Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.Jrigada/foundry-zksync

NPM · FOUNDRY-ZKSYNC-MCP · SCANNED SEP 20

Expose foundry-zksync (forge, cast, anvil-zksync) tools for zkSync Era development

Available components

0 this week 80 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability67
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 4095 tokens (~195/item across 21 items; 21 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
  • Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "clean" implies "remove" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 21 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the io.github.Jrigada/foundry-zksync MCP server?

io.github.Jrigada/foundry-zksync runs locally as an npm package, launched with npx -y foundry-zksync-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · foundry-zksync-mcp

# add to Claude Code
claude mcp add jrigada-foundry-zksync -- npx -y foundry-zksync-mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "jrigada-foundry-zksync": {
      "command": "npx",
      "args": [
        "-y",
        "foundry-zksync-mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "jrigada-foundry-zksync": {
      "command": "npx",
      "args": [
        "-y",
        "foundry-zksync-mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add jrigada-foundry-zksync -- npx -y foundry-zksync-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "jrigada-foundry-zksync": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "foundry-zksync-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add jrigada-foundry-zksync --command npx --arg -y --arg foundry-zksync-mcp
# ~/.hermes/config.yaml
mcp_servers:
  jrigada-foundry-zksync:
    command: "npx"
    args: ["-y", "foundry-zksync-mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "jrigada-foundry-zksync": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "foundry-zksync-mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add jrigada-foundry-zksync -t stdio -c npx -a -y foundry-zksync-mcp
// mcp.json
{
  "mcpServers": {
    "jrigada-foundry-zksync": {
      "command": "npx",
      "args": [
        "-y",
        "foundry-zksync-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 19 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.

  • 17 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

  • 16 Sept 26 −3
    • Stability: pass → 0.80 functional
  • 15 Sept 26 0
    • Stability: 0.97 → pass security
  • 14 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 13 Sept 26 0
    • Security disclosure: unverified → fail functional
  • 12 Sept 26 +1
    • Security disclosure: fail → unverified functional
  • 10 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed npm/foundry-zksync-mcp@0.2.3

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 96 packages
Packages resolved 96
Stale 31
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 21 exposed · ~4,095 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
anvil_zksync ~181

Start or check a local anvil-zksync development node. Supports forking from mainnet/testnet. Default port: 8011.

NameTypeReqDescription
accountsnumberNumber of funded accounts to generate (default: 10)
actionstringyes'start' launches anvil-zksync in the background and returns when ready. 'check' tests if anvil-zksync is reachable at the given port.
balancenumberETH balance for each generated account in ether (default: 10000)
forkBlockNumbernumberBlock number to fork from (requires forkUrl)
forkUrlstringRPC URL to fork from, e.g. https://mainnet.era.zksync.io
portnumberPort to listen on (default: 8011)

No output schema declared.

No examples provided.

cast_abi_decode ~111

Decode ABI-encoded hex data back into human-readable values (cast abi-decode)

NameTypeReqDescription
datastringyesHex-encoded ABI data to decode (0x-prefixed)
inputbooleanIf true, decode as input data (function args). If false/omitted, decode as output data (return values).
signaturestringyesSolidity function signature whose output types to decode against, e.g. "balanceOf(address)(uint256)" or "transfer(address,uint256)"

No output schema declared.

No examples provided.

cast_abi_encode ~87

ABI-encode values for a given Solidity function/constructor signature (cast abi-encode)

NameTypeReqDescription
argsarrayyesValues to encode, matching the signature types in order, e.g. ["0x1234...", "1000000"]
signaturestringyesSolidity function or constructor signature, e.g. "constructor(address,uint256)" or "transfer(address,uint256)"

No output schema declared.

No examples provided.

cast_balance ~89

Query the ETH balance of an address (cast balance)

NameTypeReqDescription
addressstringyesAddress to query the balance of
blockTagstringBlock to query at, e.g. "latest", "pending", or a block number
etherbooleanIf true, format the output in ether instead of wei
rpcUrlstringyesRPC URL of the network

No output schema declared.

No examples provided.

cast_call ~134

Read-only call to a deployed contract — no gas spent, no state change (cast call)

NameTypeReqDescription
argsarrayFunction arguments in order, e.g. ['0x1234...']
blockTagstringBlock to query at, e.g. "latest", "pending", or a block number
rpcUrlstringyesRPC URL of the zkSync network to call against
signaturestringyesFunction signature with return type, e.g. "balanceOf(address)(uint256)" or "name()(string)"
tostringyesAddress of the contract to call

No output schema declared.

No examples provided.

cast_calldata_decode ~70

Decode raw transaction calldata (with 4-byte selector) into function arguments (cast calldata-decode)

NameTypeReqDescription
calldatastringyesRaw transaction calldata (0x-prefixed, includes the 4-byte selector)
signaturestringyesFunction signature, e.g. "transfer(address,uint256)"

No output schema declared.

No examples provided.

cast_nonce ~88

Query the transaction nonce of an address (cast nonce). Note: on zkSync this returns the TX nonce only, not the deploy nonce.

NameTypeReqDescription
addressstringyesAddress to query the nonce of
blockTagstringBlock to query at, e.g. "latest", "pending", or a block number
rpcUrlstringyesRPC URL of the network

No output schema declared.

No examples provided.

cast_send ~414

Send a state-changing transaction to a deployed contract (cast send)

NameTypeReqDescription
accountstringNamed keystore account from ~/.foundry/keystores (recommended for production). Create one with: cast wallet import <name> --interactive
argsarrayFunction arguments in order
awsbooleanSign with AWS KMS (requires AWS_KMS_KEY_ID env var)
fromstringSender address, used with --unlocked or hardware wallets. Maps to --from for cast/deploy, --sender for forge script.
gasLimitstringGas limit override
gcpbooleanSign with Google Cloud KMS (requires GCP_PROJECT_ID, GCP_LOCATION, GCP_KEY_RING, GCP_KEY_NAME, GCP_KEY_VERSION env vars)
keystorestringPath to an encrypted keystore JSON file
keystorePasswordstringKeystore password (prefer passwordFile to keep it out of process args)
ledgerbooleanSign with a Ledger hardware wallet
passwordFilestringPath to a file containing the keystore password
privateKeystringRaw private key for signing. Only use for local development with well-known test keys (e.g. anvil-zksync accounts). For production, use 'account' (named keystore) or hardware wallets instead.
rpcUrlstringyesRPC URL of the zkSync network
signaturestringyesFunction signature, e.g. "transfer(address,uint256)"
tostringyesAddress of the contract to send the transaction to
trezorbooleanSign with a Trezor hardware wallet
unlockedbooleanUse eth_sendTransaction with --from address (no local signing). For nodes that manage keys natively.
valuestringETH value to send with the transaction, e.g. "0.1ether" or amount in wei

No output schema declared.

No examples provided.

clean ~93

Remove build artifacts (out/ and zkout/) from a foundry project (forge clean)

NameTypeReqDescription
profilestringFoundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'.
projectPathstringyesAbsolute path to the foundry project directory

No output schema declared.

No examples provided.

compile ~130

Compile a foundry-zksync project (forge build --zksync). Check foundry.toml for [profile.X.zksync] sections — if zkSync sources live under a specific profile (e.g. 'zksync'), pass that as the profile argument.

NameTypeReqDescription
profilestringFoundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'.
projectPathstringyesAbsolute path to the foundry project directory

No output schema declared.

No examples provided.

deploy ~564

Deploy a contract to a zkSync network (forge create --zksync). Returns structured output with contract address, tx hash, and deployer.

NameTypeReqDescription
accountstringNamed keystore account from ~/.foundry/keystores (recommended for production). Create one with: cast wallet import <name> --interactive
awsbooleanSign with AWS KMS (requires AWS_KMS_KEY_ID env var)
broadcastbooleanIf true, actually broadcast the deployment transaction on-chain. Without this, forge create runs in dry-run mode.
constructorArgsarrayConstructor arguments, each as a separate string. Solidity types are ABI-encoded by forge, e.g. ['0xaddr', '100', 'hello']
contractPathstringyesContract identifier in the form src/MyContract.sol:MyContract
extraArgsarrayAdditional CLI flags, each as a separate array element
fromstringSender address, used with --unlocked or hardware wallets. Maps to --from for cast/deploy, --sender for forge script.
gcpbooleanSign with Google Cloud KMS (requires GCP_PROJECT_ID, GCP_LOCATION, GCP_KEY_RING, GCP_KEY_NAME, GCP_KEY_VERSION env vars)
keystorestringPath to an encrypted keystore JSON file
keystorePasswordstringKeystore password (prefer passwordFile to keep it out of process args)
ledgerbooleanSign with a Ledger hardware wallet
passwordFilestringPath to a file containing the keystore password
privateKeystringRaw private key for signing. Only use for local development with well-known test keys (e.g. anvil-zksync accounts). For production, use 'account' (named keystore) or hardware wallets instead.
profilestringFoundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'.
projectPathstringyesAbsolute path to the foundry project directory
rpcUrlstringyesRPC URL of the target zkSync network
trezorbooleanSign with a Trezor hardware wallet
unlockedbooleanUse eth_sendTransaction with --from address (no local signing). For nodes that manage keys natively.
verifierUrlstringBlock explorer verification API URL (e.g. https://api-era.zksync.network/api)
verifybooleanIf true, verify the contract on a block explorer after deployment

No output schema declared.

No examples provided.

explain ~134

Explain raw output from foundry-zksync: error messages, logs, or transactions. Matches against a knowledge base of known zkSync gotchas and returns actionable advice. Use context='general' for background on what foundry-zksync is and how it works.

NameTypeReqDescription
contextstringHint for what kind of text this is. 'general' prepends foundry-zksync background context. Defaults to general.
rawTextstringyesRaw text to explain — can be an error message, forge log output, transaction hash, ABI-encoded data, or a general question about foundry-zksync

No output schema declared.

No examples provided.

gas_report ~171

Run tests and generate a gas usage report (forge test --zksync --gas-report). Note: zkSync gas values are aggregate-only (no computation/pubdata breakdown).

NameTypeReqDescription
contractFilterstringRegex passed to --match-contract to filter which contracts appear in the report
filterstringRegex passed to --match-test to filter which test functions run
pathFilterstringGlob passed to --match-path to filter which test files run
profilestringFoundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'.
projectPathstringyesAbsolute path to the foundry project directory

No output schema declared.

No examples provided.

get_zksync_docs ~155

Look up foundry-zksync documentation by topic. Returns URLs to the foundry-zksync book for installation, config, testing, deployment, cheatcodes, nonces, factory deps, paymasters, verification, and more. Use topic='list' to see all available topics.

NameTypeReqDescription
topicstringyesTopic to look up in the foundry-zksync book. Examples: 'installation', 'forge-test', 'cheatcodes', 'deployment', 'config', 'zksync-config', 'nonces', 'factory-deps', 'paymaster', 'verification', 'cas…

No output schema declared.

No examples provided.

init ~126

Scaffold a new foundry project and add [profile.default.zksync] config (forge init)

NameTypeReqDescription
namestringProject name (used as directory name if projectPath is the parent)
noCommitbooleanIf true, skip the initial git commit (--no-commit)
noGitbooleanIf true, skip git initialization (--no-git)
projectPathstringyesAbsolute path where the new project should be created
templatestringGitHub template to use, e.g. 'PaulRBerg/foundry-template'

No output schema declared.

No examples provided.

install ~102

Install dependencies for a foundry project (forge install)

NameTypeReqDescription
dependenciesarrayDependencies to install, e.g. ['OpenZeppelin/openzeppelin-contracts', 'transmissions11/solmate']. If omitted, installs all existing dependencies from foundry.toml.
noCommitbooleanIf true, passes --no-commit to skip creating a git commit for the install
projectPathstringyesAbsolute path to the foundry project directory

No output schema declared.

No examples provided.

read_foundry_toml ~96

Read and return the contents of foundry.toml from a project. Useful for inspecting profiles, zkSync config, library links, and other settings.

NameTypeReqDescription
projectPathstringyesAbsolute path to the foundry project directory
summarybooleanIf true, return a summary highlighting zkSync-relevant config (profiles, zksolc version, compile mode, libraries) instead of raw TOML.

No output schema declared.

No examples provided.

run_script ~532

Run a forge script targeting zkSync (forge script --zksync)

NameTypeReqDescription
accountstringNamed keystore account from ~/.foundry/keystores (recommended for production). Create one with: cast wallet import <name> --interactive
awsbooleanSign with AWS KMS (requires AWS_KMS_KEY_ID env var)
broadcastbooleanIf true, passes --broadcast to actually send transactions on-chain
extraArgsarrayAdditional CLI flags, each as a separate array element, e.g. ['--verify', '--etherscan-api-key', 'abc']
fromstringSender address, used with --unlocked or hardware wallets. Maps to --from for cast/deploy, --sender for forge script.
gcpbooleanSign with Google Cloud KMS (requires GCP_PROJECT_ID, GCP_LOCATION, GCP_KEY_RING, GCP_KEY_NAME, GCP_KEY_VERSION env vars)
keystorestringPath to an encrypted keystore JSON file
keystorePasswordstringKeystore password (prefer passwordFile to keep it out of process args)
ledgerbooleanSign with a Ledger hardware wallet
passwordFilestringPath to a file containing the keystore password
privateKeystringRaw private key for signing. Only use for local development with well-known test keys (e.g. anvil-zksync accounts). For production, use 'account' (named keystore) or hardware wallets instead.
profilestringFoundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'.
projectPathstringyesAbsolute path to the foundry project directory
rpcUrlstringRPC URL to fork from or broadcast to
scriptPathstringyesPath to the Solidity script file, e.g. script/Deploy.s.sol
senderstringAddress to use as msg.sender for the script simulation (--sender). Useful for dry-run without a signing key.
slowbooleanIf true, sends transactions sequentially (--slow). Required on ZK chains which do not support transaction batching.
trezorbooleanSign with a Trezor hardware wallet
unlockedbooleanUse eth_sendTransaction with --from address (no local signing). For nodes that manage keys natively.

No output schema declared.

No examples provided.

snapshot ~188

Create or compare gas snapshots (forge snapshot --zksync). Use diff=true to compare against existing .gas-snapshot, check=true to fail on changes.

NameTypeReqDescription
checkbooleanIf true, compare against existing snapshot and fail if any gas values changed
contractFilterstringRegex passed to --match-contract to filter which test contracts run
diffbooleanIf true, compare against the existing .gas-snapshot file and show differences
filterstringRegex passed to --match-test to filter which test functions run
profilestringFoundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'.
projectPathstringyesAbsolute path to the foundry project directory

No output schema declared.

No examples provided.

test ~232

Run tests in a foundry-zksync project (forge test --zksync). Check foundry.toml for [profile.X] sections — if the test directory differs per profile (e.g. profile 'zksync' has test = 'zksync/tests'), pass the correct profile argument.

NameTypeReqDescription
contractFilterstringRegex passed to --match-contract to filter which test contracts run
filterstringRegex passed to --match-test to filter which test functions run
pathFilterstringGlob passed to --match-path to filter which test files run, e.g. 'test/unit/*'
profilestringFoundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'.
projectPathstringyesAbsolute path to the foundry project directory
verbosityintegerVerbosity level (0-5), maps to -v through -vvvvv. Higher = more trace output

No output schema declared.

No examples provided.

verify ~398

Verify a deployed contract on a block explorer (forge verify-contract --zksync). Supports Etherscan (requires API key) and zkSync Explorer (no key needed).

NameTypeReqDescription
compilerVersionstringCompiler version used for deployment, e.g. v0.8.26+commit.8a97fa7a
constructorArgsstringABI-encoded constructor arguments (hex string, no 0x prefix)
contractAddressstringyesDeployed contract address to verify
contractPathstringyesContract identifier, e.g. src/MyContract.sol:MyContract
etherscanApiKeystringEtherscan API key (required when verifier is 'etherscan')
extraArgsarrayAdditional CLI flags
numOptimizationsnumberNumber of optimization runs used during compilation
profilestringFoundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'.
projectPathstringyesAbsolute path to the foundry project directory
retriesintegerNumber of verification retries (default: 2, max: 10). Minimum is 1. Forge retries on transient failures.
verifierstringyesVerification backend. 'etherscan' requires an API key, 'zksync' uses the zkSync Explorer (no API key needed).
verifierUrlstringyesVerifier API URL. Etherscan mainnet: https://api-era.zksync.network/api, Etherscan testnet: https://api-sepolia-era.zksync.network/api, Explorer mainnet: https://explorer.zksync.io/contract_verificat…

No output schema declared.

No examples provided.

Common questions

What is the io.github.Jrigada/foundry-zksync MCP server?

io.github.Jrigada/foundry-zksync is an MCP server listed in the public MCP registry as io.github.Jrigada/foundry-zksync. Expose foundry-zksync (forge, cast, anvil-zksync) tools for zkSync Era development. This page covers its npm package (foundry-zksync-mcp).

Is the io.github.Jrigada/foundry-zksync MCP server safe to use?

io.github.Jrigada/foundry-zksync scores 80 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.Jrigada/foundry-zksync MCP server expose?

io.github.Jrigada/foundry-zksync exposes 21 tools: init, install, clean, compile, test, and 16 more. Their descriptions and schemas cost roughly 4,095 tokens of context every time the server is loaded.

Is the io.github.Jrigada/foundry-zksync MCP server still maintained?

io.github.Jrigada/foundry-zksync is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.Jrigada/foundry-zksync MCP server under?

io.github.Jrigada/foundry-zksync declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.