) => {
  const msg = JSON.parse(e.data);
  if (msg.channel) console.log(msg.channel, msg.data);
};

Removed (no longer on the API)

  • GET /v1/wallet/{addr}/bundles — bundles are token-scoped; use /v1/token/{mint}/bundles plus client-side filter on members[].wallet_address
  • GET /v1/wallet/{addr}/security — never shipped as a REST endpoint; use the WebSocket wallet:{addr}:security stream
Endpoint ReferenceWebSocket Protocol