- validate: add avalanche to VALID_CHAINS / EVM address check / callout
chains / V1 smart_trade restriction
- trenches: drop the stale client-side quote_address_type table (missing
RWA 26, no entries for the 5 newer chains); the server now fills
launchpad_platform and quote_address_type for every chain
- market signal: accept base / eth / arbitrum / avalanche (server
TokenSignalChains); hyperevm is rejected upstream
- strategy cancel: document --order-type smart_trade_v2
- help text, SKILL.md, cli-usage, Readme: chain lists and trenches
default-platform table synced with gmgn-openapi-service
Co-Authored-By: Claude <noreply@anthropic.com>
src/config.ts loaded ~/.config/gmgn/.env with override:true and then the
cwd .env without override, so the global file always won — the opposite
of what Readme, Readme.zh, CLAUDE.md and the gmgn-cooking skill promise.
A user who updated GMGN_PRIVATE_KEY in a project .env kept signing with
the stale global key and got AUTH_SIGNATURE_INVALID.
Load the cwd .env first and the global file second, both without
override, so precedence is shell env > project .env > global .env.
`config --check` reuses the same loader instead of its own copy.
Co-Authored-By: Claude <noreply@anthropic.com>
gmgn-openapi-service already exposes two read-only call-out routes on
openapi.gmgn.ai behind the normal API-key auth, so the CLI can reach them
without the separate papi AK/SK channel:
- gmgn-cli callout record -> POST /v1/callout/get_record: one wallet's
call-outs over the last 30 days plus the 7d/30d summary card
- gmgn-cli callout global -> POST /v1/callout/global: multi-chain feed with
only-kol / only-declaration / only-safe / holding-range filters
Both are weight 3. Chains are validated against the service's 13-chain
callout list, kept separate from the tradable VALID_CHAINS. Limit is checked
against the service's 0-50 bound; holding bounds are sent as decimal
strings. /v1/callout/token is deliberately left out: the service removed it
(prod returns 404) and publishing call-outs is not part of OpenAPI.
Docs: new skills/gmgn-callout/SKILL.md, CLI reference in docs/cli-usage.md
and both Readmes, routing rows in CLAUDE.md.
Co-Authored-By: Claude <noreply@anthropic.com>
- Escape every non-visible character in the confirmation block by Unicode
property (\p{C}, \p{Z}, \p{M}, Default_Ignorable_Code_Point, U+2800) instead
of a hand-kept list; soft hyphens, Hangul fillers, tag characters etc. can no
longer make a fee-share username look like another.
- Fold only fields a command declares as blobs (cooking --image); key fields
are always shown in full. multi-swap and strategy create/cancel now validate
their addresses like swap does.
- Judge protections on the values being sent (min_output 0, anti_mev_mode off,
expire_in 0 now warn), and reject NaN / Infinity / negative --slippage,
--percent, --expire-in, --dev-wallet-bps before they reach a signed body.
--gas-price is converted gwei→wei exactly (was float-rounded).
- Total tip / priority fees per container, including sell_param / buy_param and
buy_trade_config / sell_trade_config, so section ① no longer understates.
- Anti-MEV warning only where accurate: none for swap (documented default on),
"server default applies" for multi-swap / strategy on sol / bsc / eth, and
an explicit "off" warning for cooking create on sol.
- Bind confirmations to method + route + query + body, and require one for
every signed non-GET request (deny by default) instead of a path allowlist.
- In interactive mode write the block to /dev/tty, so the process launcher
cannot filter what the human reads before typing yes.
- Display: swap --percent shows the bps line first and marks input_amount as
ignored; strategy amount_in_percent and multi-swap per-wallet bps show "% of
balance"; multi-swap shows the wallet count.
- Group risky leaves in linear time; load credentials before confirmation so a
missing key is reported before the user types yes.
- Sync skills/gmgn-swap, skills/gmgn-cooking and docs/cli-usage.md with the
gated order strategy cancel and its --yes flag.
Co-Authored-By: Claude <noreply@anthropic.com>
The confirmation prompt for swap / multi-swap / order strategy create /
cooking create printed a hand-written summary that omitted fields still sent
and signed: tip / priority fees, gas, min_output_amount, condition_orders
(auto TP/SL), check_price, sell_param / buy_param, buy_wallets,
snip_buy_wallets, dev_wallet_bps and the creator fee-share lists. A
prompt-injected agent could hide any of them behind a normal-looking summary.
