← Back to search

dev.avakit/avalanche

mericcintosun Scanned 25d ago

Act on Avalanche from your agent: scaffold a dapp, deploy a contract, mint, and read chain state.

MCP Registry ↗ npm
C
62.6 / 100

Versions

0.1.25latest
first seen Jul 22, 2026
0.1.26
first seen Jul 21, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 16

list_templates
annotations: none low

List the Avalanche dapp templates available to scaffold_app.

scaffold_app
annotations: none low

Create a new Avalanche dapp from a template (minimal, nft-mint, token-gated-app, erc20-token, icm-messenger, eerc-token, l1-launch, token-bridge). Wraps create-avalanche-app. Returns the created files and next steps.

read_chain
annotations: none low

Read a native AVAX balance, a transaction receipt, or a contract view/pure function over RPC.

estimate_gas
annotations: none low

Estimate the gas a transaction (to / data / value) would use and report the current gas price and rough AVAX cost, over RPC. No key needed.

deploy_contract
annotations: none low

Deploy compiled bytecode to Avalanche using a deployer key from the AVAKIT_DEPLOYER_KEY env var. Fuji testnet by default; mainnet (c-chain) requires confirm:true.

get_context
annotations: none low

Return AvaKit + Avalanche context for coding: the API surface, conventions, and doc links.

avalanche_env
annotations: none low

Detect the local Avalanche toolchain (avalanche-cli, Foundry), the current project, and any local L1s.

devnet_status
annotations: none low

Report the local L1s and whether the local network is running.

devnet_spin_up
annotations: none low

Create two local Avalanche L1s with Interchain Messaging and a relayer, and deploy them locally. Idempotent. Takes a few minutes.

devnet_launch_l1
annotations: none low

Create a single custom Subnet-EVM L1 and deploy it locally. Returns the exit code and log tail; read the chain's RPC afterwards with devnet_status. Idempotent (won't recreate an existing chain). Takes a few minutes on first run.

devnet_start
annotations: none low

Start the local Avalanche network.

devnet_stop
annotations: none low

Stop the local Avalanche network.

icm_state
annotations: none low

Report each L1's messenger address and last received cross-chain message.

icm_deploy_messengers
annotations: none low

Deploy the AvaKitMessenger contract on each running L1 that doesn't have one.

icm_send
annotations: none low

Send a string from one L1's messenger to the other's over Interchain Messaging.

to string from string message string
data_lookup
annotations: none low

Balances, NFTs, and recent transactions for an address on a public Avalanche chain, via the AvaCloud Data API.

address string

Permissions 3

network medium
Server uses network capabilities via: fetch()
shell high
Server uses shell capabilities via: child_process, spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 76

