io.github.Jrigada/foundry-zksync
NPM · FOUNDRY-ZKSYNC-MCP
Expose foundry-zksync (forge, cast, anvil-zksync) tools for zkSync Era development
Available components
Last scanned (7 hours ago)
Scores higher than 53% of npm servers
Category Crypto and Web3
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 30 of 93 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency44
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 254 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability67
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 4095 tokens (~195/item across 21 items; 21 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "clean" implies "remove" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 21 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Nov 26 +1
- Stability: 0.97 → pass security
- 2 Nov 26 −1
- Stability: pass → 0.97 functional
- 27 Oct 26 +1
- Stability: 0.97 → pass security
- 26 Oct 26 −1
- Stability: pass → 0.97 functional
- 24 Oct 26 −5
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
- 20 Oct 26 +1
- Stability: 0.97 → pass security
- 19 Oct 26 −1
- Stability: pass → 0.97 functional
- 17 Oct 26 +2
- Stability: 0.87 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/foundry-zksync-mcp@0.2.3
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 93 packages
| Packages resolved | 93 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
anvil_zksync ~181
Start or check a local anvil-zksync development node. Supports forking from mainnet/testnet. Default port: 8011.
| Name | Type | Req | Description |
|---|---|---|---|
| accounts | number | – | Number of funded accounts to generate (default: 10) |
| action | string | yes | 'start' launches anvil-zksync in the background and returns when ready. 'check' tests if anvil-zksync is reachable at the given port. |
| balance | number | – | ETH balance for each generated account in ether (default: 10000) |
| forkBlockNumber | number | – | Block number to fork from (requires forkUrl) |
| forkUrl | string | – | RPC URL to fork from, e.g. https://mainnet.era.zksync.io |
| port | number | – | Port to listen on (default: 8011) |
No output schema declared.
No examples provided.
cast_abi_decode ~111
Decode ABI-encoded hex data back into human-readable values (cast abi-decode)
| Name | Type | Req | Description |
|---|---|---|---|
| data | string | yes | Hex-encoded ABI data to decode (0x-prefixed) |
| input | boolean | – | If true, decode as input data (function args). If false/omitted, decode as output data (return values). |
| signature | string | yes | Solidity function signature whose output types to decode against, e.g. "balanceOf(address)(uint256)" or "transfer(address,uint256)" |
No output schema declared.
No examples provided.
cast_abi_encode ~87
ABI-encode values for a given Solidity function/constructor signature (cast abi-encode)
| Name | Type | Req | Description |
|---|---|---|---|
| args | array | yes | Values to encode, matching the signature types in order, e.g. ["0x1234...", "1000000"] |
| signature | string | yes | Solidity function or constructor signature, e.g. "constructor(address,uint256)" or "transfer(address,uint256)" |
No output schema declared.
No examples provided.
cast_balance ~89
Query the ETH balance of an address (cast balance)
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | Address to query the balance of |
| blockTag | string | – | Block to query at, e.g. "latest", "pending", or a block number |
| ether | boolean | – | If true, format the output in ether instead of wei |
| rpcUrl | string | yes | RPC URL of the network |
No output schema declared.
No examples provided.
cast_call ~134
Read-only call to a deployed contract — no gas spent, no state change (cast call)
| Name | Type | Req | Description |
|---|---|---|---|
| args | array | – | Function arguments in order, e.g. ['0x1234...'] |
| blockTag | string | – | Block to query at, e.g. "latest", "pending", or a block number |
| rpcUrl | string | yes | RPC URL of the zkSync network to call against |
| signature | string | yes | Function signature with return type, e.g. "balanceOf(address)(uint256)" or "name()(string)" |
| to | string | yes | Address of the contract to call |
No output schema declared.
No examples provided.
cast_calldata_decode ~70
Decode raw transaction calldata (with 4-byte selector) into function arguments (cast calldata-decode)
| Name | Type | Req | Description |
|---|---|---|---|
| calldata | string | yes | Raw transaction calldata (0x-prefixed, includes the 4-byte selector) |
| signature | string | yes | Function signature, e.g. "transfer(address,uint256)" |
No output schema declared.
No examples provided.
cast_nonce ~88
Query the transaction nonce of an address (cast nonce). Note: on zkSync this returns the TX nonce only, not the deploy nonce.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | Address to query the nonce of |
| blockTag | string | – | Block to query at, e.g. "latest", "pending", or a block number |
| rpcUrl | string | yes | RPC URL of the network |
No output schema declared.