Layer 1 - confirmTrade now takes the request object itself, flattens it to
every leaf field and prints four sections: key fields; risky fields, each
with a plain-language consequence and never folded; protections that are NOT
set (no min output, no slippage limit, anti-MEV not requested, no expiry);
and every remaining field. Section 4 is "whatever 1-3 did not print", so new
parameters appear automatically. Long strings (e.g. --image base64) fold to
<string, size, sha256>, gas_price is echoed in gwei, and command-side totals
are added (extra fees, total buy spend across dev / bundle / snipe wallets,
creator-fee recipients). Control, C1, bidi and zero-width characters are
escaped so a value cannot rewrite or hide lines.
Layer 2 - confirmTrade records the canonical-JSON sha256 of the confirmed
body; authSignedRequest refuses to sign swap, multi_swap, strategy/create,
strategy/cancel and create_token unless the exact body being signed was
confirmed, consuming the confirmation so it authorizes one signature. This
blocks a new command that forgets confirmTrade and a body mutated after
confirmation.
Layer 3 - order strategy cancel gets the same gate and --yes flag; cooking
create JSON options fail with a clear error instead of a raw SyntaxError;
Readme / Readme.zh now state the confirmation block is the complete request
body about to be signed.
Co-Authored-By: Claude <noreply@anthropic.com>
Adds two wallet skills and wires them into the routing.
gmgn-wallet-review (new): a glanceable trading portrait of one wallet. It
gives one style tag, a one-sentence recap of the record and a one-sentence
next step, for 1D / 7D / 30D / all, voiced 你 for the user's own wallet and
他 for anyone else's. It is a single SKILL.md with read-only gmgn-cli
portfolio calls, fixed rules and closed sentence templates. It covers SOL and
all 8 EVM chains, probing the chain for a 0x address.
- The recap names only problems in the trader's own trading: fees, holding
time, loss cutting, sizing, adds, open bags, return trend and launches.
Follower count appears only as a warning in visitor advice.
- Discipline rules from holdings, checked on 22 wallets: losers held 2x
longer, losers sized 1.5x bigger (median per-buy ticket), adds 10 points
worse, and 3+ open bags down 50% with $50+ cost.
- The next step never repeats the recap's problem.
gmgn-wallet-style (new to the repo): the full style tagging, with a 20-cell
title, speed subtitle and badges, each tag stating its triggering number.
It has a nine-chain allowlist and address patterns checked before any
command, and escapes every string it renders.
Both skills' tag rules match freq_level / pnl_level / style_title /
style_speed in gmgn-wallet-analysis/analyze.py. P5 needs ROI > 50% plus
token_num >= 5 plus ONE of {win rate >= 50%, heavy-loss share < 15%}. A diff
against the imported functions over 5,000+ cases gave 0 mismatches. The one
intended difference is gmgn-wallet-review's 3% 净盈 line at machine speed.
Routing:
- CLAUDE.md lists both skills and sends 这个钱包什么风格 / 交易风格 /
wallet style to gmgn-wallet-style instead of the smart-money-profile
workflow.
- gmgn-wallet-analysis hands style-only asks and one-line recap / next-step
asks to the new skills.
- gmgn-wallet-score hands one-line recap asks to gmgn-wallet-review. Its
description becomes a >- block (the old plain scalar failed yaml.safe_load)
with identical text.
- Readme.md and Readme.zh.md list both skills.
No trigger phrase is claimed by two skill descriptions.
Both skills stop on a rejected API key (401 AUTH_KEY_INVALID) as well as on a
rate limit, and reference only skills that exist in this repo.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The two Readme tables and the marketplace description had drifted behind
the repo: both tables listed 8 skills and the marketplace blurb said
"9 GMGN skills", while skills/ actually shipped 11. gmgn-contract-dd,
gmgn-holder-analysis and gmgn-wallet-analysis were installed but
undiscoverable from the docs.
