
Security News
TC39 Advances Temporal to Stage 4 Alongside Several ECMAScript Proposals
TC39’s March 2026 meeting advanced eight ECMAScript proposals, including Temporal reaching Stage 4 and securing its place in the ECMAScript 2026 specification.
AI-native Starknet DeFi CLI + MCP Server + Agent Skills — Swaps, multi-swap, batch (multicall), staking, lending, simulation, portfolio, gas abstraction
The AI-native DeFi toolkit for Starknet.
A production-grade CLI and MCP server that gives both developers and AI agents full access to swaps, multi-swap, atomic batch transactions, staking, lending, portfolio management, and gasless transactions — all powered by the Starkzap SDK.
npx starkfi@latest --help
Most DeFi tools are built for humans clicking buttons. StarkFi is built for agents.
┌──────────────────────────────────────────────────────────────────────────┐
│ StarkFi │
│ │
│ ┌──────────┐ ┌─────────────────────┐ ┌───────────────────────┐ │
│ │ CLI │ │ MCP Server │ │ Agent Skills │ │
│ │ (30+ │ │ (27 tools) │ │ (10 workflows) │ │
│ │ commands)│ │ stdio transport │ │ npx starkfi@latest │ │
│ └────┬─────┘ └──────────┬──────────┘ └──────────┬────────────┘ │
│ │ │ │ │
│ └──────────────────────┼───────────────────────────┘ │
│ ▼ │
│ ┌──────────────────────────────────────────────────────────────────┐ │
│ │ Service Layer │ │
│ │ ┌──────────┐ ┌──────────┐ ┌────────┐ ┌──────────┐ │ │
│ │ │ Fibrous │ │ Staking │ │ Vesu │ │ Batch │ │ │
│ │ │ Swap │ │ Lifecycle│ │ V2 │ │ Multicall│ │ │
│ │ └────┬─────┘ └────┬─────┘ └───┬────┘ └────┬─────┘ │ │
│ │ └─────────────┴────────────┴────────────┘ │ │
│ │ │ │ │
│ │ ┌───────────────┴───────────────────────────┐ │ │
│ │ │ Starkzap SDK (starkzap v1.0.0) │ │ │
│ │ │ Wallet · TxBuilder · Tokens · Paymaster │ │ │
│ │ └───────────────┬───────────────────────────┘ │ │
│ └───────────────────────┼──────────────────────────────────────────┘ │
│ ▼ │
│ ┌──────────────────────────────────────┐ ┌──────────────────────┐ │
│ │ Auth Server (Hono + Privy TEE) │ │ AVNU Paymaster │ │
│ │ Email OTP · Wallet · Sign · Gas │ │ Gas Abstraction │ │
│ └──────────────────────────────────────┘ └──────────────────────┘ │
└──────────────────────────────────────────────────────────────────────────┘
│
▼
┌──────────────────┐
│ Starknet (L2) │
└──────────────────┘
StarkFi leverages all core Starkzap modules:
| Module | Usage in StarkFi |
|---|---|
| Wallets | PrivySigner + ArgentXV050Preset for email-based wallet management via Privy TEE |
| Gasless Transactions (Paymaster) | Paymaster integration with 5 gas tokens (STRK, ETH, USDC, USDT, DAI) + developer-sponsored gasfree mode |
| Staking | Multi-token staking lifecycle (STRK, WBTC, tBTC, SolvBTC, LBTC) — stake, claim, compound, unstake (2-step) |
| TxBuilder | Atomic multicall batching — combine swap + stake + supply + send in one transaction |
| ERC-20 Tokens | Token presets, balance queries, transfers, approvals |
DEX-aggregated swaps with optimal routing. Single swaps, multi-swap (up to 3 pairs), and batch routing.
npx starkfi@latest trade 100 USDC ETH --slippage 1
npx starkfi@latest multi-swap "100 USDC>ETH, 50 USDT>ETH"
Bundle multiple DeFi operations into a single Starknet multicall. Minimum 2 operations.
npx starkfi@latest batch \
--swap "100 USDC ETH" \
--stake "50 STRK karnot" \
--supply "200 USDC Prime" \
--send "10 STRK 0xAddr"
Full staking lifecycle across multiple validators with STRK, WBTC, tBTC, SolvBTC, and LBTC support.
npx starkfi@latest stake 100 -v karnot
npx starkfi@latest rewards -v karnot --compound
npx starkfi@latest unstake intent -v karnot -a 50
npx starkfi@latest unstake exit -v karnot
Supply collateral, borrow assets, monitor health factors, and atomically close positions.
npx starkfi@latest lend-supply 100 -p Prime -t STRK
npx starkfi@latest lend-borrow -p Prime \
--collateral-amount 200 --collateral-token STRK \
--borrow-amount 50 --borrow-token USDC
npx starkfi@latest lend-status # Auto-scan all pools
npx starkfi@latest lend-status -p Prime --collateral-token STRK --borrow-token USDC # Specific position
npx starkfi@latest lend-close -p Prime --collateral-token STRK --borrow-token USDC
Users pay gas fees in their preferred ERC-20 token via AVNU Paymaster — no native STRK or ETH required. Alternatively, developers can sponsor gas entirely.
