cycle 3: MCP server, security audits, and the Parasol SDK

19 commits. 48 hours. this cycle changed what Parasol is.

we started the week as a trading agent. we ended it as an intelligence layer that any AI in the world can plug into. here's everything that shipped.

Parasol enters the Colosseum Solana Frontier hackathon

---

the Parasol MCP server

this is the headline. Parasol now speaks the Model Context Protocol, the industry standard for connecting AI agents to external tools. Claude, GPT, Cursor, or any custom AI agent can connect to Parasol and use our trading intelligence directly.

8 tools available:

parasol_analyze_token checks any Solana token for rug risk and honeypot status, then returns a clear SAFE / CAUTION / AVOID recommendation

parasol_check_rug_risk runs our 6-layer rug detection and returns a 0-100 score with per-category breakdown

parasol_check_honeypot simulates a sell to verify the token can actually be traded

parasol_get_trending shows the top-scored opportunities from our latest scan cycle

parasol_get_portfolio displays open positions with live PnL

parasol_agent_status checks if the autonomous agent is running

parasol_start_agent / parasol_stop_agent control the full trading agent lifecycle

why this matters: nobody else has built a memecoin-specific MCP server for Solana. the existing ecosystem has raw blockchain data servers and generic DeFi tools. nobody wraps rug detection, honeypot checking, bonding curve intelligence, and the kind of battle-tested execution infrastructure that Parasol has. this is the first.

any developer building a trading bot, a Telegram alert system, a portfolio dashboard, or an AI research tool can now plug into months of Parasol infrastructure with a single API key.

---

the Parasol SDK

we built a complete billing and API key system so developers can pay for what they use.

how it works:

1. create an API key (free tier: 500 Parasol Compute Units per month)

2. each tool call costs 1-8 PCU depending on complexity

3. add credits by depositing USDC (1 USDC = 1,000 PCU)

4. usage is tracked per call with a full financial ledger

pricing is simple: 1 PCU = $0.001. a rug check costs $0.005. a full token analysis costs $0.008. portfolio reads and agent status checks are free.

the billing system was designed with input from a security audit modeled on Solana Foundation standards. every deposit is verified on-chain before credits are applied. the ledger tracks every credit and debit for full auditability.

SDK and MCP documentation is available on our GitHub repository. For API access, reach out on Discord or X.

---

8 security audits, 18 fixes shipped

we ran the most comprehensive security review in Parasol's history. 8 parallel audits, each from a different expert perspective:

1. transaction safety (Solana security engineer) found and fixed a critical slippage calculation bug in the buy instruction, added account ownership validation, and capped priority fees

2. application security (OWASP/pentest) found and removed a hardcoded admin secret, auth-gated an exposed API key endpoint, and enforced authentication across all 65+ frontend API calls

3. trading systems (institutional prop desk) identified position reconciliation gaps and documented the full order lifecycle

4. AI decision safety (ML auditor) found that exit level randomization needs a server-side secret and the adaptive learner needs higher sample thresholds

5. data integrity (data engineer) fixed the Moralis batch pricing endpoint and replaced a hardcoded SOL price in honeypot detection with a live feed

6. revenue accounting (fintech CFO) added a TTL cache to the fee wallet readiness check and documented the referral payout economics

7. UX and product (product designer) identified stale price indicators and position transparency improvements

8. infrastructure (SRE) added crash handlers to the worker process and memory monitoring to the health endpoint

130+ total findings. 18 fixed and deployed the same day. the remaining findings are documented and prioritized for upcoming cycles.

---

dual-path transaction submission

every sell now fires through two independent paths simultaneously: staked RPC and Jito bundle auction. the first one to land wins. the other is naturally deduplicated by Solana.

this means every sell gets both the speed of staked connections and the MEV protection of Jito bundles. previously these ran sequentially (try Jito, wait, fall back to RPC). now they race in parallel.

---

deterministic take-profit execution

we removed the momentum continuation skip that was causing 35% of take-profit levels to never fire. when a token hit TP1 during strong momentum, the system would redistribute that portion to TP2 instead of selling. if the token reversed before TP2, the profit was lost.

now TPs fire when price crosses the level. the trailing stop handles upside capture for strong momentum. guaranteed profit at each level.

---

auth enforcement

every mutation endpoint in the API (65+ routes) now receives authentication headers from the frontend. previously only 30% of fetch calls included auth tokens.

we also removed a legacy fallback that accepted userId from request headers, which was a user impersonation vulnerability. and we protected the /api/cycle endpoint with cron secret verification so external callers can't trigger trade cycles.

---

whitepaper v4.0

the whitepaper was rewritten from scratch to reflect the current state of the product:

leads with the "human conviction + AI discipline" thesis

new sections on the proprietary execution engine and exit intelligence

security section covering auth enforcement and anti-exploitation measures

updated roadmap reflecting what's shipped vs planned

no implementation details exposed (IP protected)

---

Colosseum Solana Frontier hackathon

we have officially entered the Colosseum Solana Frontier hackathon (April 6 to May 11).

our submission: Parasol as Solana's memecoin intelligence layer, powered by MCP. any AI agent can analyze tokens for safety, detect rug pulls, check honeypot status, and execute trades through a standard protocol.

the hackathon gives us 5 weeks to refine the product, build the pitch video, and demonstrate that the combination of human conviction and AI discipline creates a genuinely new capability in DeFi.

we're building in public. every commit deploys immediately. you can watch the product evolve in real time.

---

what's next

custom agent builder where users create, name, and configure their own trading agents with visual parameter controls

agent competitions with seasonal leagues, leaderboards, and copy trading

strategy marketplace where top-performing agents can be shared or rented

dedicated Frankfurt server for sub-millisecond Jito latency

pitch video for the hackathon submission

19 commits in 48 hours. the product is fundamentally different from what it was at the start of the week. and we're just getting started.