All servers · Security · Payments & accounting · Code & repositories

io.github.jamesdfinance-dev/lazaretto

io.github.jamesdfinance-dev/lazaretto · v1.3.0

Measured by MCP Station

Instruction-like text was found in scan_artifact, scan_lockfile_deep. This is a pattern match, not a verdict. What we look for

Description written by the publisher, not verified

Free lockfile malware check plus paid behavioral scan of packages, agent skills and MCP tools.

Connect

claude mcp add --transport http lazaretto https://lazaretto.dev/mcp

{
  "mcpServers": {
    "lazaretto": {
      "url": "https://lazaretto.dev/mcp"
    }
  }
}

Tools as reported by the server

• known_bad_lookup
  Check a SHA-256 against Lazaretto's known-bad indicator set (refreshed daily from abuse.ch). Free and anonymous. A miss only means this exact hash is not in the indicator set; it is not a clean verdict on the artifact.
• check_lockfile
  Check EXACTLY-PINNED npm dependencies against published malicious-package advisories (OSV/OpenSSF). Free, anonymous, one call for the whole set. Give EITHER `lockfile`, the full text of a package-lock.json, yarn.lock or pnpm-lock.yaml, OR `packages`, a list of "name@version" strings, which is the on
• scan_artifact
  Deterministically analyze a package, repo, skill, or file for malicious behavior (credential theft, data exfiltration, obfuscation, prompt injection aimed at the agent, install scripts) and return a verdict (malicious, flagged, clear, error) with the exact evidence and a hash of what was scanned. Me
• scan_lockfile_deep
  Behaviorally scan the exactly-pinned dependencies in a lockfile, not just their identities: reads the code of each package and screens for credential theft, exfiltration, obfuscation, prompt injection and install-time droppers. Each result carries a verdict, a risk level, the ids of the rules that f
• scan_mcp_server
  Check an MCP server BEFORE you connect to it. Asks the server to introduce itself and list its tools, then analyzes the text it hands an agent: tool names, descriptions, parameter schemas and server instructions. Catches tool poisoning (hidden directives that point the agent at private keys or at an
• check_mcp_tools
  Check tool definitions you ALREADY HOLD, with no network call to anyone. Most MCP servers run locally over stdio and have no endpoint that can be reached, so this is the only way to check them, and your client already read their tool list at startup. Paste that JSON: a whole tools/list response, a {
• find_attestation
  Ask whether anyone has already attested an artifact, BEFORE you install it or pay to scan it. Free and anonymous. Give a package identity like "chalk@5.6.1", an MCP server endpoint URL, or a sha256 content hash. Returns the signed verdict if one exists, which you can verify offline against https://l
• verify_attestation
  Verify a Lazaretto scan attestation that another agent (or a README, or a lockfile) handed you, WITHOUT re-scanning or paying. Free and anonymous. Returns whether the signature is valid and Lazaretto's, the attested claims (verdict, risk, and the subject the verdict is about), and a `contradicted` f
• get_free_key
  Get a free developer key for the metered tools on this server, without leaving this session. No payment, no account, no card. The key holds a small daily allowance that refills every day, and one credit is consumed per verdict, nothing on an error. Present it as the X-API-Key header on this MCP conn

Repository · Website · JSON · Text for agents · Registry updated 2026-09-22