{"name":"trace","title":"Where did the money go?","category":"wallets","useWhen":"Run when a wallet was drained or money went missing, or before trusting an address someone gave you: follows the money and flags sweeper, pass-through and lookalike-address patterns.","benefit":{"kind":"accuracy","text":"Shows each transaction's direction, amount and other side in one call, plus the drain patterns (sweeper fee payers, pass-through, address poisoning) with the transactions that show them, instead of a guess from a list of IDs."},"description":"Follows a wallet's money through its recent transactions: net SOL and token change and the other side of each, where most money went, and drain patterns with evidence.","price":"$0.02","priceText":"25 free calls a day, then $0.02 USDC per call (x402)","http":{"method":"POST","path":"/api/tools/trace","body":"JSON object with the inputs below"},"mcp":{"method":"tools/call","name":"trace"},"inputs":[{"name":"wallet","type":"string (base58 address)","required":true,"lookingFor":"The wallet to follow.","whereToGet":"The user's wallet, or an address from their report. Never make one up."},{"name":"how_many","type":"number","required":false,"lookingFor":"How many recent transactions to read, newest first (1-50, default 25).","whereToGet":"More covers a longer stretch of time."},{"name":"before","type":"string (signature)","required":false,"lookingFor":"Start below this transaction, to page further back.","whereToGet":"next_before from the previous answer."},{"name":"time_zone","type":"string (IANA time zone)","required":false,"lookingFor":"The person's time zone, so the report shows their clock time next to UTC, e.g. America/Chicago.","whereToGet":"Ask them, or leave it out for UTC only."},{"name":"network","type":"\"mainnet-beta\" | \"devnet\"","required":false,"lookingFor":"Default \"mainnet-beta\" (real money).","whereToGet":"\"devnet\" only for test wallets."}],"outputs":[{"field":"wallet","type":"string","is":"The wallet that was followed.","howWorkedOut":"Your input, cleaned up."},{"field":"summary","type":"string","is":"What happened, in plain words, with the flags.","howWorkedOut":"Built from the fields below."},{"field":"period","type":"{ from, to }","is":"The time span the transactions cover (UTC).","howWorkedOut":"Oldest and newest block times."},{"field":"sol_now","type":"string | null","is":"SOL the wallet holds now. null if it couldn't be read.","howWorkedOut":"getBalance."},{"field":"flows[]","type":"array","is":"One entry per transaction, newest first: tx_id, time, result, direction (in / out / both / none), sol_change, sol_before (the wallet's SOL just before), token_changes (token, symbol, change, decimals), counterparty, fee_payer, wallet_signed, programs, memo.","howWorkedOut":"The wallet's own balance changes from each transaction's before/after balances; counterparty is the address whose change mirrors the wallet's biggest move; a fee-only change is direction none."},{"field":"top_destinations[]","type":"array","is":"Where most money went (up to 3, tokens first): address, transactions, sol_out, tokens_out (token, symbol, amount), and kind (wallet that can sign, program-controlled address, program, token account, or unknown), value_usd (null when prices are unavailable).","howWorkedOut":"Outgoing flows grouped by counterparty, ranked by USD value at today's Jupiter prices (tokens with no price count 0), or tokens first then SOL when Jupiter can't be reached; kind from the account's owner and whether the address is on the ed25519 curve."},{"field":"flags[]","type":"array","is":"Patterns found, each with name, level (warn / info), detail and the tx_ids that show it: fee_paid_by_other_wallet, passed_straight_through, lookalike_dust, dust_received, emptied, swept_to_collection_wallet.","howWorkedOut":"Fixed rules on the flows (see each detail). None says who anyone is."},{"field":"report","type":"object","is":"The same facts as a report a person can act on: problem (one line; a single send of half or more of the wallet's SOL leads it), biggest_move (the largest send: tx_id, time, to, sol, tokens, value_usd, share_of_sol_pct, wallet_signed, fee_payer, solscan; null if nothing went out), evidence (every transaction that moved money, UTC and local time, what moved where, Solscan link), destinations (with Solscan links), confidence (high / medium / low and the reason), points_to, next_steps.","howWorkedOut":"Fixed rules on the flags: high only for the full drain pattern (swept and emptied) into anything but a busy collection wallet, medium for that case and for single signs, low when nothing matched. Built only from the fields above."},{"field":"unread","type":"number","is":"Transactions listed for the wallet that couldn't be loaded; they're left out, never guessed.","howWorkedOut":"Signatures minus loaded transactions."},{"field":"next_before","type":"string | null","is":"Pass as before to read the next, older page.","howWorkedOut":"The oldest transaction returned; null when there are no more."}],"notes":["Facts, not accusations: each flag says what the transactions show and what else can cause it.","No exchange or entity labels: Pulse has no verified source for them, so a destination is described only by what the chain says it is."],"inputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"wallet":{"type":"string","description":"The wallet to follow. The user's wallet, or an address from their report. Never make one up."},"how_many":{"default":25,"description":"How many recent transactions to read, newest first (1-50, default 25). More covers a longer stretch of time.","type":"integer","minimum":1,"maximum":50},"before":{"description":"Start below this transaction, to page further back. next_before from the previous answer.","type":"string","minLength":64,"maxLength":100},"time_zone":{"description":"The person's time zone, so the report shows their clock time next to UTC, e.g. America/Chicago. Ask them, or leave it out for UTC only.","type":"string","maxLength":64},"network":{"default":"mainnet-beta","description":"Default \"mainnet-beta\" (real money). \"devnet\" only for test wallets.","type":"string","enum":["mainnet-beta","devnet"]}},"required":["wallet"]}}