io.github.jamesdfinance-dev/lazaretto

up checked 2026-11-11T09:39:48.961Z

Unclaimed · Unverified

Agent searches it appeared in, last 30 days: 0. Run this server? Claim the listing: verified label, uptime alerts and analytics.

Publisher-provided title

Lazaretto

Publisher-provided description

Supply chain security: free npm lockfile malware check, paid scan of packages, skills, MCP servers.

Summary by lookupd

Scans npm lockfiles, packages, skills and MCP servers for malicious behavior and checks known-bad hashes and attestations before installing.

Install

Claude Code, remote (streamable-http)

claude mcp add --transport http lazaretto https://lazaretto.dev/mcp

Claude Code, npm package (stdio)

claude mcp add lazaretto -- npx -y lazaretto-mcp

Codex, remote (streamable-http)

codex mcp add lazaretto --url https://lazaretto.dev/mcp

Codex, npm package (stdio)

codex mcp add lazaretto -- npx -y lazaretto-mcp

Cursor, remote (streamable-http) → .cursor/mcp.json

{
  "mcpServers": {
    "lazaretto": {
      "url": "https://lazaretto.dev/mcp"
    }
  }
}

Cursor, npm package (stdio) → .cursor/mcp.json

{
  "mcpServers": {
    "lazaretto": {
      "command": "npx",
      "args": [
        "-y",
        "lazaretto-mcp"
      ]
    }
  }
}

Other clients: docs. Or tell your agent: Set up lookupd for me: read https://lookupd.com/agent.md and follow it.

Tools (10 tools)

Publisher-provided text

• known_bad_lookup Check a SHA-256 against Lazaretto's known-bad indicator set (refreshed daily from abuse.ch). Free and anonymous. A miss only means this exact hash is not in the
• check_lockfile Check EXACTLY-PINNED npm dependencies against published malicious-package advisories (OSV/OpenSSF). Free, anonymous, one call for the whole set. Give EITHER `lo
• scan_artifact Deterministically analyze a package, repo, AI model, skill, or file for malicious behavior (credential theft, data exfiltration, obfuscation, prompt injection a
• scan_lockfile_deep Behaviorally scan the exactly-pinned dependencies in a lockfile, not just their identities: reads the code of each package and screens for credential theft, exf
• scan_mcp_server Check an MCP server BEFORE you connect to it. Asks the server to introduce itself and list its tools, then analyzes the text it hands an agent: tool names, desc
• check_mcp_tools Check tool definitions you ALREADY HOLD, with no network call to anyone. Most MCP servers run locally over stdio and have no endpoint that can be reached, so th
• find_mcp_servers Find an MCP server for a job, free and with no key: describe what you need ("postgres", "send slack messages", "browser automation") and get matching servers fr
• find_attestation Ask whether anyone has already attested an artifact, BEFORE you install it or pay to scan it. Free and anonymous. Give a package identity like "chalk@5.6.1", an
• verify_attestation Verify a Lazaretto scan attestation that another agent (or a README, or a lockfile) handed you, WITHOUT re-scanning or paying. Free and anonymous. Returns signa
• get_free_key Get a free developer key for the metered tools on this server, without leaving this session. No payment, no account, no card. The key holds a small daily allowa

Details

• Version: 1.3.6
• Transports: streamable-http, stdio
• Uptime (7 days): 100%
• Median latency: 364 ms
• First indexed: 2026-11-01T09:35:35.660Z
• Last seen in registry: 2026-11-03T21:17:17.630Z
• Repository: https://github.com/jamesdfinance-dev/lazaretto-mcp
• Website: https://lazaretto.ai

Badge for your README

Shows this live status and links here; updates hourly.

[![lookupd status](https://lookupd.com/badge/io.github.jamesdfinance-dev/lazaretto.svg)](https://lookupd.com/servers/io.github.jamesdfinance-dev/lazaretto)

• 62071 servers
• Last crawl: 2026-11-11T16:39:06.253Z
• API base: https://api.lookupd.com
• MCP URL: https://api.lookupd.com/mcp