lazaretto-mcp

Lazaretto MCP is an MCP server used for deterministic pre-installation verification of npm packages, AI agent skills, and MCP tools before installation. Its core idea is: before installing a package, understand what it does.

Purpose This tool is aimed at scenarios that require security verification before installing dependencies or connecting to an MCP server. It provides free lockfile malware checks, as well as paid behavioral scanning. The free check requires no account, key, or installation, and can compare every exact pinned dependency version in the project against published malicious package advisories. The paid scan adds behavioral analysis, with file and line number evidence.

Main capabilities Free tools (no API key required):

• check_lockfile: Checks whether every exact pinned dependency version in the lockfile matches a published malicious package advisory. Supports package-lock.json, npm-shrinkwrap.json, yarn.lock, or pnpm-lock.yaml, reads from the working directory, and covers the entire dependency tree in one call. Only when unverified is also empty does an empty malicious list mean everything passed.
• known_bad_lookup: Determines whether a sha256 content hash is a known malicious artifact, using exact hash matching against an indicator library refreshed daily.
• find_attestation: Queries whether an artifact already has an attestation. You can pass a package identifier such as chalk@5.6.1, an MCP server URL, or a sha256 content hash, and it returns an existing signed verdict along with its age, whether it was generated based on an older rules version, and, if the object has now been flagged as malicious, a contradicted marker. A miss means there is no attestation on record, and does not represent a verdict from either side.
• verify_attestation: Verifies the signed attestation accompanying a scan verdict (compact JWS). It can confirm that the signature belongs to Lazaretto, return the attested claims, and provide a contradicted marker when an object that once passed has now been flagged as malicious, so the verdict can be trusted without rescanning or repaying. It is still necessary to confirm that the artifact about to be run matches claims.sub.

Paid tools (require prepaid credits):

• scan_artifact: Fetches the target (npm or PyPI package, GitHub repository, ClawHub skill, raw URL, or inlinked text) without running it, returning a deterministic verdict (malicious, flagged, clear, error) and evidence. The hosted server uses the X-API-Key request header, and the stdio package uses LAZARETTO_API_KEY.
• scan_lockfile_deep: the behavioral analysis counterpart of check_lockfile, it reads the code of each exact pinned version dependency, up to 25 per call, rather than only matching names and versions. complete_coverage being false means some content was truncated, errored, or only partially read, so that run cannot be treated as proof of health for the entire tree. Calling it again with the same lockfile will rescan and re-bill the same first batch of packages. The result lists all unscanned packages in not_scanned.packages (name@version strings). The hosted server can pass not_scanned.packages back in its entirety as packages, and it will scan the first 25 and list the rest again; the stdio package accepts at most 25 packages per call, so not_scanned.packages must be processed in batches of 25. The tool adds next_call to the result, and next_call.packages holds the first 25 of that list.
• check_mcp_tools: for servers run over stdio (most of them), there is no way to connect from outside, so there is no endpoint to check. But the client has already read its tool list at startup, so you can paste that JSON and Lazaretto will analyze the same text with the same rules, without contacting any server at all.
• scan_mcp_server: point it at an MCP endpoint before connecting. It asks the server to introduce itself and list its tools, then analyzes the text the server hands to the agent: tool names, descriptions, parameter schemas, and their instructions. These texts are documentation the model will follow, so they are a server-controlled instruction channel. It can catch tool poisoning (hidden instructions to read ~/.ssh/id_rsa or the agent's config file), parameters used to carry secrets or exfiltrate conversations, and long-lived instructions about another server's tools. The evidence identifies the specific tool. It only calls initialize and tools/list, and never calls the server's own tools.

How to use Hosted mode (zero install): the server is hosted at https://lazaretto.dev/mcp，可添加到任何支持远程（Streamable HTTP) MCP clients, with no installation and no local process. check_lockfile, known_bad_lookup, find_attestation, and verify_attestation can be used without a key. scan_artifact, scan_lockfile_deep, scan_mcp_server, and check_mcp_tools require credits, which can be purchased at https://lazaretto.dev/buy (agents with a wallet can also buy credits themselves via x402 at POST https://lazaretto.dev/v1/credits/topup ). Self-hosted stdio server (optional): if you want to run locally over stdio instead of using the hosted URL, the npm package name is lazaretto-mcp, and it can also be run from a cloned repository. The stdio package only pays with prepaid credits on LAZARETTO_API_KEY and has no x402 client of its own, so paywalled results do not carry an x402 payment challenge: per-call x402 payments must be completed by the agent's own HTTP client against https://lazaretto.dev/v1/scan , not through this package. LAZARETTO_BASE_URL can override the API host (default https://lazaretto.dev）。

When to use it Use it to check a lockfile before installing npm dependencies, to inspect an MCP server's tool definitions before connecting to it, to verify scan attestations provided by other agents or READMEs, and to obtain behavioral analysis evidence for a package or skill without running code.

Limitations Reports are signals with evidence, not guarantees. clear means there is no known malicious match and no rule triggered; it is not a statement about risk. The package itself contains no detection logic and is only a front end to the Lazaretto API. The Lazaretto service and its detection engine are separate and proprietary. The license is MIT.