OpenZeppelin: MCP server, CLI and agent surfaces

Yes: OpenZeppelin runs a public MCP server at mcp.openzeppelin.com that listed 9 tools to a client with no credentials on 4 November 2026. Examples: cairo-erc20, cairo-erc721, cairo-erc1155. It speaks streamable-http, protocol 2025-11-25. Ora's cached score for openzeppelin.com is 68, grade C, read on 5 November 2026.

Fact sheet

Company	OpenZeppelin
Domain	openzeppelin.com
Category	Developer Tools (Ora leaderboard category)
MCP server	Verified (No authentication)
Ora score	68, grade C; Ora scanned the domain on 28 October 2026 and the cached score was read on 5 November 2026 from its score API (Ora's score page for openzeppelin.com, a vendor-published score)
Company found through	the awesome-remote-mcp-servers list
Last verified	4 November 2026

MCP server

Endpoint	`https://mcp.openzeppelin.com/contracts/cairo/mcp`
How it was found	listed in the awesome-remote-mcp-servers list
Transport	streamable-http
HTTP status	200
Protocol version	2025-11-25
Server	OpenZeppelin Cairo Contracts MCP Server 0.7.2
Capabilities	tools, resources, instructions
Tools	9
Resources	9
Prompts	0
Connected	4 November 2026, 20:03 UTC
Handshake time	1,241 ms over 1 attempt

Tools listed

9 tools

cairo-erc20
cairo-erc721
cairo-erc1155
cairo-erc6909
cairo-account
cairo-multisig
cairo-governor
cairo-vesting
cairo-custom

Connector log

2 connections on 4 November 2026, read-only methods only

19:58:43Z https://mcp.openzeppelin.com/contracts/cairo/mcp sent initialize, notifications/initialized, tools/list, resources/list result verified (HTTP 200) 1407 ms
20:03:54Z https://mcp.openzeppelin.com/contracts/cairo/mcp sent initialize, notifications/initialized, tools/list, resources/list result verified (HTTP 200) 1241 ms

Authentication

Auth type	No authentication
Auth as listed by a registry	Open (a claim, not checked by connecting)

The sign-in route, step by step

Send the handshake to https://mcp.openzeppelin.com/contracts/cairo/mcp over streamable-http. Servers on the 2026-07-28 revision answer server/discover; older servers answer initialize.
Send tools/list, then resources/list and prompts/list if the capabilities name them.
Send no token. The connector sent none and the server answered, so any MCP client can read this list.
Calling a tool is a separate step this directory never takes.

See OAuth for MCP: client ID metadata documents and dynamic registration for how each route works.

CLI

No CLI is on record for OpenZeppelin. The directory checks a package only where a source names one, so this is a floor: a company can ship a command line that no source read for this edition mentions. See shipping a CLI agents can use.

Other agent surfaces

Agent surfaces other than MCP and CLI
Surface	Result
OpenAPI file	No OpenAPI file at the root paths checked.
WebMCP in the initial HTML	Not checked: the home page was not read by the shared crawl.
MCP discovery file	Not checked: the domain is not in the shared crawl for this edition.
A2A agent card	Not checked: the domain is not in the shared crawl for this edition.
A2A agent card (older path)	Not checked: the domain is not in the shared crawl for this edition.
agents.json	Not checked: the domain is not in the shared crawl for this edition.
OAuth authorization server metadata	Not checked: the domain is not in the shared crawl for this edition.
NLWeb endpoint	Not checked in this edition.

Registry listings

Registry listings
Registry	Listed
Official MCP Registry	No
GitHub MCP Registry	No
awesome-remote-mcp-servers	Yes
Smithery	Not checked: Smithery's listing pages and search API were unavailable on 4 November 2026.
Glama	Not checked: Glama's API needs a key and attribution terms.