MCP server for the Cookin API: Solana and Pump.fun token intelligence, paid per call in USDC over x402 or with a Pro API key.
Inferred from the transports this listing declares (stdio). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.
SOLANA_KEYAPI keyoptionalBase58 Solana keypair holding USDC, to pay per call with x402. The key stays on this machine; only a signed transaction leaves it.
COOKIN_API_KEYAPI keyoptionalCookin Pro API key, as an alternative to paying per call. Mint one at https://cookin.fun/account/api-keys
Declared by the author in the official MCP registry. Forge does not store, broker, or ever see these values — the config below is scaffolded with placeholders you fill in locally.
Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.
Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.
scan_tokenFull Cookin snapshot for one Solana or Pump.fun token: quality score,Full Cookin snapshot for one Solana or Pump.fun token: quality score,
No input schema was published for this tool.
token_tradesRecent trades for one token, each carrying the trader's history as itRecent trades for one token, each carrying the trader's history as it
No input schema was published for this tool.
list_new_tokensNewly launched Pump.fun tokens that passed Cookin's rug filters, withNewly launched Pump.fun tokens that passed Cookin's rug filters, with
No input schema was published for this tool.
list_pumping_tokensPump.fun tokens currently pumping, with quality signals, holder behavior,Pump.fun tokens currently pumping, with quality signals, holder behavior,
No input schema was published for this tool.
list_graduated_tokensPump.fun tokens that recently graduated to Raydium or PumpSwap, withPump.fun tokens that recently graduated to Raydium or PumpSwap, with
No input schema was published for this tool.
list_agent_buysTokens the top Cookin trading agents bought most recently, with qualityTokens the top Cookin trading agents bought most recently, with quality
No input schema was published for this tool.
profile_walletLifetime trading profile of one Solana wallet: PnL, ROI, win rate, holdLifetime trading profile of one Solana wallet: PnL, ROI, win rate, hold
No input schema was published for this tool.
deployer_historyEvery token one deployer has launched, with its bond rate, peak marketEvery token one deployer has launched, with its bond rate, peak market
No input schema was published for this tool.
8 of 8 tools published a description.
Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.
MCP server for the Cookin API: Solana and Pump.fun token intelligence, paid per call in USDC over x402 or with a Pro API key.
Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.
The crawl stopped at the 60-package limit. The rest of the tree was never resolved.
36 more resolved packages are not drawn here (display cap: 24). Every dependency carrying an advisory is drawn regardless of the cap. Full inventory (CycloneDX SBOM)
234 declared dependencies never landed in the tree. They are missing from Forge's resolution, not from the package.
+222 more not listed. The counts by reason above cover all of them.
Not followed: peerDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.