Side-by-side comparison of two Model Context Protocol servers — install paths, tools, quality signals, and directory engagement so you can pick the right one for Claude, Cursor, and other MCP clients.
Check whether anything you depend on is known malware, before an agent installs it. checklockfile takes a package-lock.json, yarn.lock or pnpm-lock.yaml and matches every pinned version against published malicious-package advisories in one call, free and with no API key, catching compromised releases like chalk@5.6.1 while leaving their clean releases alone. scanartifact adds deterministic behavioral analysis (no LLM in the serving path) for credential theft, exfiltration, obfuscation, prompt injection and install-time droppers, with the file, line and evidence that triggered it; verdicts are SHA-256-bound so you can re-verify what landed on disk. Paid scans settle at $0.03 USDC on Base (x402) or prepaid credits. npx lazaretto-mcp
Pre-install guardian for npm packages with static code analysis, supply-chain attack detection, vulnerability audit (npm + GitHub Advisory Database), AI hallucination guard, and CycloneDX 1.6 SBOM generation with VEX. 28 MCP tools. Zero runtime dependencies — the SBOM serializer is implemented natively against the public CycloneDX schema.
Quality signal
51/100 (Fair)
53/100 (Fair)
Install path
Remote · high
npx · high
Engagement
0 0 0 0
1 0 0 15
Tools
known_bad_lookupscan_artifact
Pre-install package guardian with allow/warn/block decisionsStatic code analysis and vulnerability audit using npm and GitHub advisoriesAI hallucination guard to detect typosquats and fake packagesRemediation planner grouping vulnerabilities by dependency parentsCycloneDX 1.6 SBOM generation with VEX supportSARIF v2.1.0 output compatible with GitHub Code Scanning
