
Company News
AWS Security Hub Adds Socket for Supply Chain Security
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.
@pact-community/mcp-pact
Advanced tools
MCP server for Pact 5 smart contract tooling - REPL testing, module scanning, gas analysis, interface diff, fmt check
MCP server for Pact 5 smart contract tooling. Provides REPL testing, module scanning, gas analysis, and code quality tools for Kadena blockchain development.
.repl files and aggregate results| Tool | Purpose | Annotations |
|---|---|---|
pact_repl_run | Run single .repl file | readOnly:false, destructive:false, idempotent:true |
pact_repl_run_many | Run a batch of .repl files sequentially | readOnly:false, destructive:false, idempotent:true |
pact_module_scan | Static analysis for traps | readOnly:true, destructive:false, idempotent:true |
pact_gas_estimate | Measure gas consumption | readOnly:true, destructive:false, idempotent:true |
pact_interface_diff | Compare file signatures | readOnly:true, destructive:false, idempotent:true |
pact_fmt_check | Check code formatting | readOnly:true, destructive:false, idempotent:true |
pact://traps — JSON catalog of Pact 5 critical traps (5 entries)PACT_COMMUNITY_WORKSPACE_ROOT (required): Workspace root directoryPACT_COMMUNITY_PACT_BIN (optional): Path to pact binary (default: 'pact')The server runs via npx — no install step required:
{
"mcpServers": {
"pact": {
"command": "npx",
"args": ["-y", "@pact-community/mcp-pact"],
"env": {
"PACT_COMMUNITY_WORKSPACE_ROOT": "/path/to/your/project",
"PACT_COMMUNITY_PACT_BIN": "pact"
}
}
}
}
To debug interactively:
npx @modelcontextprotocol/inspector npx -y @pact-community/mcp-pact
{
"method": "tools/call",
"params": {
"name": "pact_repl_run",
"arguments": {
"file": "pact/tests/dao-token.repl"
}
}
}
{
"method": "tools/call",
"params": {
"name": "pact_repl_run_many",
"arguments": {
"files": [
"pact/tests/dao-types.repl",
"pact/tests/dao-token.repl",
"pact/tests/dao-voting.repl"
],
"failFast": false
}
}
}
Response shape:
{
"results": [
{ "file": "…", "exitCode": 0, "ok": true, "stdout": "…", "stderr": "",
"durationMs": 1234, "truncated": false }
],
"summary": { "total": 3, "passed": 3, "failed": 0, "totalDurationMs": 3700 },
"aborted": false,
"timedOut": false
}
Notes:
pact process (rejects on first bad path).ok = exitCode === 0 && stdout contains "Load successful" && no "Load failed".{
"method": "tools/call",
"params": {
"name": "pact_module_scan",
"arguments": {
"file": "pact/modules/dao-token.pact"
}
}
}
pact_gas_estimate is read-only: it does not inject gas probes. The .repl
file must emit gas using any of these forms:
(env-gaslimit N) followed by (env-gas 0) … (env-gas) — prints Gas: <n>"label: Gas: <n>""gas-probe: LABEL = <n>"{
"method": "tools/call",
"params": {
"name": "pact_gas_estimate",
"arguments": {
"file": "pact/tests/gas/transfer.repl",
"gasLimit": 150000
}
}
}
Response:
{
"file": "…",
"exitCode": 0,
"measurements": [
{ "label": "transfer", "gas": 500, "lineNumber": 12 },
{ "gas": 700, "lineNumber": 15 }
],
"totalGas": 1200,
"warning": null,
"truncated": false,
"durationMs": 850
}
Emits warning when no probes are found — no false-positive zero measurements.
Compare the public-API surface (module, implements, defun, defcap, defpact,
defschema, deftable) of two .pact files. Useful in CI to detect breaking
changes before merge.
{
"method": "tools/call",
"params": {
"name": "pact_interface_diff",
"arguments": {
"before": "pact/modules/dao-token.pact",
"after": "pact/modules/dao-token.next.pact"
}
}
}
Response:
{
"moduleName": { "before": "dao-token", "after": "dao-token" },
"added": [{ "kind": "defun", "name": "burn", "signature": "(defun burn …)", "line": 42 }],
"removed": [{ "kind": "defpact", "name": "cross-transfer", "signature": "…", "line": 88 }],
"changed": [{ "kind": "defun", "name": "transfer",
"before": { "signature": "(defun transfer (from to amount) …)", "line": 30 },
"after": { "signature": "(defun transfer (from to amount memo) …)", "line": 30 } }],
"unchanged": [/* … */],
"breakingChange": true,
"parseWarnings": []
}
breakingChange = removed.length > 0 || changed.length > 0. Each file is
capped at 2 MB; oversized inputs reject with FILE_TOO_LARGE. If neither file
yields any extractable symbols the tool throws UNPARSEABLE_PACT.
Read-only style check. Never writes files.
{
"method": "tools/call",
"params": {
"name": "pact_fmt_check",
"arguments": {
"files": [
"pact/modules/dao-token.pact",
"pact/modules/dao-voting.pact"
]
}
}
}
Issue kinds reported:
trailing-whitespacetab-characterexcess-blank-lines (≥2 consecutive blank lines, reported once per run)no-trailing-newlinecrlf-line-endingResponse:
{
"results": [
{ "file": "…", "clean": true, "issues": [] },
{ "file": "…", "clean": false, "issues": [
{ "line": 12, "kind": "tab-character" },
{ "line": 30, "kind": "trailing-whitespace" }
]}
],
"summary": { "total": 2, "clean": 1, "dirty": 1 }
}
See SECURITY.md for threat model and security controls.
FAQs
MCP server for Pact 5 smart contract tooling - REPL testing, module scanning, gas analysis, interface diff, fmt check
The npm package @pact-community/mcp-pact receives a total of 169 weekly downloads. As such, @pact-community/mcp-pact popularity was classified as not popular.
We found that @pact-community/mcp-pact demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.