io.github.Jrigada/foundry-zksync

NPM · FOUNDRY-ZKSYNC-MCP · SCANNED AUG 3

Expose foundry-zksync (forge, cast, anvil-zksync) tools for zkSync Era development

Available components

+24 this week 67 67 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 160 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability64

AI-judged instruction clarity (excellent).Pass
Context-footprint check failed: tool/resource definitions use about 4095 tokens (~195/item across 21 items; 21 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management27

Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
100% of tool parameters carry a description.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · foundry-zksync-mcp

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add jrigada-foundry-zksync -- npx -y foundry-zksync-mcp

# add to Codex CLI

codex mcp add jrigada-foundry-zksync -- npx -y foundry-zksync-mcp

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "jrigada-foundry-zksync": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "foundry-zksync-mcp"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add jrigada-foundry-zksync --command npx --arg -y --arg foundry-zksync-mcp

# ~/.hermes/config.yaml

mcp_servers:
  jrigada-foundry-zksync:
    command: "npx"
    args: ["-y", "foundry-zksync-mcp"]

// mcp.json

{
  "mcpServers": {
    "jrigada-foundry-zksync": {
      "command": "npx",
      "args": [
        "-y",
        "foundry-zksync-mcp"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

3 Aug 26 +1

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
2 Aug 26 +61
- Provenance: unverified → fail ▼ security
- Known CVEs: unverified → partial ▲ security
- Install scripts: unverified → pass ▲ security
- Malware scan: unverified → pass ▲ security
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Stability: unverified → 0.23 ▲ functional
- Schema quality: unverified → excellent ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- Licence: MIT functional
1 Aug 26 −20
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
31 Jul 26 −18
- Malware scan: pass → unverified ▼ security
27 Jul 26 43

First indexed and scored.

Show 2 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 95 packages

95 packages in the resolved dependency tree · 95 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 21 exposed · ~4,095 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

anvil_zksync ~181

Start or check a local anvil-zksync development node. Supports forking from mainnet/testnet. Default port: 8011.

Input Output Examples

Name	Type	Req	Description
accounts	number	—	Number of funded accounts to generate (default: 10)
action	string	yes	'start' launches anvil-zksync in the background and returns when ready. 'check' tests if anvil-zksync is reachable at the given port.
balance	number	—	ETH balance for each generated account in ether (default: 10000)
forkBlockNumber	number	—	Block number to fork from (requires forkUrl)
forkUrl	string	—	RPC URL to fork from, e.g. https://mainnet.era.zksync.io
port	number	—	Port to listen on (default: 8011)

No output schema declared.

No examples provided.

cast_abi_decode ~111

Decode ABI-encoded hex data back into human-readable values (cast abi-decode)

Input Output Examples

Name	Type	Req	Description
data	string	yes	Hex-encoded ABI data to decode (0x-prefixed)
input	boolean	—	If true, decode as input data (function args). If false/omitted, decode as output data (return values).
signature	string	yes	Solidity function signature whose output types to decode against, e.g. "balanceOf(address)(uint256)" or "transfer(address,uint256)"

No output schema declared.

No examples provided.

cast_abi_encode ~87

ABI-encode values for a given Solidity function/constructor signature (cast abi-encode)

Input Output Examples

Name	Type	Req	Description
args	array	yes	Values to encode, matching the signature types in order, e.g. ["0x1234...", "1000000"]
signature	string	yes	Solidity function or constructor signature, e.g. "constructor(address,uint256)" or "transfer(address,uint256)"

No output schema declared.

No examples provided.

cast_balance ~89

Query the ETH balance of an address (cast balance)

Input Output Examples

Name	Type	Req	Description
address	string	yes	Address to query the balance of
blockTag	string	—	Block to query at, e.g. "latest", "pending", or a block number
ether	boolean	—	If true, format the output in ether instead of wei
rpcUrl	string	yes	RPC URL of the network

No output schema declared.

No examples provided.

cast_call ~134

Read-only call to a deployed contract — no gas spent, no state change (cast call)

Input Output Examples

Name	Type	Req	Description
args	array	—	Function arguments in order, e.g. ['0x1234...']
blockTag	string	—	Block to query at, e.g. "latest", "pending", or a block number
rpcUrl	string	yes	RPC URL of the zkSync network to call against
signature	string	yes	Function signature with return type, e.g. "balanceOf(address)(uint256)" or "name()(string)"
to	string	yes	Address of the contract to call

No output schema declared.