Rather than bump a stale count by one, complete both tables and the
blurb to the full set, including the gmgn-token-buy skill added in this
branch. Each new row is placed next to the skill it reads like, so the
tables still group by subject: contract-dd and holder-analysis after
gmgn-token, wallet-analysis after gmgn-portfolio, and token-buy
immediately before gmgn-swap, which is what it hands its order card to.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Add EVM chains arc and stable everywhere robinhood is supported:
- src/validate.ts: add arc + stable to VALID_CHAINS and EVM address check
- src/commands/{token,market,portfolio,swap,track}.ts: extend --chain
option help and the market-signal chain gate
- src/client/OpenApiClient.ts: HotSearchesParam chain comment
- Sync SKILL.md files, Readme.md, Readme.zh.md, docs/cli-usage.md;
update the default hot-search set wording from 6-chain to 7-chain
Cooking/create_token remains sol/bsc/base/robinhood only (no launchpad
on arc or stable), matching the openapi service.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Remove the robinhood-rejection guards in kol, smartmoney, signal and
cooking create-token so the CLI matches the backend, which now accepts
robinhood on these endpoints
- Update --chain / --dex / --raised-token help text and error messages
- cooking: robinhood launchpad uses trench / pons DEXes, native raised
token only
- Sync SKILL.md files, cli-usage.md and both Readmes with the new chain
support
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds a new skill that scores any wallet address across three angles —
profitability (track-record score), copy-tradeability (score + a
latency/slippage/gas backtest), and Dev reputation for token-creator
wallets — plus trading-style tags, computed deterministically from
GMGN portfolio data. Wires it into CLAUDE.md's skill routing and the
Readme skill tables/install instructions, and refreshes the stale
plugin metadata descriptions/keywords to reflect all 8 current skills.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Address HackenProof report GMGNWM-143, where attacker-controlled token metadata
could hijack an AI agent driving gmgn-cli into executing an unauthorized trade.
Move guardrails from overridable SKILL.md text into code.
- Add src/sanitize.ts: neutralize prompt-injection framing and hidden/control
characters in API output (via printResult) and validate create-token metadata
- Add src/confirm.ts: code-enforced human confirmation for financial writes
(swap, multi-swap, order strategy create, cooking create) — reads a typed
"yes" from /dev/tty; automation requires GMGN_ALLOW_AUTOMATED_TRADES=1 + --yes
- Harden config.ts: tighten ~/.config/gmgn/.env to 0600 and warn if world-readable
- Update SKILL.md files, Readme.md and Readme.zh.md to document the gate,
the --yes flag, and untrusted-metadata handling
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add robinhood as a supported chain across the CLI and skills, and stop
advertising chains that are not publicly supported yet.
robinhood:
- validate.ts: add to VALID_CHAINS and treat as EVM for address checks
- reject guards for commands that do not support it: track kol,
track smartmoney, cooking create (mirrors market signal)
- --chain help updated for supported commands (token/portfolio/swap/
market kline·trending·trenches·hot-searches/track follow-*/order get/
gas-price); OpenApiClient chain comment
- docs: all SKILL.md, Readme.md, Readme.zh.md (split-out row for
unsupported commands), cli-usage.md, plugin/marketplace descriptions
disable monad/megaeth/hyperevm/tron:
- comment monad out of VALID_CHAINS (kept for quick re-enable)
- strip these chains from all --chain help, SKILL.md, cli-usage.md
(hot-searches default now 4 chains: sol/bsc/base/eth)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Add --min-*/--max-* range flags to `market hot-searches` (same metric names as
market trending); flatten filter fields onto each param (no nested filter object)
- Document response as long-form RankItem fields (server maps shortcodes); drop the
filter_id field from the documented response shape
- Sync SKILL.md, cli-usage.md, Readme.md, Readme.zh.md, and OpenApiClient types
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Register dynamic --min-*/--max-* flags on `market trending`, mirroring the
trenches pattern; forwarded as min_<metric>/max_<metric> query params to
/v1/market/rank
- Add RANK_RANGE_FIELDS covering the 18 numeric metrics plus min/max-created
token-age windows (m/h/d duration strings, passed through as-is)
- Document range filters and web-client filter aliases in SKILL.md, cli-usage.md,
Readme.md and Readme.zh.md
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Update Readme.md, Readme.zh.md, src/commands/swap.ts and cooking.ts
with integer 0–100 slippage examples (e.g. 30 = 30%) to match the
updated API validation and skill docs.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add ETH chain support to all P0 commands across CLI and SKILL.md docs:
Commands with ETH support added:
- token info/security/pool/holders/traders
- market kline/trending
- portfolio info/holdings/activity/stats/token-balance
- track follow-wallet
- swap, order quote/get
P1/P2 commands remain sol/bsc/base only:
- track kol/smartmoney (P1)
- multi-swap, order strategy create/list/cancel (P1)
- portfolio created-tokens (P2)
Also adds ETH chain currencies, explorer links, and gas price bounds
to gmgn-swap SKILL.md.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add POST /v1/market/token_signal client method and TokenSignalGroup interface
- Add market signal sub-command with individual flags for single-group queries
- Support --groups <json> override for multi-group parallel queries
- Document max 50 results per group limit
- Update SKILL.md, cli-usage.md, and README with signal types, response fields, and examples
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add POST /v1/trade/multi_swap support: new MultiSwapParams interface,
multiSwap() method, and multi-swap CLI command with full options
(accounts, input/output amounts, slippage, fees, condition-orders, etc.)