No examples provided.
cast_send ~414
Send a state-changing transaction to a deployed contract (cast send)
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | – | Named keystore account from ~/.foundry/keystores (recommended for production). Create one with: cast wallet import <name> --interactive |
| args | array | – | Function arguments in order |
| aws | boolean | – | Sign with AWS KMS (requires AWS_KMS_KEY_ID env var) |
| from | string | – | Sender address, used with --unlocked or hardware wallets. Maps to --from for cast/deploy, --sender for forge script. |
| gasLimit | string | – | Gas limit override |
| gcp | boolean | – | Sign with Google Cloud KMS (requires GCP_PROJECT_ID, GCP_LOCATION, GCP_KEY_RING, GCP_KEY_NAME, GCP_KEY_VERSION env vars) |
| keystore | string | – | Path to an encrypted keystore JSON file |
| keystorePassword | string | – | Keystore password (prefer passwordFile to keep it out of process args) |
| ledger | boolean | – | Sign with a Ledger hardware wallet |
| passwordFile | string | – | Path to a file containing the keystore password |
| privateKey | string | – | Raw private key for signing. Only use for local development with well-known test keys (e.g. anvil-zksync accounts). For production, use 'account' (named keystore) or hardware wallets instead. |
| rpcUrl | string | yes | RPC URL of the zkSync network |
| signature | string | yes | Function signature, e.g. "transfer(address,uint256)" |
| to | string | yes | Address of the contract to send the transaction to |
| trezor | boolean | – | Sign with a Trezor hardware wallet |
| unlocked | boolean | – | Use eth_sendTransaction with --from address (no local signing). For nodes that manage keys natively. |
| value | string | – | ETH value to send with the transaction, e.g. "0.1ether" or amount in wei |
No output schema declared.
No examples provided.
clean ~93
Remove build artifacts (out/ and zkout/) from a foundry project (forge clean)
| Name | Type | Req | Description |
|---|---|---|---|
| profile | string | – | Foundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'. |
| projectPath | string | yes | Absolute path to the foundry project directory |
No output schema declared.
No examples provided.
compile ~130
Compile a foundry-zksync project (forge build --zksync). Check foundry.toml for [profile.X.zksync] sections — if zkSync sources live under a specific profile (e.g. 'zksync'), pass that as the profile argument.
| Name | Type | Req | Description |
|---|---|---|---|
| profile | string | – | Foundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'. |
| projectPath | string | yes | Absolute path to the foundry project directory |
No output schema declared.
No examples provided.
deploy ~564
Deploy a contract to a zkSync network (forge create --zksync). Returns structured output with contract address, tx hash, and deployer.
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | – | Named keystore account from ~/.foundry/keystores (recommended for production). Create one with: cast wallet import <name> --interactive |
| aws | boolean | – | Sign with AWS KMS (requires AWS_KMS_KEY_ID env var) |
| broadcast | boolean | – | If true, actually broadcast the deployment transaction on-chain. Without this, forge create runs in dry-run mode. |
| constructorArgs | array | – | Constructor arguments, each as a separate string. Solidity types are ABI-encoded by forge, e.g. ['0xaddr', '100', 'hello'] |
| contractPath | string | yes | Contract identifier in the form src/MyContract.sol:MyContract |
| extraArgs | array | – | Additional CLI flags, each as a separate array element |
| from | string | – | Sender address, used with --unlocked or hardware wallets. Maps to --from for cast/deploy, --sender for forge script. |
| gcp | boolean | – | Sign with Google Cloud KMS (requires GCP_PROJECT_ID, GCP_LOCATION, GCP_KEY_RING, GCP_KEY_NAME, GCP_KEY_VERSION env vars) |
| keystore | string | – | Path to an encrypted keystore JSON file |
| keystorePassword | string | – | Keystore password (prefer passwordFile to keep it out of process args) |
| ledger | boolean | – | Sign with a Ledger hardware wallet |
| passwordFile | string | – | Path to a file containing the keystore password |
| privateKey | string | – | Raw private key for signing. Only use for local development with well-known test keys (e.g. anvil-zksync accounts). For production, use 'account' (named keystore) or hardware wallets instead. |
| profile | string | – | Foundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'. |
| projectPath | string | yes | Absolute path to the foundry project directory |
| rpcUrl | string | yes | RPC URL of the target zkSync network |
| trezor | boolean | – | Sign with a Trezor hardware wallet |
| unlocked | boolean | – | Use eth_sendTransaction with --from address (no local signing). For nodes that manage keys natively. |
| verifierUrl | string | – | Block explorer verification API URL (e.g. https://api-era.zksync.network/api) |
| verify | boolean | – | If true, verify the contract on a block explorer after deployment |
No output schema declared.
No examples provided.
explain ~134
Explain raw output from foundry-zksync: error messages, logs, or transactions. Matches against a knowledge base of known zkSync gotchas and returns actionable advice. Use context='general' for background on what foundry-zksync is and how it works.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | Hint for what kind of text this is. 'general' prepends foundry-zksync background context. Defaults to general. |
| rawText | string | yes | Raw text to explain — can be an error message, forge log output, transaction hash, ABI-encoded data, or a general question about foundry-zksync |
No output schema declared.
No examples provided.
gas_report ~171
Run tests and generate a gas usage report (forge test --zksync --gas-report). Note: zkSync gas values are aggregate-only (no computation/pubdata breakdown).
| Name | Type | Req | Description |
|---|---|---|---|
| contractFilter | string | – | Regex passed to --match-contract to filter which contracts appear in the report |
| filter | string | – | Regex passed to --match-test to filter which test functions run |
| pathFilter | string | – | Glob passed to --match-path to filter which test files run |
| profile | string | – | Foundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'. |
| projectPath | string | yes | Absolute path to the foundry project directory |
No output schema declared.
No examples provided.
get_zksync_docs ~155
Look up foundry-zksync documentation by topic. Returns URLs to the foundry-zksync book for installation, config, testing, deployment, cheatcodes, nonces, factory deps, paymasters, verification, and more. Use topic='list' to see all available topics.
| Name | Type | Req | Description |
|---|---|---|---|
| topic | string | yes | Topic to look up in the foundry-zksync book. Examples: 'installation', 'forge-test', 'cheatcodes', 'deployment', 'config', 'zksync-config', 'nonces', 'factory-deps', 'paymaster', 'verification', 'cas… |
No output schema declared.
No examples provided.
init ~126
Scaffold a new foundry project and add [profile.default.zksync] config (forge init)
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | Project name (used as directory name if projectPath is the parent) |
| noCommit | boolean | – | If true, skip the initial git commit (--no-commit) |
| noGit | boolean | – | If true, skip git initialization (--no-git) |
| projectPath | string | yes | Absolute path where the new project should be created |
| template | string | – | GitHub template to use, e.g. 'PaulRBerg/foundry-template' |
No output schema declared.
No examples provided.
install ~102
Install dependencies for a foundry project (forge install)
| Name | Type | Req | Description |
|---|---|---|---|
| dependencies | array | – | Dependencies to install, e.g. ['OpenZeppelin/openzeppelin-contracts', 'transmissions11/solmate']. If omitted, installs all existing dependencies from foundry.toml. |
| noCommit | boolean | – | If true, passes --no-commit to skip creating a git commit for the install |
| projectPath | string | yes | Absolute path to the foundry project directory |
No output schema declared.
No examples provided.
read_foundry_toml ~96
Read and return the contents of foundry.toml from a project. Useful for inspecting profiles, zkSync config, library links, and other settings.
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | yes | Absolute path to the foundry project directory |
| summary | boolean | – | If true, return a summary highlighting zkSync-relevant config (profiles, zksolc version, compile mode, libraries) instead of raw TOML. |
No output schema declared.
No examples provided.
run_script ~532
Run a forge script targeting zkSync (forge script --zksync)
| Name | Type | Req | Description |
|---|---|---|---|
| account | string | – | Named keystore account from ~/.foundry/keystores (recommended for production). Create one with: cast wallet import <name> --interactive |
| aws | boolean | – | Sign with AWS KMS (requires AWS_KMS_KEY_ID env var) |
| broadcast | boolean | – | If true, passes --broadcast to actually send transactions on-chain |
| extraArgs | array | – | Additional CLI flags, each as a separate array element, e.g. ['--verify', '--etherscan-api-key', 'abc'] |
| from | string | – | Sender address, used with --unlocked or hardware wallets. Maps to --from for cast/deploy, --sender for forge script. |
| gcp | boolean | – | Sign with Google Cloud KMS (requires GCP_PROJECT_ID, GCP_LOCATION, GCP_KEY_RING, GCP_KEY_NAME, GCP_KEY_VERSION env vars) |
| keystore | string | – | Path to an encrypted keystore JSON file |
| keystorePassword | string | – | Keystore password (prefer passwordFile to keep it out of process args) |
| ledger | boolean | – | Sign with a Ledger hardware wallet |
| passwordFile | string | – | Path to a file containing the keystore password |
| privateKey | string | – | Raw private key for signing. Only use for local development with well-known test keys (e.g. anvil-zksync accounts). For production, use 'account' (named keystore) or hardware wallets instead. |
| profile | string | – | Foundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'. |
| projectPath | string | yes | Absolute path to the foundry project directory |
| rpcUrl | string | – | RPC URL to fork from or broadcast to |
| scriptPath | string | yes | Path to the Solidity script file, e.g. script/Deploy.s.sol |
| sender | string | – | Address to use as msg.sender for the script simulation (--sender). Useful for dry-run without a signing key. |
| slow | boolean | – | If true, sends transactions sequentially (--slow). Required on ZK chains which do not support transaction batching. |
| trezor | boolean | – | Sign with a Trezor hardware wallet |
| unlocked | boolean | – | Use eth_sendTransaction with --from address (no local signing). For nodes that manage keys natively. |
No output schema declared.
No examples provided.
snapshot ~188
Create or compare gas snapshots (forge snapshot --zksync). Use diff=true to compare against existing .gas-snapshot, check=true to fail on changes.
| Name | Type | Req | Description |
|---|---|---|---|
| check | boolean | – | If true, compare against existing snapshot and fail if any gas values changed |
| contractFilter | string | – | Regex passed to --match-contract to filter which test contracts run |
| diff | boolean | – | If true, compare against the existing .gas-snapshot file and show differences |
| filter | string | – | Regex passed to --match-test to filter which test functions run |
| profile | string | – | Foundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'. |
| projectPath | string | yes | Absolute path to the foundry project directory |
No output schema declared.
No examples provided.
test ~232
Run tests in a foundry-zksync project (forge test --zksync). Check foundry.toml for [profile.X] sections — if the test directory differs per profile (e.g. profile 'zksync' has test = 'zksync/tests'), pass the correct profile argument.
| Name | Type | Req | Description |
|---|---|---|---|
| contractFilter | string | – | Regex passed to --match-contract to filter which test contracts run |
| filter | string | – | Regex passed to --match-test to filter which test functions run |
| pathFilter | string | – | Glob passed to --match-path to filter which test files run, e.g. 'test/unit/*' |
| profile | string | – | Foundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'. |
| projectPath | string | yes | Absolute path to the foundry project directory |
| verbosity | integer | – | Verbosity level (0-5), maps to -v through -vvvvv. Higher = more trace output |
No output schema declared.
No examples provided.
verify ~398
Verify a deployed contract on a block explorer (forge verify-contract --zksync). Supports Etherscan (requires API key) and zkSync Explorer (no key needed).
| Name | Type | Req | Description |
|---|---|---|---|
| compilerVersion | string | – | Compiler version used for deployment, e.g. v0.8.26+commit.8a97fa7a |
| constructorArgs | string | – | ABI-encoded constructor arguments (hex string, no 0x prefix) |
| contractAddress | string | yes | Deployed contract address to verify |
| contractPath | string | yes | Contract identifier, e.g. src/MyContract.sol:MyContract |
| etherscanApiKey | string | – | Etherscan API key (required when verifier is 'etherscan') |
| extraArgs | array | – | Additional CLI flags |
| numOptimizations | number | – | Number of optimization runs used during compilation |
| profile | string | – | Foundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'. |
| projectPath | string | yes | Absolute path to the foundry project directory |
| retries | integer | – | Number of verification retries (default: 2, max: 10). Minimum is 1. Forge retries on transient failures. |
| verifier | string | yes | Verification backend. 'etherscan' requires an API key, 'zksync' uses the zkSync Explorer (no API key needed). |
| verifierUrl | string | yes | Verifier API URL. Etherscan mainnet: https://api-era.zksync.network/api, Etherscan testnet: https://api-sepolia-era.zksync.network/api, Explorer mainnet: https://explorer.zksync.io/contract_verificat… |
No output schema declared.
No examples provided.
How do I install the io.github.Jrigada/foundry-zksync MCP server?
io.github.Jrigada/foundry-zksync runs locally as an npm package, launched with npx -y foundry-zksync-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · foundry-zksync-mcp
claude mcp add jrigada-foundry-zksync -- npx -y foundry-zksync-mcp
What is the io.github.Jrigada/foundry-zksync MCP server?
io.github.Jrigada/foundry-zksync is an MCP server listed in the public MCP registry as io.github.Jrigada/foundry-zksync. Expose foundry-zksync (forge, cast, anvil-zksync) tools for zkSync Era development. This page covers its npm package (foundry-zksync-mcp).
Is the io.github.Jrigada/foundry-zksync MCP server safe to use?
io.github.Jrigada/foundry-zksync scores 76 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.Jrigada/foundry-zksync MCP server expose?
io.github.Jrigada/foundry-zksync exposes 21 tools: init, install, clean, compile, test, and 16 more. Their descriptions and schemas cost roughly 4,095 tokens of context every time the server is loaded.
Is the io.github.Jrigada/foundry-zksync MCP server still maintained?
io.github.Jrigada/foundry-zksync is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.Jrigada/foundry-zksync MCP server under?
io.github.Jrigada/foundry-zksync declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.