Atlas / MCP servers / praneshasp / Foundry

FoundryBLOCK

Name: Foundry
Author: praneshasp

mcp/praneshasp/foundry-1

MCP server by praneshasp · ai · blockchain · mcp server · Audited 2026-10-06

⚑ Report / re-scan Source ↗

An experimental MCP Server for foundry built for Solidity devs

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

16 11r · 5w · 0d

Transport

stdio

License

MIT

Stars

253

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A simple, lightweight and fast MCP (Model Context Protocol) server that provides Solidity development capabilities using the Foundry toolchain (Forge, Cast, and Anvil).

Overview

This server connects LLM assistants to the Foundry ecosystem, enabling them to:

Interact with nodes (local Anvil instances or remote RPC endpoints)
Analyze smart contracts and blockchain data
Perform common EVM operations using Cast
Manage, deploy, and execute Solidity code and scripts
Work with a persistent Forge workspace

Features

Network Interaction

Start and manage local Anvil instances
Connect to any remote network (just specify the RPC)
Get network/chain information

Contract Interaction

Call contract functions (read-only)
Send transactions to contracts (if PRIVATE_KEY is configured)
Get transaction receipts
Read contract storage
Analyze transaction traces
Retrieve contract ABIs and sources from block explorers

Solidity Development

Maintain a dedicated Forge workspace
Create and edit Solidity files
Install dependencies
Run Forge scripts
Deploy contracts

Utility Functions

Calculate contract addresses
Check contract bytecode size
Estimate gas costs
Convert between units (hex to decimals, etc.,)
Generate wallets
Get event logs
Lookup function and event signatures

Smart Contract Analysis (Heimdall)

Disassemble EVM bytecode into human-readable opcodes
Decode raw calldata without requiring ABI
Decompile EVM bytecode to Solidity source code and ABI
Generate visual control flow graphs for EVM bytecode
Detailed transaction inspection with calldata decoding and trace analysis

Usage

The server is designed to be used as an MCP tool provider for MCP Clients. When connected to a client, it enables the clients(claude desktop, cursor, client, etc.,) to perform Solidity and onchain operations directly.

Requirements

Read from source at commit 2f8359351517OBSERVED · 2026-10-06

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add foundry-mcp-server --env PRIVATE_KEY=${PRIVATE_KEY} -- npx -y @pranesh.asp/[email protected]

claude-desktop

{
  "mcpServers": {
    "foundry-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@pranesh.asp/[email protected]"
      ],
      "env": {
        "PRIVATE_KEY": "${PRIVATE_KEY}"
      }
    }
  }
}

Exposed tools (16)

11 read · 5 write · 0 destructive.

Tool	Risk	Description
`anvil_start`	write	Start a new Anvil instance (local Ethereum node)
`anvil_status`	read	Check if Anvil is running and get its status
`anvil_stop`	write	Stop a running Anvil instance
`cast_balance`	read	Check the ETH balance of an address
`cast_call`	read	Call a contract function (read-only)
`cast_chain`	read	Get information about the current chain
`cast_receipt`	read	Get the transaction receipt
`cast_send`	write	Send a transaction to a contract function
`convert_eth_units`	read	Convert between Ethereum units (wei, gwei, ether)
`create_solidity_file`	write	Create or update a Solidity file in the workspace
`forge_script`	write	Run a Forge script from the workspace
`heimdall_cfg`	read	Generate visual control flow graph for EVM bytecode using Heimdall
`heimdall_decode`	read	Decode raw calldata without requiring ABI using Heimdall
`heimdall_decompile`	read	Decompile EVM bytecode to Solidity source code and ABI using Heimdall
`heimdall_disassemble`	read	Disassemble EVM bytecode into human-readable opcodes using Heimdall
`heimdall_inspect`	read	Detailed inspection of Ethereum transactions including calldata decoding, trace analysis, and log visualization using Heimdall

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (5 observation(s))
Network: declared (3 observation(s))
Shell: declared (1 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (11)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/tools/anvil/start.ts:65

const child = exec(command, (error, stdout, stderr) => {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319

src/tools/forge/script.ts:20

async ({ scriptPath, sig = "run()", rpcUrl, broadcast = false, verify = false }) => {

Why it matters. certificate verification is disabled

Fix. leave verification on

MEDIUMInventory / provenance · inv.binary · CWE-1104

bun.lockb

bun.lockb

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README