# lazaretto MCP server

Verify a skill, tool, or package for malicious behavior before your agent installs it. Hosted.

## Links
- Registry page: https://www.getdrio.com/mcp/io-github-jamesdfinance-dev-lazaretto
- Repository: https://github.com/jamesdfinance-dev/lazaretto-mcp

## Install
- Endpoint: https://lazaretto.dev/mcp
- Auth: Not captured

## Setup notes
- Remote endpoint: https://lazaretto.dev/mcp

## Tools
- known_bad_lookup - Check a SHA-256 against Lazaretto's known-bad indicator set (refreshed daily from abuse.ch). Free and anonymous. A miss only means this exact hash is not in the indicator set; it is not a clean verdict on the artifact. Endpoint: https://lazaretto.dev/mcp
- check_lockfile - Check every EXACTLY-PINNED dependency in a lockfile against published malicious-package advisories (OSV/OpenSSF). Free, anonymous, one call for the whole tree. Accepts the contents of a package-lock.json, yarn.lock, or pnpm-lock.yaml. Only exact versions can be answered: a range like ^5.0.0 has no definitive answer because a compromised release usually sits between clean ones. Fail-closed: anything that could not be checked is returned in `unverified`, so an empty `malicious` list is an all-clear only when `unverified` is empty too. Endpoint: https://lazaretto.dev/mcp
- scan_artifact - Deterministically analyze a package, repo, skill, or file for malicious behavior (credential theft, data exfiltration, obfuscation, prompt injection aimed at the agent, install scripts) and return a verdict (malicious, flagged, clear, error) with the exact evidence and a hash of what was scanned. Requires prepaid credits presented as an X-API-Key request header; consumes one credit per successful scan. Buy credits at POST https://lazaretto.dev/v1/credits/topup. For a free check, use known_bad_lookup. Endpoint: https://lazaretto.dev/mcp
- verify_attestation - Verify a Lazaretto scan attestation that another agent (or a README, or a lockfile) handed you, WITHOUT re-scanning or paying. Free and anonymous. Returns whether the signature is valid and Lazaretto's, the attested claims (verdict, risk, and the subject the verdict is about), and a `contradicted` flag if a previously-clear subject is now known-bad. You MUST still confirm the artifact you are about to run matches `claims.sub` (its sha256, or its package identity). Endpoint: https://lazaretto.dev/mcp

## Resources
Not captured

## Prompts
Not captured

## Metadata
- Owner: io.github.jamesdfinance-dev
- Version: 1.0.0
- Runtime: Streamable Http
- Transports: HTTP
- License: Not captured
- Language: Not captured
- Stars: Not captured
- Updated: Jul 16, 2026
- Source: https://registry.modelcontextprotocol.io