# Pay gas in USDC instead of STRK
npx starkfi@latest config set-gas-token USDC
# Developer pays all gas (gasfree mode)
npx starkfi@latest config set-gasfree on
| Mode | Who Pays | Gas Tokens | Description |
|---|---|---|---|
| Gasless (default) | User | STRK, ETH, USDC, USDT, DAI | User pays in ERC-20 via Paymaster |
| Gasfree | Developer | — | Developer sponsors all gas |
Estimate fees and validate any transaction before broadcasting.
npx starkfi@latest trade 100 USDC ETH --simulate
# → mode: SIMULATION, estimatedFee: 0.054 STRK ($0.0024), callCount: 4
Consolidated view of all DeFi positions in one call.
npx starkfi@latest portfolio
# → Token Balances (USD), Staking Positions, Lending Positions, Total Value
StarkFi exposes 27 MCP tools via stdio transport, enabling AI assistants to execute DeFi operations.
# Start the MCP server
npx starkfi@latest mcp-start
| Category | Tools | Count |
|---|---|---|
| Auth & Config | get_auth_status, config_action | 2 |
| Wallet | get_balance, get_portfolio, deploy_account, send_tokens, get_tx_status | 5 |
| Trade | get_swap_quote, swap_tokens, get_multi_swap_quote, multi_swap, batch_execute | 5 |
| Staking | list_validators, list_pools, get_staking_info, get_stake_status, stake_tokens, unstake_tokens, claim_rewards, compound_rewards | 8 |
| Lending | list_lending_pools, get_lending_position, supply_assets, withdraw_assets, borrow_assets, repay_debt, close_position | 7 |
User: "Swap 100 USDC to STRK and stake half on Karnot"
Agent:
1. get_swap_quote(amount: "100", from: "USDC", to: "STRK") → 500 STRK
2. swap_tokens(amount: "100", from: "USDC", to: "STRK") → txHash: 0x...
3. stake_tokens(amount: "250", validator: "karnot", token: "STRK") → txHash: 0x...
Add to your AI assistant's MCP config (Cursor, Claude, etc.):
{
"mcpServers": {
"starkfi": {
"command": "npx",
"args": ["-y", "starkfi@latest", "mcp-start"]
}
}
}
For the complete tool registry and schemas, see MCP Documentation.
StarkFi ships with 10 agent skills — structured instruction sets that teach AI coding assistants how to use StarkFi without custom prompting.
| Category | Skills |
|---|---|
| Auth | authenticate-wallet |
| Wallet Data | balance, portfolio |
| Transactions | send, trade, multi-swap, batch, staking, lending |
| Utility | config |
# Install skills for your AI assistant
npx skills add ahmetenesdur/starkfi
See Skills Documentation for details.
npx starkfi@latest auth login user@example.com
npx starkfi@latest auth verify user@example.com <OTP_CODE>
npx starkfi@latest deploy
npx starkfi@latest balance
npx starkfi@latest trade 10 STRK ETH --simulate # Preview first
npx starkfi@latest trade 10 STRK ETH # Execute
| Command | Description |
|---|---|
auth login <email> | Start email OTP authentication |
auth verify <email> <code> | Complete authentication |
auth logout | Terminate session |
status | Check auth status and API health |
address | Display Starknet address |
deploy | Deploy smart account on-chain |
balance [--token <symbol>] [--json] | Query token balances |
send <amount> <token> <recipient> [--simulate] [--json] | Transfer tokens |
portfolio [--json] | Full DeFi portfolio |
| Command | Description |
|---|---|
trade <amount> <from> <to> [--slippage <%>] [--simulate] [--json] | Swap tokens |
multi-swap "<pairs>" [--slippage <%>] [--simulate] [--json] | Multi-pair swap (2-3 pairs) |
| Command | Description |
|---|---|
batch [--simulate] --swap "..." --stake "..." --supply "..." --send "..." | Atomic multicall (min 2 ops) |
| Command | Description |
|---|---|
validators [--json] | List active validators |
pools <validator> [--json] | Show delegation pools |
stake <amount> --validator <name> [--token <symbol>] [--simulate] | Stake tokens |
stake-status [validator] [--json] | Staking dashboard |
rewards --validator <name> [--token <symbol>] <--claim|--compound> | Manage rewards |
unstake <intent|exit> --validator <name> [--token <symbol>] [--amount <n>] | Unstake (2-step) |
| Command | Description |
|---|---|
lend-pools [name] | List lending pools |
lend-supply <amount> -p <pool> -t <token> | Supply assets |
lend-withdraw <amount> -p <pool> -t <token> | Withdraw assets |
lend-borrow -p <pool> --collateral-amount <n> --collateral-token <t> --borrow-amount <n> --borrow-token <t> [--use-supplied] | Borrow |
lend-repay <amount> -p <pool> -t <token> --collateral-token <t> | Repay debt |
lend-status [-p <pool> --collateral-token <t> [--borrow-token <t>]] | Position status (auto-scan if no args) |
lend-close -p <pool> --collateral-token <t> --borrow-token <t> | Close position atomically |
| Command | Description |
|---|---|
config list | Show current configuration |
config reset | Reset all settings to defaults |
config set-rpc <url> | Set custom RPC endpoint |
config get-rpc | Show current RPC |
config set-network <mainnet|sepolia> | Switch network |
config set-gas-token <token|reset> | Set gas payment token |
config set-gasfree <on|off> | Toggle developer-sponsored gas |
tx-status <hash> | Check transaction status |
StarkFi includes a dedicated authentication server (server/) built for secure, non-custodial wallet management.
| Route | Purpose |
|---|---|
/auth | Email OTP login and verification via Privy |
/wallet | Wallet creation and address retrieval |
/sign | Transaction signing via Privy TEE (non-custodial) |
/paymaster | Paymaster proxy for gas abstraction |
ALLOWED_ORIGINS)hono/secure-headersSee server/README.md for setup instructions.
| Layer | Technology |
|---|---|
| Core SDK | Starkzap v1.0.0 |
| CLI | Commander.js v14.0.3 |
| MCP | @modelcontextprotocol/sdk v1.27.1 |
| Schema | Zod v4.3.6 |
| Auth Server | Hono v4.12.7 + Privy TEE |
| DEX Routing | Fibrous Aggregator |
| Lending | Vesu V2 Protocol |
| Gas | AVNU Paymaster |
StarkFi implements a robust error handling system with a custom StarkfiError class and 25 specific error codes organized by domain:
| Domain | Error Codes |
|---|---|
| Auth | AUTH_REQUIRED, AUTH_FAILED, SESSION_EXPIRED |
| Wallet | WALLET_NOT_DEPLOYED, WALLET_NOT_FOUND, INSUFFICIENT_BALANCE |
| Network | NETWORK_ERROR, RATE_LIMITED, TX_FAILED, TX_NOT_FOUND, PAYMASTER_ERROR |
| Validation | INVALID_CONFIG, INVALID_ADDRESS, INVALID_AMOUNT |
| DeFi | SWAP_FAILED, NO_ROUTE_FOUND, SLIPPAGE_EXCEEDED, STAKING_FAILED, LENDING_FAILED, POOL_NOT_FOUND, EXIT_NOT_READY, VALIDATOR_NOT_FOUND |
| System | SIMULATION_FAILED, BATCH_LIMIT_EXCEEDED, UNKNOWN |
All network operations include automatic retry with exponential backoff (500ms base, max 2 retries). Parallel operations use a sliding-window concurrency pool to prevent RPC rate-limiting.
Raw Starknet JSON-RPC errors (hex-encoded Cairo strings like u256_sub Overflow) are automatically parsed into human-readable messages:
| Raw Error | Displayed Message |
|---|---|
u256_sub Overflow | Insufficient balance — you don't have enough tokens (including gas fees) |
ERC20: insufficient allowance | Token approval required — not enough allowance for this operation |
UNAUTHORIZED | Unauthorized — session may have expired, try: starkfi auth login |
argent/multicall-failed | One or more calls in the transaction failed |
dusty-collateral-balance | Collateral amount is below the pool's minimum (dust limit). Please increase the amount. |
dusty-debt-balance | Borrow amount is below the pool's minimum (dust limit). Please increase the amount. |
This applies to both CLI output (formatError) and MCP responses (withErrorHandling).
git clone https://github.com/ahmetenesdur/starkfi.git
cd starkfi
pnpm install
pnpm build # Compile TypeScript → dist/
pnpm dev -- --help # Run with tsx (hot-reload)
pnpm lint # ESLint
pnpm format # Prettier
cd server
pnpm install
cp .env.example .env # Configure environment
pnpm dev
Contributions are welcome! Here's how to get started:
pnpm installpnpm build && pnpm lintFor bug reports and feature requests, please open an issue.
MIT — ahmetenesdur
FAQs
AI-native Starknet DeFi CLI + MCP Server + Agent Skills — Swaps, multi-swap, batch (multicall), staking, lending, simulation, portfolio, gas abstraction
The npm package starkfi receives a total of 379 weekly downloads. As such, starkfi popularity was classified as not popular.
We found that starkfi demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
TC39’s March 2026 meeting advanced eight ECMAScript proposals, including Temporal reaching Stage 4 and securing its place in the ECMAScript 2026 specification.

Research
/Security News
Since January 31, 2026, we identified at least 72 additional malicious Open VSX extensions, including transitive GlassWorm loader extensions targeting developers.

Research
Six malicious Packagist packages posing as OphimCMS themes contain trojanized jQuery that exfiltrates URLs, injects ads, and loads FUNNULL-linked redirects.