No examples provided.

cast_calldata_decode ~70

Decode raw transaction calldata (with 4-byte selector) into function arguments (cast calldata-decode)

Input Output Examples

Name	Type	Req	Description
calldata	string	yes	Raw transaction calldata (0x-prefixed, includes the 4-byte selector)
signature	string	yes	Function signature, e.g. "transfer(address,uint256)"

No output schema declared.

No examples provided.

cast_nonce ~88

Query the transaction nonce of an address (cast nonce). Note: on zkSync this returns the TX nonce only, not the deploy nonce.

Input Output Examples

Name	Type	Req	Description
address	string	yes	Address to query the nonce of
blockTag	string	—	Block to query at, e.g. "latest", "pending", or a block number
rpcUrl	string	yes	RPC URL of the network

No output schema declared.

No examples provided.

cast_send ~414

Send a state-changing transaction to a deployed contract (cast send)

Input Output Examples

Name	Type	Req	Description
account	string	—	Named keystore account from ~/.foundry/keystores (recommended for production). Create one with: cast wallet import <name> --interactive
args	array	—	Function arguments in order
aws	boolean	—	Sign with AWS KMS (requires AWS_KMS_KEY_ID env var)
from	string	—	Sender address, used with --unlocked or hardware wallets. Maps to --from for cast/deploy, --sender for forge script.
gasLimit	string	—	Gas limit override
gcp	boolean	—	Sign with Google Cloud KMS (requires GCP_PROJECT_ID, GCP_LOCATION, GCP_KEY_RING, GCP_KEY_NAME, GCP_KEY_VERSION env vars)
keystore	string	—	Path to an encrypted keystore JSON file
keystorePassword	string	—	Keystore password (prefer passwordFile to keep it out of process args)
ledger	boolean	—	Sign with a Ledger hardware wallet
passwordFile	string	—	Path to a file containing the keystore password
privateKey	string	—	Raw private key for signing. Only use for local development with well-known test keys (e.g. anvil-zksync accounts). For production, use 'account' (named keystore) or hardware wallets instead.
rpcUrl	string	yes	RPC URL of the zkSync network
signature	string	yes	Function signature, e.g. "transfer(address,uint256)"
to	string	yes	Address of the contract to send the transaction to
trezor	boolean	—	Sign with a Trezor hardware wallet
unlocked	boolean	—	Use eth_sendTransaction with --from address (no local signing). For nodes that manage keys natively.
value	string	—	ETH value to send with the transaction, e.g. "0.1ether" or amount in wei

No output schema declared.

No examples provided.

clean ~93

Remove build artifacts (out/ and zkout/) from a foundry project (forge clean)

Input Output Examples

Name	Type	Req	Description
profile	string	—	Foundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'.
projectPath	string	yes	Absolute path to the foundry project directory

No output schema declared.

No examples provided.

compile ~130

Compile a foundry-zksync project (forge build --zksync). Check foundry.toml for [profile.X.zksync] sections — if zkSync sources live under a specific profile (e.g. 'zksync'), pass that as the profile argument.

Input Output Examples

Name	Type	Req	Description
profile	string	—	Foundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'.
projectPath	string	yes	Absolute path to the foundry project directory

No output schema declared.

No examples provided.

deploy ~564

Deploy a contract to a zkSync network (forge create --zksync). Returns structured output with contract address, tx hash, and deployer.

Input Output Examples

Name	Type	Req	Description
account	string	—	Named keystore account from ~/.foundry/keystores (recommended for production). Create one with: cast wallet import <name> --interactive
aws	boolean	—	Sign with AWS KMS (requires AWS_KMS_KEY_ID env var)
broadcast	boolean	—	If true, actually broadcast the deployment transaction on-chain. Without this, forge create runs in dry-run mode.
constructorArgs	array	—	Constructor arguments, each as a separate string. Solidity types are ABI-encoded by forge, e.g. ['0xaddr', '100', 'hello']
contractPath	string	yes	Contract identifier in the form src/MyContract.sol:MyContract
extraArgs	array	—	Additional CLI flags, each as a separate array element
from	string	—	Sender address, used with --unlocked or hardware wallets. Maps to --from for cast/deploy, --sender for forge script.
gcp	boolean	—	Sign with Google Cloud KMS (requires GCP_PROJECT_ID, GCP_LOCATION, GCP_KEY_RING, GCP_KEY_NAME, GCP_KEY_VERSION env vars)
keystore	string	—	Path to an encrypted keystore JSON file
keystorePassword	string	—	Keystore password (prefer passwordFile to keep it out of process args)
ledger	boolean	—	Sign with a Ledger hardware wallet
passwordFile	string	—	Path to a file containing the keystore password
privateKey	string	—	Raw private key for signing. Only use for local development with well-known test keys (e.g. anvil-zksync accounts). For production, use 'account' (named keystore) or hardware wallets instead.
profile	string	—	Foundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'.
projectPath	string	yes	Absolute path to the foundry project directory
rpcUrl	string	yes	RPC URL of the target zkSync network
trezor	boolean	—	Sign with a Trezor hardware wallet
unlocked	boolean	—	Use eth_sendTransaction with --from address (no local signing). For nodes that manage keys natively.
verifierUrl	string	—	Block explorer verification API URL (e.g. https://api-era.zksync.network/api)
verify	boolean	—	If true, verify the contract on a block explorer after deployment

