NestDaddy
All servers NestDaddy MCP Blog Sign inTry it free
Security

Lazaretto

io.github.jamesdfinance-dev/lazaretto · v1.3.6

Supply chain security: free npm lockfile malware check, paid scan of packages, skills, MCP servers.

Website Source code Set it up

Connect Remote server

Terminal
claude mcp add --transport http lazaretto https://lazaretto.dev/mcp --header "X-API-Key: <X_API_KEY>"
~/.cursor/mcp.json
{
  "mcpServers": {
    "lazaretto": {
      "url": "https://lazaretto.dev/mcp",
      "headers": {
        "X-API-Key": "<X_API_KEY>"
      }
    }
  }
}
.vscode/mcp.json
{
  "servers": {
    "lazaretto": {
      "type": "http",
      "url": "https://lazaretto.dev/mcp",
      "headers": {
        "X-API-Key": "<X_API_KEY>"
      }
    }
  }
}
Claude Desktop
Settings > Connectors > Add custom connector
URL: https://lazaretto.dev/mcp

Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.

Tools 10 found in our last check

  • known_bad_lookup

    Check a SHA-256 against Lazaretto's known-bad indicator set (refreshed daily from abuse.ch). Free and anonymous. A miss only means this exact hash is not in the indicator set; it is not a clean verdict on the artifact.

  • check_lockfile

    Check EXACTLY-PINNED npm dependencies against published malicious-package advisories (OSV/OpenSSF). Free, anonymous, one call for the whole set. Give EITHER `lockfile`, the full text of a package-lock.json, yarn.lock or pnpm-lock.yaml, OR `packages`, a list of "name@version" str…

  • scan_artifact

    Deterministically analyze a package, repo, AI model, skill, or file for malicious behavior (credential theft, data exfiltration, obfuscation, prompt injection aimed at the agent, install scripts, model files that run code on load) and return a verdict (malicious, flagged, clear,…

  • scan_lockfile_deep

    Behaviorally scan the exactly-pinned dependencies in a lockfile, not just their identities: reads the code of each package and screens for credential theft, exfiltration, obfuscation, prompt injection and install-time droppers. Each result carries a verdict, a risk level, the id…

  • scan_mcp_server

    Check an MCP server BEFORE you connect to it. Asks the server to introduce itself and list its tools, then analyzes the text it hands an agent: tool names, descriptions, parameter schemas and server instructions. Catches tool poisoning (hidden directives that point the agent at…

  • check_mcp_tools

    Check tool definitions you ALREADY HOLD, with no network call to anyone. Most MCP servers run locally over stdio and have no endpoint that can be reached, so this is the only way to check them, and your client already read their tool list at startup. Paste that JSON: a whole too…

  • find_mcp_servers

    Find an MCP server for a job, free and with no key: describe what you need ("postgres", "send slack messages", "browser automation") and get matching servers from the official MCP registry, each with its endpoint, the command to add it to Claude Code, its tools, and what Lazaret…

  • find_attestation

    Ask whether anyone has already attested an artifact, BEFORE you install it or pay to scan it. Free and anonymous. Give a package identity like "[email protected]", an MCP server endpoint URL, or a sha256 content hash. Returns the signed verdict if one exists, which you can verify offl…

  • verify_attestation

    Verify a Lazaretto scan attestation that another agent (or a README, or a lockfile) handed you, WITHOUT re-scanning or paying. Free and anonymous. Returns signature validity and the signed claims, including verdict, risk and subject. For a clear or flagged SHA-256 subject only,…

  • get_free_key

    Get a free developer key for the metered tools on this server, without leaving this session. No payment, no account, no card. The key holds a small daily allowance that refills every day, and one credit is consumed per verdict, nothing on an error. Present it as the X-API-Key he…

Headers

NameDescription
X-API-Key
Optional, secret		Optional. A Lazaretto key holding scan credits, used only by the paid tools. The free tools work without it. Buy credits at https://lazaretto.dev/buy.

Details

Endpointhttps://lazaretto.dev/mcp (Streamable HTTP)
Package[email protected] (NPM, stdio)
First published3 Nov 2026
Last updated3 Nov 2026
Registry nameio.github.jamesdfinance-dev/lazaretto

More security servers See all

Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.