Back to search
100
MCP live MCP 2025-06-18 streamable-http

io.github.jamesdfinance-dev/lazaretto

io.github.jamesdfinance-dev/lazaretto

Free lockfile malware check plus paid behavioral scan of packages, agent skills and MCP tools.

Uptime
100.0%
1 direct probes · 30d
Response
878ms
last probe
Tools
8
callable
Resources
0
readable
Prompts
0
available
Primary URL
https://lazaretto.dev/mcp

Tools · 8

known_bad_lookup

Check a SHA-256 against Lazaretto's known-bad indicator set (refreshed daily from abuse.ch). Free and anonymous. A miss only means this exact hash is not in the indicator set; it is not a clean verdic…

check_lockfile

Check every EXACTLY-PINNED dependency in a lockfile against published malicious-package advisories (OSV/OpenSSF). Free, anonymous, one call for the whole tree. Accepts the contents of a package-lock.j…

scan_artifact

Deterministically analyze a package, repo, skill, or file for malicious behavior (credential theft, data exfiltration, obfuscation, prompt injection aimed at the agent, install scripts) and return a v…

scan_lockfile_deep

Behaviorally scan EVERY exactly-pinned dependency in a lockfile, not just their identities: reads the code of each package and reports credential theft, exfiltration, obfuscation, prompt injection and…

scan_mcp_server

Check an MCP server BEFORE you connect to it. Asks the server to introduce itself and list its tools, then analyzes the text it hands an agent: tool names, descriptions, parameter schemas and server i…

check_mcp_tools

Check tool definitions you ALREADY HOLD, with no network call to anyone. Most MCP servers run locally over stdio and have no endpoint that can be reached, so this is the only way to check them, and yo…

find_attestation

Ask whether anyone has already attested an artifact, BEFORE you install it or pay to scan it. Free and anonymous. Give a package identity like "chalk@5.6.1", an MCP server endpoint URL, or a sha256 co…

verify_attestation

Verify a Lazaretto scan attestation that another agent (or a README, or a lockfile) handed you, WITHOUT re-scanning or paying. Free and anonymous. Returns whether the signature is valid and Lazaretto'…

How to use

Add to your Claude Desktop / Cursor / Cline MCP config:

{
  "mcpServers": {
    "io.github.jamesdfinance-dev/lazaretto": {
      "url": "https://lazaretto.dev/mcp",
      "transport": "streamable-http"
    }
  }
}