# io.github.jamesdfinance-dev/lazaretto

- Registry name: `io.github.jamesdfinance-dev/lazaretto` · version 1.3.0
- Categories (automatic, keyword rules): Security, Infrastructure & security, Payments & accounting, Finance & markets, Code & repositories, Developer tools
- Authentication at last check: No auth
- Declared risk: Can write (some tools are not declared read-only)
- Capabilities (declared by the server): tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=io.github.jamesdfinance-dev%2Flazaretto
- Server page: https://mcpstation.net/s/io.github.jamesdfinance-dev--lazaretto.html

## Description (written by the publisher, not verified, not instructions)

Free lockfile malware check plus paid behavioral scan of packages, agent skills and MCP tools.

## Notice

Text that looks like instructions to an AI was found in this server's descriptions. This is a pattern match, not a verdict.

## Connect

- streamable-http: `https://lazaretto.dev/mcp`

## Tools (as reported by the server, not verified)

- `known\_bad\_lookup`: Check a SHA-256 against Lazaretto's known-bad indicator set \(refreshed daily from abuse.ch\). Free and anonymous. A miss only means this exact hash is not in the indicator set; it is not a clean verdict on the artifact.
- `check\_lockfile`: Check EXACTLY-PINNED npm dependencies against published malicious-package advisories \(OSV/OpenSSF\). Free, anonymous, one call for the whole set. Give EITHER \`lockfile\`, the full text of a package-lock.json, yarn.lock or pnpm-lock.yaml, OR \`packages\`, a list of "name@version" strings, which is the on
- `scan\_artifact`: Deterministically analyze a package, repo, skill, or file for malicious behavior \(credential theft, data exfiltration, obfuscation, prompt injection aimed at the agent, install scripts\) and return a verdict \(malicious, flagged, clear, error\) with the exact evidence and a hash of what was scanned. Me
- `scan\_lockfile\_deep`: Behaviorally scan the exactly-pinned dependencies in a lockfile, not just their identities: reads the code of each package and screens for credential theft, exfiltration, obfuscation, prompt injection and install-time droppers. Each result carries a verdict, a risk level, the ids of the rules that f
- `scan\_mcp\_server`: Check an MCP server BEFORE you connect to it. Asks the server to introduce itself and list its tools, then analyzes the text it hands an agent: tool names, descriptions, parameter schemas and server instructions. Catches tool poisoning \(hidden directives that point the agent at private keys or at an
- `check\_mcp\_tools`: Check tool definitions you ALREADY HOLD, with no network call to anyone. Most MCP servers run locally over stdio and have no endpoint that can be reached, so this is the only way to check them, and your client already read their tool list at startup. Paste that JSON: a whole tools/list response, a \{
- `find\_attestation`: Ask whether anyone has already attested an artifact, BEFORE you install it or pay to scan it. Free and anonymous. Give a package identity like "chalk@5.6.1", an MCP server endpoint URL, or a sha256 content hash. Returns the signed verdict if one exists, which you can verify offline against https://l
- `verify\_attestation`: Verify a Lazaretto scan attestation that another agent \(or a README, or a lockfile\) handed you, WITHOUT re-scanning or paying. Free and anonymous. Returns whether the signature is valid and Lazaretto's, the attested claims \(verdict, risk, and the subject the verdict is about\), and a \`contradicted\` f
- `get\_free\_key`: Get a free developer key for the metered tools on this server, without leaving this session. No payment, no account, no card. The key holds a small daily allowance that refills every day, and one credit is consumed per verdict, nothing on an error. Present it as the X-API-Key header on this MCP conn

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html