@starkscan/cli

Command-line Starkscan client for status checks, explorer reads, local exports, and agent setup.

Release target: 0.3.0. This release carries the address-activity truth contract and its typed nullable output through the native CLI. Use the untagged install only after the live latest verifier passes; pin 0.3.0 for reproducible installs after that promotion.

Install

npm install -g @starkscan/cli
starkscan doctor

One-off agent setup without a global install:

npx -y @starkscan/cli init --agent --output-format json

Exact pin for unattended services:

npx -y @starkscan/[email protected] init --agent --output-format json

Prerelease tags such as @beta are maintainer-directed test channels only. Normal users and agents should use the default package or the exact 0.3.0 pin above.

First commands

export STARKSCAN_API_KEY="<store this in your shell or agent secret store>"
export STARKSCAN_CHAIN="SN_MAIN"
# Optional: only set this for preview or self-hosted hosts.
# export STARKSCAN_BASE_URL="https://preview.example.com/api"

starkscan status
starkscan block 8279910
starkscan tx 0x1234abcd
starkscan search 0x1234abcd
starkscan wallet-asset-discovery 0xWALLET --limit 25
starkscan wallet-state 0xWALLET --mode require_complete --limit 25

The CLI defaults to https://api.starkscan.co, sends X-Starkscan-Api-Key, and uses the same REST API contract as the SDK. MCP uses a separate transport: POST https://api.starkscan.co/mcp on the API domain, or POST {appBaseUrl}/api/mcp on app-origin deployments.

Why use it

• No Rust toolchain or private repository access required.
• Prebuilt native starkscan binaries are bundled in the npm package.
• Bundled or downloaded native archives are verified against manifest checksums before execution.
• --output-format json keeps stdout parseable for agents and CI.
• Stable exit classes make automation predictable: success, usage, auth, rate-limit, timeout, and not-found errors are distinct.
• MCP helpers print ready-to-paste Codex, Claude Code, Cursor, Claude Desktop, and Cline configs with environment placeholders, not secret values.

Agent setup

npx -y @starkscan/[email protected] init --agent --output-format json
npx -y @starkscan/[email protected] mcp print-config --transport remote
npx -y @starkscan/[email protected] mcp start --transport remote

print-config emits machine-readable snippets. Keep STARKSCAN_API_KEY in the host shell, CI secret store, or MCP client secret store.

Launcher inspection

Agents can inspect the launcher decision without executing the native binary:

npx -y @starkscan/[email protected] --launcher-json

The JSON includes the package version, resolved binary path, release tag, source (bundled, download, bin-path, or unknown for legacy caches), cache-hit status, and verification status.

Trust and safety

• npm package: https://www.npmjs.com/package/@starkscan/cli
• CLI docs: https://starkscan.co/docs/ai/agent-cli
• API key setup: https://starkscan.co/api-key
• Package trust: https://starkscan.co/docs/build/package-trust
• Machine-readable launch matrix: https://starkscan.co/public-client-surface-matrix.json
• Socket signal: https://socket.dev/npm/package/@starkscan/cli

Socket is an external package-risk signal, not a Starkscan security certificate. The public trust source is Starkscan docs because the canonical engineering repository is private. Package promotion also requires checked release scripts, native artifact checksum verification, npm Trusted Publishing/OIDC for CI publishes, and live smoke proof against the hosted API.

The CLI forwards public API keys only to Starkscan HTTPS hosts or localhost/loopback fixtures. When intentionally testing a private API host, pass --allow-untrusted-base-url explicitly so keys are not replayed to an unexpected endpoint by default.

Release binding

The package resolves bundled artifacts under artifacts/v<package-version> when published with native binaries included. Maintainer overrides such as STARKSCAN_CLI_RELEASE_TAG, STARKSCAN_CLI_RELEASE_BASE_URL, STARKSCAN_CLI_BUNDLED_ARTIFACT_DIR, and STARKSCAN_CLI_BIN_PATH exist for tests and emergency rollback; public clients should not need them.