bots.st/lazaretto
Lazaretto
Check pinned dependencies and artifacts for malware
1978 ms
answered our call
- State
- Answered
- Protocol
- MCP 2025-06-18
- Tools listed
- 10
- Answered
- 3 of the last 3 calls
How to reach it
- MCP, HTTP
https://lazaretto.dev/mcp - npm
npx -y lazaretto-mcpReleased 3 Nov 2026, version 0.6.6
What it can do
| Tool | What it says it does |
|---|---|
check_lockfile | Check EXACTLY-PINNED npm dependencies against published malicious-package advisories (OSV/OpenSSF). Free, anonymous, one call for the whole set. Give EITHER `lockfile`, the full text of a package-lock.json, yarn.lock or pnpm-lock.yaml, OR `packages`, a list of "name@version" strings, which is the… |
check_mcp_tools | Check tool definitions you ALREADY HOLD, with no network call to anyone. Most MCP servers run locally over stdio and have no endpoint that can be reached, so this is the only way to check them, and your client already read their tool list at startup. Paste that JSON: a whole tools/list response, a… |
find_attestation | Ask whether anyone has already attested an artifact, BEFORE you install it or pay to scan it. Free and anonymous. Give a package identity like "chalk@5.6.1", an MCP server endpoint URL, or a sha256 content hash. Returns the signed verdict if one exists, which you can verify offline against… |
find_mcp_servers | Find an MCP server for a job, free and with no key: describe what you need ("postgres", "send slack messages", "browser automation") and get matching servers from the official MCP registry, each with its endpoint, the command to add it to Claude Code, its tools, and what Lazaretto's latest read… |
get_free_key | Get a free developer key for the metered tools on this server, without leaving this session. No payment, no account, no card. The key holds a small daily allowance that refills every day, and one credit is consumed per verdict, nothing on an error. Present it as the X-API-Key header on this MCP… |
known_bad_lookup | Check a SHA-256 against Lazaretto's known-bad indicator set (refreshed daily from abuse.ch). Free and anonymous. A miss only means this exact hash is not in the indicator set; it is not a clean verdict on the artifact. |
scan_artifact | Deterministically analyze a package, repo, AI model, skill, or file for malicious behavior (credential theft, data exfiltration, obfuscation, prompt injection aimed at the agent, install scripts, model files that run code on load) and return a verdict (malicious, flagged, clear, error) with the… |
scan_lockfile_deep | Behaviorally scan the exactly-pinned dependencies in a lockfile, not just their identities: reads the code of each package and screens for credential theft, exfiltration, obfuscation, prompt injection and install-time droppers. Each result carries a verdict, a risk level, the ids of the rules that… |
scan_mcp_server | Check an MCP server BEFORE you connect to it. Asks the server to introduce itself and list its tools, then analyzes the text it hands an agent: tool names, descriptions, parameter schemas and server instructions. Catches tool poisoning (hidden directives that point the agent at private keys or at… |
verify_attestation | Verify a Lazaretto scan attestation that another agent (or a README, or a lockfile) handed you, WITHOUT re-scanning or paying. Free and anonymous. Returns signature validity and the signed claims, including verdict, risk and subject. For a clear or flagged SHA-256 subject only, checks the current… |
In its maker's words
Supply chain security: free npm lockfile malware check, paid scan of packages, skills, MCP servers.
- Website
- lazaretto.ai
- Source
- github.com/jamesdfinance-dev/lazaretto-mcp
- Publisher
- jamesdfinance-dev
- Listed from
- the official MCP Registry as
io.github.jamesdfinance-dev/lazaretto - Version
- 1.3.6, updated 3 Nov 2026
- Kinds of work
- Security and trust, Code and developer tools, AI models and agent tools
The domain it lives on
- lazaretto.dev
- registered 10 Jul 2026 (4 months ago), at CloudFlare, Inc., its name does not resolve now
- lazaretto.ai
- registered 28 Sep 2026 (1 month ago), at GoDaddy.com, LLC, its home page is a working site
From our own crawl of domain names: registry records and the home page as our crawler last saw it.
Every call we made
| When | What happened | Time |
|---|---|---|
| Answered | 1978 ms | |
| Answered | 2772 ms | |
| Answered | 783 ms |
Next door
- paidforAssess an x402 seller before payment
- WhisperDNS-verifiable agent networking and control
- EchelonGraph CVE & ExposureCVE and internet exposure lookups
- RevClamp MCP ServerAudits payments, disputes, and VAT compliance
- APIEmpresas: Spanish company dataKYB checks using CIF, directors, sanctions, tenders, BORME
Is this your bot? Claim its address to add a verified badge and keep the listing current.