stealth-trader

Give your AI agent its own Solana wallet — it trades for you, and nothing traces back to it.

An open-source MCP server (plus a Telegram bot) that gives an AI agent its own Solana wallet. Hand it to a Claude or Cursor agent and it can buy, sell, and cash out on its own. Every trade runs inside the b402 shielded pool: the SOL is shielded, swapped, and reshielded as an encrypted note behind a zero-knowledge proof, with a relayer signing the on-chain tx. The trade lands on-chain — but the agent's wallet isn't the signer or even an account on it, so nothing traces back to it. Prefer to tap instead of prompt? The same engine runs as a Telegram bot.

Get started · What it does · MCP tools · How it works · Security

Note: the live mainnet deployment is a test playground, not production. The current program IDs are an experimental preview — use small amounts only and treat it as a tech demo. An audited production deployment, under multisig upgrade authority, is in progress and will replace these program IDs.

_{Terminal: pnpm smoke — a mainnet shield → swap → cashout in ~25 seconds. Prints Solscan links so you can verify the depositor wallet is absent from tx.accountKeys.} _{Telegram (hosted bot): buy a token, then verify on-chain that the swap tx's accountKeys don't include your wallet. Full MP4.}

Get started

Use it from an agent — one command, zero config (Claude Code, Cursor, any MCP runtime):

claude mcp add stealth-trader -- npx -y @b402ai/stealth-trader@latest mcp

First run generates a wallet and saves its seed to ~/.config/stealth-trader/master-seed — back that file up; it derives the wallet that holds your funds. It boots on public mainnet RPC so reads work out of the box, but set HELIUS_RPC_URL (free, 1 min at helius.dev) before trading — public RPC throttles and swaps can fail on it.

Your agent can now buy, sell, check holdings, and cash out — privately. Ask it: "privately buy 0.01 SOL of <mint>, then cash out to a fresh address." It composes the tools and signs nothing with your own wallet — the relayer does.

See it on mainnet — ~25s, costs ~$0.01:

git clone https://github.com/mmchougule/stealth-trader && cd stealth-trader
pnpm install
export HELIUS_RPC_URL="https://mainnet.helius-rpc.com/?api-key=YOUR_KEY"   # free at helius.dev
pnpm smoke

Needs a Solana CLI wallet with ~0.005 SOL — the script auto-funds the test wallet from ~/.config/solana/id.json (or fund the address it prints). It shields, swaps, and cashes out, then prints two Solscan links: your wallet is not in the swap's accountKeys. (full steps + exact cost ↓)

Or use the hosted Telegram bot: t.me/btrader021bot — /start, send a little SOL, Buy. This repo ships v0.5 (/buy, /sell, /cashout, /holdings, leader discovery, MCP); /follow lands in v0.6.

What it does (v0.5)

feature	what it is	how to use
Private buy	Buy any SPL token through Jupiter. Your wallet never signs the swap; the relayer does. Rug-check gate aborts obvious honeypots before any SOL moves.	TG `/buy <mint> <sol>` · MCP `private_buy` · `pnpm smoke`
Private sell	Sell a shielded token note back to SOL — same privacy property as buy.	TG `/sell <mint> <amount>`
Private cashout	Withdraw shielded balance to any wallet. The recipient has no on-chain edge to your deposit address.	TG `/cashout <addr>` · MCP `cashout`
Private holdings	Per-mint shielded balance — only the viewing-key holder can read it.	TG `/holdings` · MCP `get_holdings`
Private lend	Deposit shielded USDC into Kamino V2 for yield. Deposit address absent on chain.	MCP `private_lend` (mainnet)
Leader stats / discovery	7-day PnL, hit rate, top mints for any wallet; curated starter list. Read-only in v0.5.	TG `/leader <wallet>`, `/discover` · MCP `discover_leaders`

Seven MCP tools an agent can compose: "check this wallet's 7-day stats, then privately buy 0.01 SOL of its top mint, and cash out to a fresh address." The agent calls discover_leaders → private_buy → cashout — every trade signed by the relayer, your wallet never in tx.accountKeys.

Copy-trade (/follow) ships in v0.6 — it needs a hosted Helius webhook proxy so self-hosters don't need ngrok. The full copy-trade bot is live now at t.me/btrader021bot if you want to try that flow today.

Why it matters

On Solana, the wallet that signs your swap is your wallet — so every trade is stamped with your address in public. Anyone can front-run your buys, copy your positions in real time, read your whole portfolio from a single address, and watch exactly when you exit.

stealth-trader breaks that link: a relayer signs the trade, not you, so there's nothing to correlate. Don't take our word for it — open any tx the bot produces on Solscan and your deposit address is not in tx.accountKeys. The bot's "Verify privacy" button shows you that, per trade.

Try it in 30 seconds

git clone https://github.com/mmchougule/stealth-trader && cd stealth-trader
pnpm install
export HELIUS_RPC_URL="https://mainnet.helius-rpc.com/?api-key=YOUR_KEY"
pnpm smoke

Try it before any Telegram setup — the smoke needs a Helius RPC URL + a funded Solana CLI wallet, runs on mainnet in ~25 seconds, and proves the privacy property end-to-end.