- Fix track follow-wallet: switch from criticalRequest to normalRequest;
--wallet is now optional (API Key's bound user resolves the follow list)
- Update SKILL.md, cli-usage.md, Readme.md, Readme.zh.md to reflect both changes
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
List all swap skill order types: market, limit, take-profit/stop-loss,
trailing take-profit/stop-loss, and multi-wallet batch trading.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Redefine price_scale: profit_stop uses gain % from entry (e.g. "100" = +100% / 2×), loss_stop uses drop % from entry (e.g. "65" = drops 65%)
- Update all condition-order examples in SKILL.md and both READMEs accordingly
- Add is_anti_mev recommended note and anti-mev flag to swap examples
- Add order strategy create to Financial Risk Notice
- Fix response section heading format (bold → ###) for order strategy create/list
- Add reset_at field extraction guidance to Rate Limit Handling in all 6 skills
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add "Swap with Take-Profit / Stop-Loss Orders" section to Readme.md and Readme.zh.md
with hold_amount and buy_amount mode examples (TP at +100%/+300%, SL at -65%)
- Reorder CLI Reference section: basic Swap moved before TP/SL examples
- Update SKILL.md condition-orders examples: add stop-loss at -65%, bump slippage to 0.3,
add note that hold_amount includes any added positions at trigger time
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove --open-price option from swap order strategy create command
- Remove open_price field from OpenApiClient StrategyCreateParams type
- Update skills/gmgn-swap/SKILL.md: drop open-price row and inference table, simplify examples to use --sub-order-type directly
- Update docs/cli-usage.md: remove --open-price from command signature and parameter table
- Add /gmgn-cooking skill to Skills tables in Readme.md and Readme.zh.md
- Add limit order and cooking CLI examples to section 8 of both readmes
- Update Cline install instructions to include /gmgn-cooking
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Low-end models (e.g. Cursor default model) were stopping at Step 2
after seeing "the CLI is working", treating the demo key verification
as a success state and skipping the mandatory personal API key setup.
- Step 2: add explicit "Setup is NOT yet complete" warning after demo
key verification, with "Do not stop here" directive
- Step 3: rename to "REQUIRED: Set up personal API key", add ⚠️ mandatory
marker, change from passive "when the user asks" to imperative
"immediately run without waiting for them to ask"
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Emphasizes multi-chain Meme trading, 100+ data dimensions,
and 24/7 automated trading agent use case.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1. Real-time on-chain data with K-line/trending granularity table
2. Trade speed (<0.3s, same RPC as web)
3. Unique token data fields (rat_trader, bundler, sniper, etc.)
4. Feature capability list
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Added competitive positioning section with data comparison table,
speed advantages, and unique features
- Table trimmed to GMGN vs Others (2 columns) for clarity
- Speed section rewritten around real-time data, token analytics keywords,
trade latency (<0.3s), and explicit K-line/trending granularity
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
GMGN API does not support IPv6. When a 401/403 error occurs and
credentials look correct, AI agents and users now have a clear
two-step diagnostic: list inet6 interfaces, then probe
ipv6.icanhazip.com to confirm whether outbound traffic is IPv6.
If confirmed, the instruction is to disable IPv6 immediately.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