No output schema declared.

No examples provided.

explain ~134

Explain raw output from foundry-zksync: error messages, logs, or transactions. Matches against a knowledge base of known zkSync gotchas and returns actionable advice. Use context='general' for background on what foundry-zksync is and how it works.

Input Output Examples

Name	Type	Req	Description
context	string	—	Hint for what kind of text this is. 'general' prepends foundry-zksync background context. Defaults to general.
rawText	string	yes	Raw text to explain — can be an error message, forge log output, transaction hash, ABI-encoded data, or a general question about foundry-zksync

No output schema declared.

No examples provided.

gas_report ~171

Run tests and generate a gas usage report (forge test --zksync --gas-report). Note: zkSync gas values are aggregate-only (no computation/pubdata breakdown).

Input Output Examples

Name	Type	Req	Description
contractFilter	string	—	Regex passed to --match-contract to filter which contracts appear in the report
filter	string	—	Regex passed to --match-test to filter which test functions run
pathFilter	string	—	Glob passed to --match-path to filter which test files run
profile	string	—	Foundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'.
projectPath	string	yes	Absolute path to the foundry project directory

No output schema declared.

No examples provided.

get_zksync_docs ~155

Look up foundry-zksync documentation by topic. Returns URLs to the foundry-zksync book for installation, config, testing, deployment, cheatcodes, nonces, factory deps, paymasters, verification, and more. Use topic='list' to see all available topics.

Input Output Examples

Name	Type	Req	Description
topic	string	yes	Topic to look up in the foundry-zksync book. Examples: 'installation', 'forge-test', 'cheatcodes', 'deployment', 'config', 'zksync-config', 'nonces', 'factory-deps', 'paymaster', 'verification', 'cas…

No output schema declared.

No examples provided.

init ~126

Scaffold a new foundry project and add [profile.default.zksync] config (forge init)

Input Output Examples

Name	Type	Req	Description
name	string	—	Project name (used as directory name if projectPath is the parent)
noCommit	boolean	—	If true, skip the initial git commit (--no-commit)
noGit	boolean	—	If true, skip git initialization (--no-git)
projectPath	string	yes	Absolute path where the new project should be created
template	string	—	GitHub template to use, e.g. 'PaulRBerg/foundry-template'

No output schema declared.

No examples provided.

install ~102

Install dependencies for a foundry project (forge install)

Input Output Examples

Name	Type	Req	Description
dependencies	array	—	Dependencies to install, e.g. ['OpenZeppelin/openzeppelin-contracts', 'transmissions11/solmate']. If omitted, installs all existing dependencies from foundry.toml.
noCommit	boolean	—	If true, passes --no-commit to skip creating a git commit for the install
projectPath	string	yes	Absolute path to the foundry project directory

No output schema declared.

No examples provided.

read_foundry_toml ~96

Read and return the contents of foundry.toml from a project. Useful for inspecting profiles, zkSync config, library links, and other settings.

Input Output Examples

Name	Type	Req	Description
projectPath	string	yes	Absolute path to the foundry project directory
summary	boolean	—	If true, return a summary highlighting zkSync-relevant config (profiles, zksolc version, compile mode, libraries) instead of raw TOML.

No output schema declared.

