Connection check
verified live · 27h ago
lazaretto
Free lockfile malware check plus paid behavioral scan of packages, agent skills and MCP tools.
Tools
8
GitHub stars
—
Installs / wk
212
Licence
MIT
Transport
streamable-http, stdio
Last checked
27h ago
Tools & capabilities
8 toolsRead from the running server on 27h ago.
check_lockfile
read-only
lockfile*
Check every EXACTLY-PINNED dependency in a lockfile against published malicious-package advisories (OSV/OpenSSF). Free, anonymous, one call for the whole tree. Accepts the contents… Check every EXACTLY-PINNED dependency in a lockfile against published malicious-package advisories (OSV/OpenSSF). Free, anonymous, one call for the whole tree. Accepts the contents of a package-lock.json, yarn.lock, or pnpm-lock.yaml. Only exact versions can be answered: a range like ^5.0.0 has no definitive answer because a compromised release usually sits between clean ones. Fail-closed: anything that could not be checked is returned in `unverified`, so an empty `malicious` list is an all-clear only when `unverified` is empty too.
check_mcp_tools
tools_json*
Check tool definitions you ALREADY HOLD, with no network call to anyone. Most MCP servers run locally over stdio and have no endpoint that can be reached, so this is the only way t… Check tool definitions you ALREADY HOLD, with no network call to anyone. Most MCP servers run locally over stdio and have no endpoint that can be reached, so this is the only way to check them, and your client already read their tool list at startup. Paste that JSON: a whole tools/list response, a {"tools":[...]} object, or a bare array. Analyzes the same text as scan_mcp_server and applies the same rules, so a payload cannot be caught over the wire and missed here. Detects tool poisoning (hidden directive blocks, orders pointing the agent at private keys or an agent config file), parameters whose real purpose is to carry secrets or your conversation out, standing orders about ANOTHER server's tools, and invisible-unicode payloads. Metered like scan_artifact.
find_attestation
read-only
subject*
Ask whether anyone has already attested an artifact, BEFORE you install it or pay to scan it. Free and anonymous. Give a package identity like "[email protected]", an MCP server endpoint… Ask whether anyone has already attested an artifact, BEFORE you install it or pay to scan it. Free and anonymous. Give a package identity like "[email protected]", an MCP server endpoint URL, or a sha256 content hash. Returns the signed verdict if one exists, which you can verify offline against https://lazaretto.dev/.well-known/jwks.json, plus freshness: whether the corpus has since contradicted it and whether it was attested under an older rules version. A miss is not a verdict, it only means nobody has scanned this yet.
known_bad_lookup
read-only
sha256*
Check a SHA-256 against Lazaretto's known-bad indicator set (refreshed daily from abuse.ch). Free and anonymous. A miss only means this exact hash is not in the indicator set; it i… Check a SHA-256 against Lazaretto's known-bad indicator set (refreshed daily from abuse.ch). Free and anonymous. A miss only means this exact hash is not in the indicator set; it is not a clean verdict on the artifact.
scan_artifact
reftype*depthcontent
Deterministically analyze a package, repo, skill, or file for malicious behavior (credential theft, data exfiltration, obfuscation, prompt injection aimed at the agent, install scr… Deterministically analyze a package, repo, skill, or file for malicious behavior (credential theft, data exfiltration, obfuscation, prompt injection aimed at the agent, install scripts) and return a verdict (malicious, flagged, clear, error) with the exact evidence and a hash of what was scanned. Metered: present an X-API-Key holding credits. If you hold a wallet instead of an account, pay per call over x402 at POST https://lazaretto.dev/v1/scan ($0.03 USDC on Base, no signup). A free key with a daily allowance is available at POST https://lazaretto.dev/v1/trial. For checks that are always free, use check_lockfile or known_bad_lookup.
scan_lockfile_deep
lockfile*
Behaviorally scan EVERY exactly-pinned dependency in a lockfile, not just their identities: reads the code of each package and reports credential theft, exfiltration, obfuscation,… Behaviorally scan EVERY exactly-pinned dependency in a lockfile, not just their identities: reads the code of each package and reports credential theft, exfiltration, obfuscation, prompt injection and install-time droppers with file-and-line evidence. This is the paid counterpart to check_lockfile, which only matches names and versions against advisories. Metered: one credit per package that returns a verdict, nothing for one that errors. Capped at 25 packages per call. Use it before installing a tree you have not vetted.
scan_mcp_server
url*
Check an MCP server BEFORE you connect to it. Asks the server to introduce itself and list its tools, then analyzes the text it hands an agent: tool names, descriptions, parameter… Check an MCP server BEFORE you connect to it. Asks the server to introduce itself and list its tools, then analyzes the text it hands an agent: tool names, descriptions, parameter schemas and server instructions. Catches tool poisoning (hidden directives that point the agent at private keys or at an agent config file), parameters whose real purpose is to carry secrets or your conversation out, standing orders about ANOTHER server's tools (cross-server shadowing), and invisible-unicode payloads. Returns a verdict with the exact tool and line as evidence, plus a hash of what was advertised, so a server that changes its tools later does not inherit the old verdict. Metered like scan_artifact: an X-API-Key with credits, or pay per call over x402 at POST https://lazaretto.dev/v1/scan with target type mcp_server ($0.03 USDC on Base, no signup).
verify_attestation
read-only
attestation*