Here's exactly what happens, no surprises:

Generates a MASTER_SEED into ./.env (back this up if you keep using it)
Derives a test wallet from that seed
Transfers 0.0045 SOL from your Solana CLI wallet (~/.config/solana/id.json) to the test wallet. The script previews this with a 5-second Ctrl-C window. Opt out: STEALTH_NO_AUTOFUND=1 + fund the printed address manually.
Shields 0.0015 SOL into the b402 pool. Your test wallet signs this — the one on-chain step where you're visible.
Swaps shielded SOL → USDC. Relayer signs; your wallet isn't in the swap tx.
Cashes the USDC out — back to your CLI wallet by default. Relayer signs; your wallet isn't in the cashout tx either.

The script prints two Solscan links. Open both: the test wallet address doesn't appear in accountKeys for the swap or the cashout. That's the privacy property, verifiable on chain. (How it works on-chain →)

Net cost: ~$0.01 in tx fees + a few cents of swap slippage. The 0.0015 SOL becomes ~0.13 USDC and comes back to your CLI wallet at the cashout — nothing is drained.

No Solana CLI keypair? The script prints the deposit address and waits 5 minutes for you to fund it manually.

Use cases

audience	how they use it	result
Solana trader (Telegram)	`/buy <mint> <sol>` to enter, `/sell` to exit, `/cashout <addr>` to withdraw to a fresh wallet	trades land shielded; cashout has no on-chain link to the deposit
AI agent (MCP)	One prompt composes `discover_leaders` → `private_buy` → `get_holdings` → `cashout`	agent runs a private DeFi strategy with no wallet attribution
App developer (TypeScript SDK)	`import { B402Solana } from '@b402ai/solana'` and drive the same primitives directly	embed private execution into your own product

Same code, three surfaces.

Install

As an MCP server (Claude Code, Cursor, any MCP runtime):

claude mcp add stealth-trader -- npx -y @b402ai/stealth-trader@latest mcp

Env: STEALTH_TG_ID, MASTER_SEED, HELIUS_RPC_URL. Data persists to a local pglite store at ~/.stealth-trader/db — set DATABASE_URL=postgresql://… to point at a real cluster.

For more MCP-side wiring (Claude Code, Cursor configs, prompt patterns): b402 MCP overview →.

As a self-hosted Telegram bot:

git clone https://github.com/mmchougule/stealth-trader && cd stealth-trader
pnpm install
pnpm wizard                       # paste bot token + Helius key
pnpm start                       # schema auto-applies on first boot

Get a bot token from @BotFather and a free Helius key from helius.dev. The bot ships with pglite (WASM Postgres) in-process, so the only thing you need to provision is the bot itself.

For production deployments, set OPERATOR_FEE_KEYPAIR_PATH to a keypair file with ~0.05 SOL on hand. It absorbs the one-time ~0.002 SOL rent per (recipient, mint) on /cashout so users never see "insufficient funds for rent" the first time they withdraw to a fresh address.

Usage (Telegram)

/start                            welcome + your deposit address
/wallet                           your deposit address (where to send SOL)
/balance                          public SOL balance you can spend

/buy <mint> <sol>                 private buy — shield fresh SOL and swap
/sell <mint> <raw-amount>         private sell — swap a token note back to SOL
/holdings                         per-mint shielded balances

/leader <wallet>                  7-day stats — PnL, hit rate, top mints
/discover                         curated leaders (paste any into /leader)

/cashout <recipient> [mint]       unshield to any wallet (no link to deposit)

Copy-trade (/follow, /follows, /unfollow) lands in v0.6 once the hosted Helius webhook proxy ships — until then end-users would need ngrok to receive leader events.

MCP tools

Six tools an agent (Claude Code, Cursor, custom) can compose. Example: "buy 0.05 SOL of this mint privately, then sell it back and cash out to a fresh address."

tool	what it does
`get_wallet`	the agent's deposit address (fund it with SOL)
`get_balance`	public SOL + shielded SOL + total available
`get_holdings`	shielded token balances per mint
`private_buy`	swap SOL → any SPL token through the shielded pool
`private_sell`	swap a shielded token note back to SOL
`cashout`	unshield to any recipient, with no on-chain link to the deposit

Private lending (Kamino) and copy-trade/leader discovery land in a later release alongside the audited deployment.

How it works

Fund your derived address  ──►  public SOL balance
                                       │  shield at trade time
                                       ▼
        ┌──────────────  b402 shielded pool  ──────────────┐
        │   encrypted notes · commitment tree + nullifier tree
        ▼                      ▼                      ▼
   private_buy            private_sell           private_lend
   (SOL → token)          (token → SOL)          (Kamino USDC)
        │                      │                      │
        └──────────┬───────────┴──────────┬───────────┘
                   ▼                      ▼
          swap is CPI'd inside     output reshields as a
          the pool; relayer        new encrypted note
          signs the on-chain tx    (yours, still hidden)

You fund a derived address — that's your public balance. A buy shields fresh SOL into the pool, swaps it for the token via a CPI from inside the pool, and reshields the output as a new encrypted note; if you already hold a shielded note, it skips the shield and just swaps that note. Each spend is an adapt proof: it proves in zero-knowledge that you own a valid unspent note — tracked in the commitment tree, retired in the nullifier tree — without revealing which one or whose. The relayer signs the on-chain tx from a pool-controlled account, so your wallet is not a signer, not an account, not in the block.

Deeper reading on the b402 docs site:

Privacy model — exactly what's hidden, what's revealed
Trust assumptions — what the relayer can and can't do
Protocol architecture — circuits, nullifier tree, verifier
Adapter overview — how Jupiter/Kamino integrate

Two correctness properties worth knowing — both ship in @b402ai/solana@0.0.33:

Swap routes ladder down on tx-size overrun. Jupiter routes vary trade-to-trade; some exceed the relayer's tx-build buffer ("encoding overruns Uint8Array"). The swap layer retries at maxAccounts [32, 28, 24, 20] until the wrapped tx fits, then surfaces a clean error if none do.
Note leafIndex comes from the pool's CommitmentAppended event log, not the pre-tx tree.leafCount prediction. Concurrent shields on the shared pool race the prediction. Reading the post-confirm event eliminates the phantom-note class that produces silent Adapt_221 proof failures.

Compared to

vs. public DEX routers (Jupiter, Raydium UI, etc.):

property	stealth-trader	public router
your wallet signs the swap?	no	yes
your wallet appears in `tx.accountKeys`?	no	yes
your portfolio is readable from your address?	no	yes
wallet trackers can link the trade to you?	no	yes

vs. copy-trade bots (Trojan, BullX, Photon, Maestro):

property	stealth-trader	Trojan / BullX / Photon
follower's wallet appears in the leader's block?	no	yes
MCP-callable (any agent runtime)?	yes	no
open source?	yes	no

The "wallet in accountKeys" rows are facts checkable on Solscan in 30 seconds for any tx those tools produce.

Numbers

206 unit tests covering swap-ladder, rug-check gate, Jupiter quote breaker, per-user serial lock, balance ledger, wallet derivation, delta-balance deposits, leader stats, MCP handlers.
Tests run against in-memory pglite + a mocked SDK; ~3s wall time. A few exercise live Jupiter/RugCheck and degrade gracefully when rate-limited, so the suite stays green offline.
Built on @b402ai/solana@0.0.33, mainnet program 42a3hsCXtQLWonyxWZosaaCJCweYYKMrvNd25p1Jrt2y.

Status

v0.5 — /buy, /sell, /holdings, /cashout work end-to-end against mainnet (TG + MCP); /leader and /discover are read-only stats. Every trade is relayer-signed; the user wallet never appears in the swap or cashout accountKeys. Copy-trade (/follow) lands in v0.6 with a hosted webhook proxy.

Limits

Copy-trade is buys only. Sells (leader sells X → follower sells X) ship with copy-trade in v0.6.
Hosted b402 relayer is the default. Run your own from mmchougule/b402-solana/packages/relayer and point B402_RELAYER_URL at it.
The b402 shielded pool is unaudited. Read the trust assumptions before depositing more than you'd lose in an experiment.
Same-amount notes pile up if every copy uses identical per_trade_lamports. The SDK recycles existing notes when shapes match. Snap-to-nearest recycle is on the roadmap.

Security

Reports: see SECURITY.md. 90-day coordinated disclosure.

Stack

@b402ai/solana — shielded pool SDK
@modelcontextprotocol/sdk — MCP transport
grammy — Telegram bot framework
zod — MCP tool schema validation
pino — structured logging
pg — Postgres driver
Helius enhanced webhooks for leader-tx ingestion

License

Apache-2.0.

Name		Name	Last commit message	Last commit date
Latest commit History 80 Commits
.github/workflows		.github/workflows
docs		docs
scripts		scripts
sql		sql
src		src
.env.example		.env.example
.gitignore		.gitignore
CONTRIBUTING.md		CONTRIBUTING.md
LICENSE		LICENSE
README.md		README.md
SECURITY.md		SECURITY.md
docker-compose.yml		docker-compose.yml
package.json		package.json
pnpm-lock.yaml		pnpm-lock.yaml
tsconfig.json		tsconfig.json

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Repository files navigation

stealth-trader

Get started

What it does (v0.5)

Why it matters

Try it in 30 seconds

Use cases

Install

Usage (Telegram)

MCP tools

How it works

Compared to

Numbers

Status

Limits

Security

Stack

License

About

Releases

Packages

Contributors

Languages

Folders and files

Latest commit

History

Repository files navigation

stealth-trader

Get started

What it does (v0.5)

Why it matters

Try it in 30 seconds

Use cases

Install

Usage (Telegram)

MCP tools

How it works

Compared to

Numbers

Status

Limits

Security

Stack

License

About

Topics

Resources

Contributing

Security policy

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages