stealth-trader

Give your AI agent its own Solana wallet — it trades for you, and nothing traces back to it.

An open-source MCP server (plus a Telegram bot) that gives an AI agent its own Solana wallet. Hand it to a Claude or Cursor agent and it can buy, sell, and cash out on its own. Every trade runs inside the b402 shielded pool: the SOL is shielded, swapped, and reshielded as an encrypted note behind a zero-knowledge proof, with a relayer signing the on-chain tx. The trade lands on-chain — but the agent's wallet isn't the signer or even an account on it, so nothing traces back to it. Prefer to tap instead of prompt? The same engine runs as a Telegram bot.

Get started · What it does · MCP tools · How it works · Security

Note: the live mainnet deployment is a test playground, not production. The current program IDs are an experimental preview — use small amounts only and treat it as a tech demo. An audited production deployment, under multisig upgrade authority, is in progress and will replace these program IDs.

Get started

Use it from an agent — one command, zero config (Claude Code, Cursor, any MCP runtime):

claude mcp add stealth-trader -- npx -y @b402ai/stealth-trader@latest mcp

First run generates a wallet and saves its seed to ~/.config/stealth-trader/master-seed — back that file up; it derives the wallet that holds your funds. It boots on public mainnet RPC so reads work out of the box, but set HELIUS_RPC_URL (free, 1 min at helius.dev) before trading — public RPC throttles and swaps can fail on it.

Your agent can now buy, sell, check holdings, and cash out — privately. Ask it: "privately buy 0.01 SOL of <mint>, then cash out to a fresh address." It composes the tools and signs nothing with your own wallet — the relayer does.

See it on mainnet — ~25s, costs ~$0.01:

git clone https://github.com/mmchougule/stealth-trader && cd stealth-trader
pnpm install
export HELIUS_RPC_URL="https://mainnet.helius-rpc.com/?api-key=YOUR_KEY"   # free at helius.dev
pnpm smoke

Needs a Solana CLI wallet with ~0.005 SOL — the script auto-funds the test wallet from ~/.config/solana/id.json (or fund the address it prints). It shields, swaps, and cashes out, then prints two Solscan links: your wallet is not in the swap's accountKeys. (full steps + exact cost ↓)

Or use the hosted Telegram bot: t.me/btrader021bot — /start, send a little SOL, Buy. This repo ships v0.5 (/buy, /sell, /cashout, /holdings, leader discovery, MCP); /follow lands in v0.6.

What it does (v0.5)

| feature | what it is | how to use | |---|---|---| | Private buy | Buy any SPL token through Jupiter. Your wallet never signs the swap; the relayer does. Rug-check gate aborts obvious honeypots before any SOL moves. | TG /buy <mint> <sol> · MCP private_buy · pnpm smoke | | Private sell | Sell a shielded token note back to SOL — same privacy property as buy. | TG /sell <mint> <amount> | | Private cashout | Withdraw shielded balance to any wallet. The recipient has no on-chain edge to your deposit address. | TG /cashout <addr> · MCP cashout | | Private holdings | Per-mint shielded balance — only the viewing-key holder can read it. | TG /holdings · MCP get_holdings | | Private lend | Deposit shielded USDC into Kamino V2 for yield. Deposit address absent on chain. | MCP private_lend (mainnet) | | Leader stats / discovery | 7-day PnL, hit rate, top mints for any wallet; curated starter list. Read-only in v0.5. | TG /leader <wallet>, /discover · MCP discover_leaders |

Seven MCP tools an agent can compose: "check this wallet's 7-day stats, then privately buy 0.01 SOL of its top mint, and cash out to a fresh address." The agent calls discover_leaders → private_buy → cashout — every trade signed by the relayer, your wallet never in tx.accountKeys.

Copy-trade (/follow) ships in v0.6 — it needs a hosted Helius webhook proxy so self-hosters don't need ngrok. The full copy-trade bot is live now at t.me/btrader021bot if you want to try that flow today.

Why it matters

On Solana, the wallet that signs your swap is your wallet — so every trade is stamped with your address in public. Anyone can front-run your buys, copy your positions in real time, read your whole portfolio from a single address, and watch exactly when you exit.

stealth-trader breaks that link: a relayer signs the trade, not you, so there's nothing to correlate. Don't take our word for it — open any tx the bot produces on Solscan and your deposit address is not in tx.accountKeys. The bot's "Verify privacy" button shows you that, per trade.

