# jamesdfinance-dev/lazaretto-mcp [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/jamesdfinance-dev/lazaretto-mcp  
**GitHub Stars:** 0  
**Views:** 3  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/jamesdfinance-dev-lazaretto-mcp

## Description
Check whether anything you depend on is known malware, before an agent installs it. checklockfile takes a package-lock.json, yarn.lock or pnpm-lock.yaml and matches every pinned version against published malicious-package advisories in one call, free and with no API key, catching compromised releases like chalk@5.6.1 while leaving their clean releases alone. scanartifact adds deterministic behavioral analysis (no LLM in the serving path) for credential theft, exfiltration, obfuscation, prompt injection and install-time droppers, with the file, line and evidence that triggered it; verdicts are SHA-256-bound so you can re-verify what landed on disk. Paid scans settle at $0.03 USDC on Base (x402) or prepaid credits. npx lazaretto-mcp

## Tools
Capabilities this server exposes over MCP:

- **known_bad_lookup**
- **scan_artifact**

## Claude Desktop Quick Installation
Remote MCP endpoint (confidence: high). Install path detected from listing signals. Add as a URL/SSE server in your client:

```json
"mcpServers": {
  "lazaretto-mcp": {
    "url": "https://lazaretto.dev/mcp"
  }
}
```

## Documentation

## What jamesdfinance-dev/lazaretto-mcp MCP server does

The jamesdfinance-dev/lazaretto-mcp MCP server provides pre-install verification for software packages, AI agent skills, and MCP tools. Its free lockfile workflow examines exactly pinned dependencies and compares them with published malicious-package advisories from OSV and OpenSSF. It can also check whether a SHA-256 artifact hash appears in Lazaretto's known-bad indicator store.

For deeper analysis, the server can fetch npm or PyPI packages, GitHub repositories, ClawHub skills, raw URLs, or supplied text without executing the target. The resulting verdict can be `malicious`, `flagged`, `clear`, or `error`, with evidence tied to the finding. MCP-specific checks analyze tool names, descriptions, schemas, and instructions for patterns such as tool poisoning or attempts to move secrets and conversation data.

## How it works

The jamesdfinance-dev/lazaretto-mcp MCP server is a thin client for the Lazaretto API. It makes HTTPS requests and does not include the detection engine itself. Lockfile checks read files from the agent's working directory, so the complete dependency file does not need to be pasted into the model context. Supported inputs include `package-lock.json`, `npm-shrinkwrap.json`, `yarn.lock`, and `pnpm-lock.yaml`.

A lockfile result is only an all-clear when both the `malicious` and `unverified` collections are empty. Artifact results include the file, line, and evidence associated with a rule match. Scan verdicts are bound to a SHA-256 subject, and signed attestations can be checked later without rescanning or paying again. A previously clear subject may be marked `contradicted` if it becomes known-bad.

## Setup and configuration

Use the hosted endpoint at `https://lazaretto.dev/mcp` with an MCP client that supports remote Streamable HTTP servers. The optional `X-API-Key` header identifies prepaid credits for paid operations. `check_lockfile`, `known_bad_lookup`, and `verify_attestation` do not require a key. Artifact and MCP scans require credits, which can be purchased as a bundle or topped up through the documented x402 endpoint.

For local stdio use, clone the repository, run `npm install`, and start `node index.mjs` with `LAZARETTO_API_KEY` when paid operations are needed. `LAZARETTO_BASE_URL` can replace the default `https://lazaretto.dev` API host. The package also documents `npx lazaretto-mcp` as a one-line launch command.

## Tools and capabilities

- `check_lockfile`: checks pinned dependencies against malicious-package advisories.
- `known_bad_lookup`: matches a SHA-256 content hash against a daily-refreshed indicator store.
- `verify_attestation`: validates Lazaretto's signed scan attestation and returns its claims.
- `scan_artifact`: analyzes fetched or inline targets without running them.
- `check_mcp_tools`: analyzes pasted MCP tool-list JSON without contacting the server.
- `scan_mcp_server`: calls only `initialize` and `tools/list` on an MCP endpoint before analyzing its exposed text.

## Limitations and notes

The jamesdfinance-dev/lazaretto-mcp MCP server reports signals and evidence rather than providing a security warranty. A `clear` result means no known-bad match or rule fired; it is not a general statement that the target is safe. For attestation verification, the artifact you plan to run must still match `claims.sub`. External MCP servers that run only over stdio cannot be reached by `scan_mcp_server`; their tool-list JSON can instead be submitted to `check_mcp_tools`. The MCP package is MIT licensed, while the Lazaretto service and detection engine are separate proprietary components.

_Full upstream README: https://allmcps.com/mcp/jamesdfinance-dev-lazaretto-mcp/readme_