
Security News
pnpm 11.5 Adds Support for Recognizing npm Staged Publishes
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.
pumpswap-python
Advanced tools
Direct Pump AMM (pAMMBay) + legacy PumpSwap swaps in Python. Build raw Solana instructions, no Jupiter.
Direct Pump AMM (pAMMBay…) + legacy PumpSwap swaps. From Python. No Jupiter.
When a pump.fun token graduates off its bonding curve, it moves to an AMM pool —
today that's Pump AMM, the pAMMBay6oceH9fJKBRHGP5D4bD4sWpmSwMn52FMfXEA
program. Jupiter can route through it, but you pay an extra hop of latency and
you're at the mercy of its routing. This library builds the raw on-chain swap
instructions directly, so you control exactly what lands on chain.
There's plenty of bonding-curve tooling out there. A complete, current Pump AMM swap builder in Python — handling the 23/21-account layouts, reversed base/quote pools, coin-creator vaults, volume accumulators, Token-2022, and WSOL wrap/unwrap — was missing. This is that.
Building against the bonding curve (pre-graduation)? See the companion package pumpfun-python.
pip install pumpswap-python
Only two runtime deps: solders and
httpx. No SDK bloat.
build_buy / build_sell read the pool, do the math, and hand you an ordered
list of unsigned instructions plus a quote. You sign and send — the library
never touches your keys.
import asyncio
import httpx
from solders.keypair import Keypair
from solders.transaction import VersionedTransaction
from pumpswap import build_buy, build_message, fetch_latest_blockhash
RPC = "https://api.mainnet-beta.solana.com" # use your own (Helius/QuickNode) for real volume
wallet = Keypair() # load your real keypair
MINT = "TokenMintAddress..."
POOL = "PumpAmmPoolAddress..."
async def main():
async with httpx.AsyncClient() as client:
plan = await build_buy(
RPC, wallet.pubkey(), MINT, POOL,
sol_lamports=100_000_000, # 0.1 SOL
slippage_bps=500, # 5%
http_client=client,
)
blockhash = await fetch_latest_blockhash(RPC, http_client=client)
print(f"venue={plan.venue} expected_tokens={plan.expected_tokens:,} max_sol={plan.max_sol_in}")
msg = build_message(wallet.pubkey(), plan.instructions, blockhash)
tx = VersionedTransaction(msg, [wallet]) # ← you sign
# ... send `tx` with your RPC's sendTransaction
asyncio.run(main())
Selling is symmetric:
plan = await build_sell(RPC, wallet.pubkey(), MINT, POOL, token_amount=1_000_000, http_client=client)
print(plan.expected_sol_out, plan.min_sol_out)
from pumpswap import calculate_swap_output
amount_out, fee = calculate_swap_output(
amount_in=100_000_000,
reserve_in=5_000_000_000,
reserve_out=1_000_000_000_000,
lp_fee_bps=20,
protocol_fee_bps=5,
)
| Function | Returns |
|---|---|
build_buy(rpc_url, user, token_mint, pool, sol_lamports, *, slippage_bps=500) | BuyPlan |
build_sell(rpc_url, user, token_mint, pool, token_amount, *, slippage_bps=500) | SellPlan |
BuyPlan / SellPlan carry .instructions, .fee, .venue, and the quote
fields (expected_tokens / expected_sol_out, etc.).
fetch_pool_state · fetch_amm_config · fetch_vault_balances · read_pool_reserves
calculate_swap_output · build_amm_buy_instruction (23 accounts) ·
build_amm_sell_instruction (21 accounts)
build_legacy_swap_instruction (13 accounts)
build_create_ata_idempotent · build_sol_transfer · build_sync_native ·
build_close_account · build_message · prepend_compute_budget ·
fetch_latest_blockhash
get_associated_token_address · get_coin_creator_vault_authority ·
get_user_volume_accumulator; all program IDs and discriminators are exported.
buy vs sell ≠ user buy/sell. The instructions are relative to
the pool's base/quote. build_buy/build_sell translate intent for you.base_mint = SOL, quote_mint = TOKEN. PoolState.base_is_sol flags it; a user "buy" then maps to a program
sell, and vice-versa.buy has 23 accounts, sell has 21. Buy carries the global + user volume
accumulators; sell does not.coin_creator, which can legitimately be
the zero pubkey — don't substitute the pool creator, or the on-chain
constraint fails.Free for noncommercial use under the PolyForm Noncommercial License 1.0.0 — personal projects, research, education, non-profits.
Commercial use requires a license (trading for profit, products/services, multi-user apps, use inside a company). See COMMERCIAL.md.
Trading on-chain carries financial risk and these instructions move real funds. This software is provided "as is", without warranty of any kind. You are responsible for what you sign and send. Always test with small amounts first.
FAQs
Direct Pump AMM (pAMMBay) + legacy PumpSwap swaps in Python. Build raw Solana instructions, no Jupiter.
We found that pumpswap-python demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.

Security News
Federal audit finds NIST lacked a plan to clear the NVD backlog, wasted funds on duplicate work, and delayed use of CISA data.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.