No examples provided.

run_script ~532

Run a forge script targeting zkSync (forge script --zksync)

Input Output Examples

Name	Type	Req	Description
account	string	—	Named keystore account from ~/.foundry/keystores (recommended for production). Create one with: cast wallet import <name> --interactive
aws	boolean	—	Sign with AWS KMS (requires AWS_KMS_KEY_ID env var)
broadcast	boolean	—	If true, passes --broadcast to actually send transactions on-chain
extraArgs	array	—	Additional CLI flags, each as a separate array element, e.g. ['--verify', '--etherscan-api-key', 'abc']
from	string	—	Sender address, used with --unlocked or hardware wallets. Maps to --from for cast/deploy, --sender for forge script.
gcp	boolean	—	Sign with Google Cloud KMS (requires GCP_PROJECT_ID, GCP_LOCATION, GCP_KEY_RING, GCP_KEY_NAME, GCP_KEY_VERSION env vars)
keystore	string	—	Path to an encrypted keystore JSON file
keystorePassword	string	—	Keystore password (prefer passwordFile to keep it out of process args)
ledger	boolean	—	Sign with a Ledger hardware wallet
passwordFile	string	—	Path to a file containing the keystore password
privateKey	string	—	Raw private key for signing. Only use for local development with well-known test keys (e.g. anvil-zksync accounts). For production, use 'account' (named keystore) or hardware wallets instead.
profile	string	—	Foundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'.
projectPath	string	yes	Absolute path to the foundry project directory
rpcUrl	string	—	RPC URL to fork from or broadcast to
scriptPath	string	yes	Path to the Solidity script file, e.g. script/Deploy.s.sol
sender	string	—	Address to use as msg.sender for the script simulation (--sender). Useful for dry-run without a signing key.
slow	boolean	—	If true, sends transactions sequentially (--slow). Required on ZK chains which do not support transaction batching.
trezor	boolean	—	Sign with a Trezor hardware wallet
unlocked	boolean	—	Use eth_sendTransaction with --from address (no local signing). For nodes that manage keys natively.

No output schema declared.

No examples provided.

snapshot ~188

Create or compare gas snapshots (forge snapshot --zksync). Use diff=true to compare against existing .gas-snapshot, check=true to fail on changes.

Input Output Examples

Name	Type	Req	Description
check	boolean	—	If true, compare against existing snapshot and fail if any gas values changed
contractFilter	string	—	Regex passed to --match-contract to filter which test contracts run
diff	boolean	—	If true, compare against the existing .gas-snapshot file and show differences
filter	string	—	Regex passed to --match-test to filter which test functions run
profile	string	—	Foundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'.
projectPath	string	yes	Absolute path to the foundry project directory

No output schema declared.

No examples provided.

test ~232

Run tests in a foundry-zksync project (forge test --zksync). Check foundry.toml for [profile.X] sections — if the test directory differs per profile (e.g. profile 'zksync' has test = 'zksync/tests'), pass the correct profile argument.

Input Output Examples

Name	Type	Req	Description
contractFilter	string	—	Regex passed to --match-contract to filter which test contracts run
filter	string	—	Regex passed to --match-test to filter which test functions run
pathFilter	string	—	Glob passed to --match-path to filter which test files run, e.g. 'test/unit/*'
profile	string	—	Foundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'.
projectPath	string	yes	Absolute path to the foundry project directory
verbosity	integer	—	Verbosity level (0-5), maps to -v through -vvvvv. Higher = more trace output

No output schema declared.

No examples provided.

verify ~398

Verify a deployed contract on a block explorer (forge verify-contract --zksync). Supports Etherscan (requires API key) and zkSync Explorer (no key needed).

Input Output Examples

Name	Type	Req	Description
compilerVersion	string	—	Compiler version used for deployment, e.g. v0.8.26+commit.8a97fa7a
constructorArgs	string	—	ABI-encoded constructor arguments (hex string, no 0x prefix)
contractAddress	string	yes	Deployed contract address to verify
contractPath	string	yes	Contract identifier, e.g. src/MyContract.sol:MyContract
etherscanApiKey	string	—	Etherscan API key (required when verifier is 'etherscan')
extraArgs	array	—	Additional CLI flags
numOptimizations	number	—	Number of optimization runs used during compilation
profile	string	—	Foundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'.
projectPath	string	yes	Absolute path to the foundry project directory
retries	integer	—	Number of verification retries (default: 2, max: 10). Minimum is 1. Forge retries on transient failures.
verifier	string	yes	Verification backend. 'etherscan' requires an API key, 'zksync' uses the zkSync Explorer (no API key needed).
verifierUrl	string	yes	Verifier API URL. Etherscan mainnet: https://api-era.zksync.network/api, Etherscan testnet: https://api-sepolia-era.zksync.network/api, Explorer mainnet: https://explorer.zksync.io/contract_verificat…

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug