# io.github.Jrigada/foundry-zksync (npm · foundry-zksync-mcp)

Expose foundry-zksync (forge, cast, anvil-zksync) tools for zkSync Era development

- Trust score: 67/100 (medium)
- Change this week: +24
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `foundry-zksync-mcp`: 67/100 (this document), [markdown](https://verifymcp.io/servers/jrigada-foundry-zksync/foundry-zksync-mcp.md), [page](https://verifymcp.io/servers/jrigada-foundry-zksync/foundry-zksync-mcp)

## Channel facts

- Registry: `npm`
- Package: `foundry-zksync-mcp`
- Version: `0.2.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 160 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 64/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 4095 tokens (~195/item across 21 items; 21 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add jrigada-foundry-zksync -- npx -y foundry-zksync-mcp
```

### Codex

```bash
codex mcp add jrigada-foundry-zksync -- npx -y foundry-zksync-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "jrigada-foundry-zksync": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "foundry-zksync-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add jrigada-foundry-zksync --command npx --arg -y --arg foundry-zksync-mcp
```

### Hermes

```yaml
mcp_servers:
  jrigada-foundry-zksync:
    command: "npx"
    args: ["-y", "foundry-zksync-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "jrigada-foundry-zksync": {
      "command": "npx",
      "args": [
        "-y",
        "foundry-zksync-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 66, +61)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] Tool coverage: unverified → 100
- [functional] Licence: MIT

### 2026-08-01 (score 5, −20)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 25, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 43)

First indexed and scored.

## MCP tools (21)

### `init` (~126 tokens)

Scaffold a new foundry project and add [profile.default.zksync] config (forge init)

Input parameters:

- `name` (string): Project name (used as directory name if projectPath is the parent)
- `noCommit` (boolean): If true, skip the initial git commit (--no-commit)
- `noGit` (boolean): If true, skip git initialization (--no-git)
- `projectPath` (string, required): Absolute path where the new project should be created
- `template` (string): GitHub template to use, e.g. 'PaulRBerg/foundry-template'

### `install` (~102 tokens)

Install dependencies for a foundry project (forge install)

Input parameters:

- `dependencies` (array): Dependencies to install, e.g. ['OpenZeppelin/openzeppelin-contracts', 'transmissions11/solmate']. If omitted, installs all existing dependencies from foundry.toml.
- `noCommit` (boolean): If true, passes --no-commit to skip creating a git commit for the install
- `projectPath` (string, required): Absolute path to the foundry project directory

### `clean` (~93 tokens)

Remove build artifacts (out/ and zkout/) from a foundry project (forge clean)

Input parameters:

- `profile` (string): Foundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'.
- `projectPath` (string, required): Absolute path to the foundry project directory

### `compile` (~130 tokens)

Compile a foundry-zksync project (forge build --zksync). Check foundry.toml for [profile.X.zksync] sections — if zkSync sources live under a specific profile (e.g. 'zksync'), pass that as the profile argument.

Input parameters:

- `profile` (string): Foundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'.
- `projectPath` (string, required): Absolute path to the foundry project directory

### `test` (~232 tokens)

Run tests in a foundry-zksync project (forge test --zksync). Check foundry.toml for [profile.X] sections — if the test directory differs per profile (e.g. profile 'zksync' has test = 'zksync/tests'), pass the correct profile argument.

Input parameters:

- `contractFilter` (string): Regex passed to --match-contract to filter which test contracts run
- `filter` (string): Regex passed to --match-test to filter which test functions run
- `pathFilter` (string): Glob passed to --match-path to filter which test files run, e.g. 'test/unit/*'
- `profile` (string): Foundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'.
- `projectPath` (string, required): Absolute path to the foundry project directory
- `verbosity` (integer): Verbosity level (0-5), maps to -v through -vvvvv. Higher = more trace output

### `run_script` (~532 tokens)

Run a forge script targeting zkSync (forge script --zksync)

Input parameters:

- `account` (string): Named keystore account from ~/.foundry/keystores (recommended for production). Create one with: cast wallet import <name> --interactive
- `aws` (boolean): Sign with AWS KMS (requires AWS_KMS_KEY_ID env var)
- `broadcast` (boolean): If true, passes --broadcast to actually send transactions on-chain
- `extraArgs` (array): Additional CLI flags, each as a separate array element, e.g. ['--verify', '--etherscan-api-key', 'abc']
- `from` (string): Sender address, used with --unlocked or hardware wallets. Maps to --from for cast/deploy, --sender for forge script.
- `gcp` (boolean): Sign with Google Cloud KMS (requires GCP_PROJECT_ID, GCP_LOCATION, GCP_KEY_RING, GCP_KEY_NAME, GCP_KEY_VERSION env vars)
- `keystore` (string): Path to an encrypted keystore JSON file
- `keystorePassword` (string): Keystore password (prefer passwordFile to keep it out of process args)
- `ledger` (boolean): Sign with a Ledger hardware wallet
- `passwordFile` (string): Path to a file containing the keystore password
- `privateKey` (string): Raw private key for signing. Only use for local development with well-known test keys (e.g. anvil-zksync accounts). For production, use 'account' (named keystore) or hardware wallets instead.
- `profile` (string): Foundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'.
- `projectPath` (string, required): Absolute path to the foundry project directory
- `rpcUrl` (string): RPC URL to fork from or broadcast to
- `scriptPath` (string, required): Path to the Solidity script file, e.g. script/Deploy.s.sol
- `sender` (string): Address to use as msg.sender for the script simulation (--sender). Useful for dry-run without a signing key.
- `slow` (boolean): If true, sends transactions sequentially (--slow). Required on ZK chains which do not support transaction batching.
- `trezor` (boolean): Sign with a Trezor hardware wallet
- `unlocked` (boolean): Use eth_sendTransaction with --from address (no local signing). For nodes that manage keys natively.

### `deploy` (~564 tokens)

Deploy a contract to a zkSync network (forge create --zksync). Returns structured output with contract address, tx hash, and deployer.

Input parameters:

- `account` (string): Named keystore account from ~/.foundry/keystores (recommended for production). Create one with: cast wallet import <name> --interactive
- `aws` (boolean): Sign with AWS KMS (requires AWS_KMS_KEY_ID env var)
- `broadcast` (boolean): If true, actually broadcast the deployment transaction on-chain. Without this, forge create runs in dry-run mode.
- `constructorArgs` (array): Constructor arguments, each as a separate string. Solidity types are ABI-encoded by forge, e.g. ['0xaddr', '100', 'hello']
- `contractPath` (string, required): Contract identifier in the form src/MyContract.sol:MyContract
- `extraArgs` (array): Additional CLI flags, each as a separate array element
- `from` (string): Sender address, used with --unlocked or hardware wallets. Maps to --from for cast/deploy, --sender for forge script.
- `gcp` (boolean): Sign with Google Cloud KMS (requires GCP_PROJECT_ID, GCP_LOCATION, GCP_KEY_RING, GCP_KEY_NAME, GCP_KEY_VERSION env vars)
- `keystore` (string): Path to an encrypted keystore JSON file
- `keystorePassword` (string): Keystore password (prefer passwordFile to keep it out of process args)
- `ledger` (boolean): Sign with a Ledger hardware wallet
- `passwordFile` (string): Path to a file containing the keystore password
- `privateKey` (string): Raw private key for signing. Only use for local development with well-known test keys (e.g. anvil-zksync accounts). For production, use 'account' (named keystore) or hardware wallets instead.
- `profile` (string): Foundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'.
- `projectPath` (string, required): Absolute path to the foundry project directory
- `rpcUrl` (string, required): RPC URL of the target zkSync network
- `trezor` (boolean): Sign with a Trezor hardware wallet
- `unlocked` (boolean): Use eth_sendTransaction with --from address (no local signing). For nodes that manage keys natively.
- `verifierUrl` (string): Block explorer verification API URL (e.g. https://api-era.zksync.network/api)
- `verify` (boolean): If true, verify the contract on a block explorer after deployment

### `verify` (~398 tokens)

Verify a deployed contract on a block explorer (forge verify-contract --zksync). Supports Etherscan (requires API key) and zkSync Explorer (no key needed).

Input parameters:

- `compilerVersion` (string): Compiler version used for deployment, e.g. v0.8.26+commit.8a97fa7a
- `constructorArgs` (string): ABI-encoded constructor arguments (hex string, no 0x prefix)
- `contractAddress` (string, required): Deployed contract address to verify
- `contractPath` (string, required): Contract identifier, e.g. src/MyContract.sol:MyContract
- `etherscanApiKey` (string): Etherscan API key (required when verifier is 'etherscan')
- `extraArgs` (array): Additional CLI flags
- `numOptimizations` (number): Number of optimization runs used during compilation
- `profile` (string): Foundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'.
- `projectPath` (string, required): Absolute path to the foundry project directory
- `retries` (integer): Number of verification retries (default: 2, max: 10). Minimum is 1. Forge retries on transient failures.
- `verifier` (string, required): Verification backend. 'etherscan' requires an API key, 'zksync' uses the zkSync Explorer (no API key needed).
- `verifierUrl` (string, required): Verifier API URL. Etherscan mainnet: https://api-era.zksync.network/api, Etherscan testnet: https://api-sepolia-era.zksync.network/api, Explorer mainnet: https://explorer.zksync.io/contract_verificat…

### `gas_report` (~171 tokens)

Run tests and generate a gas usage report (forge test --zksync --gas-report). Note: zkSync gas values are aggregate-only (no computation/pubdata breakdown).

Input parameters:

- `contractFilter` (string): Regex passed to --match-contract to filter which contracts appear in the report
- `filter` (string): Regex passed to --match-test to filter which test functions run
- `pathFilter` (string): Glob passed to --match-path to filter which test files run
- `profile` (string): Foundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'.
- `projectPath` (string, required): Absolute path to the foundry project directory

### `snapshot` (~188 tokens)

Create or compare gas snapshots (forge snapshot --zksync). Use diff=true to compare against existing .gas-snapshot, check=true to fail on changes.

Input parameters:

- `check` (boolean): If true, compare against existing snapshot and fail if any gas values changed
- `contractFilter` (string): Regex passed to --match-contract to filter which test contracts run
- `diff` (boolean): If true, compare against the existing .gas-snapshot file and show differences
- `filter` (string): Regex passed to --match-test to filter which test functions run
- `profile` (string): Foundry profile to use (maps to FOUNDRY_PROFILE env var). Selects a [profile.<name>] section from foundry.toml, e.g. 'zksync', 'ci', 'production'.
- `projectPath` (string, required): Absolute path to the foundry project directory

### `read_foundry_toml` (~96 tokens)

Read and return the contents of foundry.toml from a project. Useful for inspecting profiles, zkSync config, library links, and other settings.

Input parameters:

- `projectPath` (string, required): Absolute path to the foundry project directory
- `summary` (boolean): If true, return a summary highlighting zkSync-relevant config (profiles, zksolc version, compile mode, libraries) instead of raw TOML.

### `explain` (~134 tokens)

Explain raw output from foundry-zksync: error messages, logs, or transactions. Matches against a knowledge base of known zkSync gotchas and returns actionable advice. Use context='general' for background on what foundry-zksync is and how it works.

Input parameters:

- `context` (string): Hint for what kind of text this is. 'general' prepends foundry-zksync background context. Defaults to general.
- `rawText` (string, required): Raw text to explain — can be an error message, forge log output, transaction hash, ABI-encoded data, or a general question about foundry-zksync

### `cast_abi_encode` (~87 tokens)

ABI-encode values for a given Solidity function/constructor signature (cast abi-encode)

Input parameters:

- `args` (array, required): Values to encode, matching the signature types in order, e.g. ["0x1234...", "1000000"]
- `signature` (string, required): Solidity function or constructor signature, e.g. "constructor(address,uint256)" or "transfer(address,uint256)"

### `cast_abi_decode` (~111 tokens)

Decode ABI-encoded hex data back into human-readable values (cast abi-decode)

Input parameters:

- `data` (string, required): Hex-encoded ABI data to decode (0x-prefixed)
- `input` (boolean): If true, decode as input data (function args). If false/omitted, decode as output data (return values).
- `signature` (string, required): Solidity function signature whose output types to decode against, e.g. "balanceOf(address)(uint256)" or "transfer(address,uint256)"

### `cast_calldata_decode` (~70 tokens)

Decode raw transaction calldata (with 4-byte selector) into function arguments (cast calldata-decode)

Input parameters:

- `calldata` (string, required): Raw transaction calldata (0x-prefixed, includes the 4-byte selector)
- `signature` (string, required): Function signature, e.g. "transfer(address,uint256)"

### `cast_call` (~134 tokens)

Read-only call to a deployed contract — no gas spent, no state change (cast call)

Input parameters:

- `args` (array): Function arguments in order, e.g. ['0x1234...']
- `blockTag` (string): Block to query at, e.g. "latest", "pending", or a block number
- `rpcUrl` (string, required): RPC URL of the zkSync network to call against
- `signature` (string, required): Function signature with return type, e.g. "balanceOf(address)(uint256)" or "name()(string)"
- `to` (string, required): Address of the contract to call

### `cast_send` (~414 tokens)

Send a state-changing transaction to a deployed contract (cast send)

Input parameters:

- `account` (string): Named keystore account from ~/.foundry/keystores (recommended for production). Create one with: cast wallet import <name> --interactive
- `args` (array): Function arguments in order
- `aws` (boolean): Sign with AWS KMS (requires AWS_KMS_KEY_ID env var)
- `from` (string): Sender address, used with --unlocked or hardware wallets. Maps to --from for cast/deploy, --sender for forge script.
- `gasLimit` (string): Gas limit override
- `gcp` (boolean): Sign with Google Cloud KMS (requires GCP_PROJECT_ID, GCP_LOCATION, GCP_KEY_RING, GCP_KEY_NAME, GCP_KEY_VERSION env vars)
- `keystore` (string): Path to an encrypted keystore JSON file
- `keystorePassword` (string): Keystore password (prefer passwordFile to keep it out of process args)
- `ledger` (boolean): Sign with a Ledger hardware wallet
- `passwordFile` (string): Path to a file containing the keystore password
- `privateKey` (string): Raw private key for signing. Only use for local development with well-known test keys (e.g. anvil-zksync accounts). For production, use 'account' (named keystore) or hardware wallets instead.
- `rpcUrl` (string, required): RPC URL of the zkSync network
- `signature` (string, required): Function signature, e.g. "transfer(address,uint256)"
- `to` (string, required): Address of the contract to send the transaction to
- `trezor` (boolean): Sign with a Trezor hardware wallet
- `unlocked` (boolean): Use eth_sendTransaction with --from address (no local signing). For nodes that manage keys natively.
- `value` (string): ETH value to send with the transaction, e.g. "0.1ether" or amount in wei

### `cast_balance` (~89 tokens)

Query the ETH balance of an address (cast balance)

Input parameters:

- `address` (string, required): Address to query the balance of
- `blockTag` (string): Block to query at, e.g. "latest", "pending", or a block number
- `ether` (boolean): If true, format the output in ether instead of wei
- `rpcUrl` (string, required): RPC URL of the network

### `cast_nonce` (~88 tokens)

Query the transaction nonce of an address (cast nonce). Note: on zkSync this returns the TX nonce only, not the deploy nonce.

Input parameters:

- `address` (string, required): Address to query the nonce of
- `blockTag` (string): Block to query at, e.g. "latest", "pending", or a block number
- `rpcUrl` (string, required): RPC URL of the network

### `get_zksync_docs` (~155 tokens)

Look up foundry-zksync documentation by topic. Returns URLs to the foundry-zksync book for installation, config, testing, deployment, cheatcodes, nonces, factory deps, paymasters, verification, and more. Use topic='list' to see all available topics.

Input parameters:

- `topic` (string, required): Topic to look up in the foundry-zksync book. Examples: 'installation', 'forge-test', 'cheatcodes', 'deployment', 'config', 'zksync-config', 'nonces', 'factory-deps', 'paymaster', 'verification', 'cas…

### `anvil_zksync` (~181 tokens)

Start or check a local anvil-zksync development node. Supports forking from mainnet/testnet. Default port: 8011.

Input parameters:

- `accounts` (number): Number of funded accounts to generate (default: 10)
- `action` (string, required): 'start' launches anvil-zksync in the background and returns when ready. 'check' tests if anvil-zksync is reachable at the given port.
- `balance` (number): ETH balance for each generated account in ether (default: 10000)
- `forkBlockNumber` (number): Block number to fork from (requires forkUrl)
- `forkUrl` (string): RPC URL to fork from, e.g. https://mainnet.era.zksync.io
- `port` (number): Port to listen on (default: 8011)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/jrigada-foundry-zksync/foundry-zksync-mcp#diagnostics

## Score history

- 2026-08-03: 67
- 2026-08-02: 66
- 2026-08-01: 5
- 2026-07-31: 25
- 2026-07-30: 43
- 2026-07-28: 43
- 2026-07-27: 43

## Links

- npm package: https://www.npmjs.com/package/foundry-zksync-mcp
- Socket report: https://socket.dev/npm/package/foundry-zksync-mcp
- Repository: https://github.com/Jrigada/foundry-zksync-mcp
- Changelog RSS feed: https://verifymcp.io/servers/jrigada-foundry-zksync/foundry-zksync-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/jrigada-foundry-zksync/foundry-zksync-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/jrigada-foundry-zksync/foundry-zksync-mcp