Try it in 30 seconds

git clone https://github.com/mmchougule/stealth-trader && cd stealth-trader
pnpm install
export HELIUS_RPC_URL="https://mainnet.helius-rpc.com/?api-key=YOUR_KEY"
pnpm smoke

Try it before any Telegram setup — the smoke needs a Helius RPC URL + a funded Solana CLI wallet, runs on mainnet in ~25 seconds, and proves the privacy property end-to-end.

Here's exactly what happens, no surprises:

1. Generates a MASTER_SEED into ./.env (back this up if you keep using it)
2. Derives a test wallet from that seed
3. Transfers 0.0045 SOL from your Solana CLI wallet (~/.config/solana/id.json) to the test wallet. The script previews this with a 5-second Ctrl-C window. Opt out: STEALTH_NO_AUTOFUND=1 + fund the printed address manually.
4. Shields 0.0015 SOL into the b402 pool. Your test wallet signs this — the one on-chain step where you're visible.
5. Swaps shielded SOL → USDC. Relayer signs; your wallet isn't in the swap tx.
6. Cashes the USDC out — back to your CLI wallet by default. Relayer signs; your wallet isn't in the cashout tx either.

The script prints two Solscan links. Open both: the test wallet address doesn't appear in accountKeys for the swap or the cashout. That's the privacy property, verifiable on chain. (How it works on-chain →)

Net cost: ~$0.01 in tx fees + a few cents of swap slippage. The 0.0015 SOL becomes ~0.13 USDC and comes back to your CLI wallet at the cashout — nothing is drained.

No Solana CLI keypair? The script prints the deposit address and waits 5 minutes for you to fund it manually.

Use cases

| audience | how they use it | result | |---|---|---| | Solana trader (Telegram) | /buy <mint> <sol> to enter, /sell to exit, /cashout <addr> to withdraw to a fresh wallet | trades land shielded; cashout has no on-chain link to the deposit | | AI agent (MCP) | One prompt composes discover_leaders → private_buy → get_holdings → cashout | agent runs a private DeFi strategy with no wallet attribution | | App developer (TypeScript SDK) | import { B402Solana } from '@b402ai/solana' and drive the same primitives directly | embed private execution into your own product |

Same code, three surfaces.

Install

As an MCP server (Claude Code, Cursor, any MCP runtime):

claude mcp add stealth-trader -- npx -y @b402ai/stealth-trader@latest mcp

Env: STEALTH_TG_ID, MASTER_SEED, HELIUS_RPC_URL. Data persists to a local pglite store at ~/.stealth-trader/db — set DATABASE_URL=postgresql://… to point at a real cluster.

For more MCP-side wiring (Claude Code, Cursor configs, prompt patterns): b402 MCP overview →.

As a self-hosted Telegram bot:

git clone https://github.com/mmchougule/stealth-trader && cd stealth-trader
pnpm install
pnpm wizard                       # paste bot token + Helius key
pnpm start                       # schema auto-applies on first boot

Get a bot token from @BotFather and a free Helius key from helius.dev. The bot ships with pglite (WASM Postgres) in-process, so the only thing you need to provision is the bot itself.

For production deployments, set OPERATOR_FEE_KEYPAIR_PATH to a keypair file with ~0.05 SOL on hand. It absorbs the one-time ~0.002 SOL rent per (recipient, mint) on /cashout so users never see "insufficient funds for rent" the first time they withdraw to a fresh address.

Usage (Telegram)

/start                            welcome + your deposit address
/wallet                           your deposit address (where to send SOL)
/balance                          public SOL balance you can spend

/buy <mint> <sol>                 private buy — shield fresh SOL and swap
/sell <mint> <raw-amount>         private sell — swap a token note back to SOL
/holdings                         per-mint shielded balances

/leader <wallet>                  7-day stats — PnL, hit rate, top mints
/discover                         curated leaders (paste any into /leader)

/cashout <recipient> [mint]       unshield to any wallet (no link to deposit)

Copy-trade (/follow, /follows, /unfollow) lands in v0.6 once the hosted Helius webhook proxy ships — until then end-users would need ngrok to receive leader events.

MCP tools

Seven tools an agent (Claude Code, Cursor, custom) can compose. Example: "score this wallet's last 7 days, privately buy 0.01 SOL of its top mint, then cash out to a fresh address."

| tool | what it does | |-----------------------|------------------------------------------------------------------------| | private_buy | swap SOL → any SPL token through the shielded pool | | private_lend | lend a shielded token into Kamino (mainnet only) | | cashout | unshield to a recipient with no on-chain link to your deposit | | get_holdings | shielded token balances per mint | | get_wallet | your deposit address (where you shield SOL once) | | get_balance | public SOL balance available for new shields | | discover_leaders | rank candidate wallets by recent on-chain PnL + activity |

How it works

Fund your derived address  ──►  public SOL balance
                                       │  shield at trade time
                                       ▼
        ┌──────────────  b402 shielded pool  ──────────────┐
        │   encrypted notes · commitment tree + nullifier tree
        ▼                      ▼                      ▼
   private_buy            private_sell           private_lend
   (SOL → token)          (token → SOL)          (Kamino USDC)
        │                      │                      │
        └──────────┬───────────┴──────────┬───────────┘
                   ▼                      ▼
          swap is CPI'd inside     output reshields as a
          the pool; relayer        new encrypted note
          signs the on-chain tx    (yours, still hidden)

You fund a derived address — that's your public balance. A buy shields fresh SOL into the pool, swaps it for the token via a CPI from inside the pool, and reshields the output as a new encrypted note; if you already hold a shielded note, it skips the shield and just swaps that note. Each spend is an adapt proof: it proves in zero-knowledge that you own a valid unspent note — tracked in the commitment tree, retired in the nullifier tree — without revealing which one or whose. The relayer signs the on-chain tx from a pool-controlled account, so your wallet is not a signer, not an account, not in the block.

Deeper reading on the b402 docs site:

• Privacy model — exactly what's hidden, what's revealed
• Trust assumptions — what the relayer can and can't do
• Protocol architecture — circuits, nullifier tree, verifier
• Adapter overview — how Jupiter/Kamino integrate

Two correctness properties worth knowing — both ship in @b402ai/[email protected]:

• Swap routes ladder down on tx-size overrun. Jupiter routes vary trade-to-trade; some exceed the relayer's tx-build buffer ("encoding overruns Uint8Array"). The swap layer retries at maxAccounts [32, 28, 24, 20] until the wrapped tx fits, then surfaces a clean error if none do.
• Note leafIndex comes from the pool's CommitmentAppended event log, not the pre-tx tree.leafCount prediction. Concurrent shields on the shared pool race the prediction. Reading the post-confirm event eliminates the phantom-note class that produces silent Adapt_221 proof failures.

Compared to

vs. public DEX routers (Jupiter, Raydium UI, etc.):

| property | stealth-trader | public router | |------------------------------------------------|:--------------:|:-------------:| | your wallet signs the swap? | no | yes | | your wallet appears in tx.accountKeys? | no | yes | | your portfolio is readable from your address? | no | yes | | wallet trackers can link the trade to you? | no | yes |

vs. copy-trade bots (Trojan, BullX, Photon, Maestro):

| property | stealth-trader | Trojan / BullX / Photon | |---------------------------------------------------|:--------------:|:-----------------------:| | follower's wallet appears in the leader's block? | no | yes | | MCP-callable (any agent runtime)? | yes | no | | open source? | yes | no |

The "wallet in accountKeys" rows are facts checkable on Solscan in 30 seconds for any tx those tools produce.

Numbers

• 206 unit tests covering swap-ladder, rug-check gate, Jupiter quote breaker, per-user serial lock, balance ledger, wallet derivation, delta-balance deposits, leader stats, MCP handlers.
• Tests run against in-memory pglite + a mocked SDK; ~3s wall time. A few exercise live Jupiter/RugCheck and degrade gracefully when rate-limited, so the suite stays green offline.
• Built on @b402ai/[email protected], mainnet program 42a3hsCXtQLWonyxWZosaaCJCweYYKMrvNd25p1Jrt2y.

Status

v0.5 — /buy, /sell, /holdings, /cashout work end-to-end against mainnet (TG + MCP); /leader and /discover are read-only stats. Every trade is relayer-signed; the user wallet never appears in the swap or cashout accountKeys. Copy-trade (/follow) lands in v0.6 with a hosted webhook proxy.

Limits

• Copy-trade is buys only. Sells (leader sells X → follower sells X) ship with copy-trade in v0.6.
• Hosted b402 relayer is the default. Run your own from mmchougule/b402-solana/packages/relayer and point B402_RELAYER_URL at it.
• The b402 shielded pool is unaudited. Read the trust assumptions before depositing more than you'd lose in an experiment.
• Same-amount notes pile up if every copy uses identical per_trade_lamports. The SDK recycles existing notes when shapes match. Snap-to-nearest recycle is on the roadmap.

Security

Reports: see SECURITY.md. 90-day coordinated disclosure.

Stack

• @b402ai/solana — shielded pool SDK
• @modelcontextprotocol/sdk — MCP transport
• grammy — Telegram bot framework
• zod — MCP tool schema validation
• pino — structured logging
• pg — Postgres driver
• Helius enhanced webhooks for leader-tx ingestion

License

Apache-2.0.