Lazaretto MCP

What jamesdfinance-dev/lazaretto-mcp MCP server does

The jamesdfinance-dev/lazaretto-mcp MCP server provides pre-install verification for software packages, AI agent skills, and MCP tools. Its free lockfile workflow examines exactly pinned dependencies and compares them with published malicious-package advisories from OSV and OpenSSF. It can also check whether a SHA-256 artifact hash appears in Lazaretto's known-bad indicator store.

For deeper analysis, the server can fetch npm or PyPI packages, GitHub repositories, ClawHub skills, raw URLs, or supplied text without executing the target. The resulting verdict can be malicious, flagged, clear, or error, with evidence tied to the finding. MCP-specific checks analyze tool names, descriptions, schemas, and instructions for patterns such as tool poisoning or attempts to move secrets and conversation data.

How it works

The jamesdfinance-dev/lazaretto-mcp MCP server is a thin client for the Lazaretto API. It makes HTTPS requests and does not include the detection engine itself. Lockfile checks read files from the agent's working directory, so the complete dependency file does not need to be pasted into the model context. Supported inputs include package-lock.json, npm-shrinkwrap.json, yarn.lock, and pnpm-lock.yaml.

A lockfile result is only an all-clear when both the malicious and unverified collections are empty. Artifact results include the file, line, and evidence associated with a rule match. Scan verdicts are bound to a SHA-256 subject, and signed attestations can be checked later without rescanning or paying again. A previously clear subject may be marked contradicted if it becomes known-bad.

Setup and configuration

Use the hosted endpoint at https://lazaretto.dev/mcp with an MCP client that supports remote Streamable HTTP servers. The optional X-API-Key header identifies prepaid credits for paid operations. check_lockfile, known_bad_lookup, and verify_attestation do not require a key. Artifact and MCP scans require credits, which can be purchased as a bundle or topped up through the documented x402 endpoint.

For local stdio use, clone the repository, run npm install, and start node index.mjs with LAZARETTO_API_KEY when paid operations are needed. LAZARETTO_BASE_URL can replace the default https://lazaretto.dev API host. The package also documents npx lazaretto-mcp as a one-line launch command.

Tools and capabilities

• check_lockfile: checks pinned dependencies against malicious-package advisories.
• known_bad_lookup: matches a SHA-256 content hash against a daily-refreshed indicator store.
• verify_attestation: validates Lazaretto's signed scan attestation and returns its claims.
• scan_artifact: analyzes fetched or inline targets without running them.
• check_mcp_tools: analyzes pasted MCP tool-list JSON without contacting the server.
• scan_mcp_server: calls only initialize and tools/list on an MCP endpoint before analyzing its exposed text.

Limitations and notes

The jamesdfinance-dev/lazaretto-mcp MCP server reports signals and evidence rather than providing a security warranty. A clear result means no known-bad match or rule fired; it is not a general statement that the target is safe. For attestation verification, the artifact you plan to run must still match claims.sub. External MCP servers that run only over stdio cannot be reached by scan_mcp_server; their tool-list JSON can instead be submitted to check_mcp_tools. The MCP package is MIT licensed, while the Lazaretto service and detection engine are separate proprietary components.