low
Tool 'list_templates' has no annotations annotation_checker · 100%
low
Tool 'scaffold_app' has no annotations annotation_checker · 100%
low
Tool 'read_chain' has no annotations annotation_checker · 100%
low
Tool 'estimate_gas' has no annotations annotation_checker · 100%
low
Tool 'deploy_contract' has no annotations annotation_checker · 100%
low
Tool 'get_context' has no annotations annotation_checker · 100%
low
Tool 'avalanche_env' has no annotations annotation_checker · 100%
low
Tool 'devnet_status' has no annotations annotation_checker · 100%
low
Tool 'devnet_spin_up' has no annotations annotation_checker · 100%
low
Tool 'devnet_launch_l1' has no annotations annotation_checker · 100%
low
Tool 'devnet_start' has no annotations annotation_checker · 100%
low
Tool 'devnet_stop' has no annotations annotation_checker · 100%
low
Tool 'icm_state' has no annotations annotation_checker · 100%
low
Tool 'icm_deploy_messengers' has no annotations annotation_checker · 100%
low
Tool 'icm_send' has no annotations annotation_checker · 100%
low
Tool 'data_lookup' has no annotations annotation_checker · 100%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Excessive dependency count: 127 direct dependencies dependency_analyzer · 90%
medium
Suspicious package name: react-dom dependency_analyzer · 60%
medium
Vulnerable dependency: tsup@catalog: (GHSA-3mv9-4h5g-vhg3) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@catalog: (GHSA-5xrq-8626-4rwp) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@catalog: (GHSA-9crc-q9x8-hgqq) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@7.0.0 (GHSA-4w7w-66w2-5vf9) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@7.0.0 (GHSA-93m4-6634-74q7) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@7.0.0 (GHSA-fx2h-pf6j-xcff) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@7.0.0 (GHSA-g4jq-h2w9-997c) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@7.0.0 (GHSA-jqfw-vq24-v9c3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@7.0.0 (GHSA-p9ff-h696-f583) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@7.0.0 (GHSA-v6wh-96g9-6wx3) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.9 (GHSA-4633-3j49-mh5q) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.9 (GHSA-4c39-4ccg-62r3) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.9 (GHSA-68g3-v927-f742) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.9 (GHSA-6gpp-xcg3-4w24) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.9 (GHSA-89xv-2m56-2m9x) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.9 (GHSA-955p-x3mx-jcvp) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.9 (GHSA-m99w-x7hq-7vfj) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.9 (GHSA-p9j2-gv94-2wf4) dependency_analyzer · 95%
medium
Vulnerable dependency: next@16.2.9 (GHSA-q8wf-6r8g-63ch) dependency_analyzer · 95%
medium
Vulnerable dependency: postcss@8.5.16 (GHSA-fxqj-rqcc-2cmp) dependency_analyzer · 95%
medium
Vulnerable dependency: postcss@8.5.16 (GHSA-r28c-9q8g-f849) dependency_analyzer · 95%
info
Tool: scaffold_app manifest_parser · 85%
medium
Hex string literal (>50 chars) in mericcintosun-AvaKit-773f68e/packages/create-avalanche-app/templates/eerc-token/lib/eerc-config.ts:31 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in mericcintosun-AvaKit-773f68e/packages/create-avalanche-app/templates/eerc-token/lib/eerc-config.ts:32 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in mericcintosun-AvaKit-773f68e/packages/create-avalanche-app/templates/eerc-token/lib/eerc-config.ts:35 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in mericcintosun-AvaKit-773f68e/packages/create-avalanche-app/templates/eerc-token/lib/eerc-config.ts:36 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in mericcintosun-AvaKit-773f68e/packages/create-avalanche-app/templates/eerc-token/lib/eerc-config.ts:39 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in mericcintosun-AvaKit-773f68e/packages/create-avalanche-app/templates/eerc-token/lib/eerc-config.ts:40 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in mericcintosun-AvaKit-773f68e/packages/create-avalanche-app/templates/eerc-token/lib/eerc-config.ts:43 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in mericcintosun-AvaKit-773f68e/packages/create-avalanche-app/templates/eerc-token/lib/eerc-config.ts:44 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in mericcintosun-AvaKit-773f68e/packages/create-avalanche-app/templates/eerc-token/lib/eerc-config.ts:47 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in mericcintosun-AvaKit-773f68e/packages/create-avalanche-app/templates/eerc-token/lib/eerc-config.ts:48 entropy_analyzer · 70%
info
package.json metadata manifest_parser · 100%
info
Tool: list_templates manifest_parser · 85%
info
Tool: read_chain manifest_parser · 85%
info
Tool: estimate_gas manifest_parser · 85%
info
Tool: deploy_contract manifest_parser · 85%
info
Tool: get_context manifest_parser · 85%
info
Tool: avalanche_env manifest_parser · 85%
info
Tool: devnet_status manifest_parser · 85%
info
Tool: devnet_spin_up manifest_parser · 85%
info
Tool: devnet_launch_l1 manifest_parser · 85%
info
Tool: devnet_start manifest_parser · 85%
info
Tool: devnet_stop manifest_parser · 85%
info
Tool: icm_state manifest_parser · 85%
info
Tool: icm_deploy_messengers manifest_parser · 85%
info
Tool: icm_send manifest_parser · 85%
info
Tool: data_lookup manifest_parser · 85%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (13) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 157 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%