jamesdfinance-dev/lazaretto-mcp

Know what a package does before you install it.
An MCP server for Lazaretto: deterministic
pre-install verification for npm packages, AI agent skills and MCP tools. The
free lockfile check matches every exactly pinned dependency against OSV and
OpenSSF malicious-package advisories with no account. A paid scan adds
behavioral analysis with file-and-line evidence.
This package is a thin front end for the Lazaretto
API. It ships no detection logic and does nothing but make HTTPS requests, so
it is easy to audit.
Try it in one line, nothing installed
Check every exactly pinned dependency in your project against published
malicious-package advisories. No account, no key, no install:
Works with package-lock.json, npm-shrinkwrap.json, yarn.lock or
pnpm-lock.yaml. We keep no copy of your lockfile.
Tools
check_lockfile (free, no API key)
Checks every exactly-pinned dependency in your lockfile against published
malicious-package advisories. Reads package-lock.json, yarn.lock, or
pnpm-lock.yaml from the working directory, so the agent never has to paste a
lockfile through its context. One call covers the whole tree.
An empty malicious list is an all-clear only when unverified is also empty.
- **known_bad_lookup**: free, no key. Is a sha256 content hash a known-bad
artifact? Exact-hash match against an indicator store refreshed daily.
- **find_attestation**: free, no key. Has anyone already attested this
artifact? Give a package identity like chalk@5.6.1, an MCP server URL, or a
sha256 content hash, and get the signed verdict if one exists, with its age,
whether it was made under an older rules version, and contradicted if the
subject is now known-bad. A miss means no attestation is on record for this
subject. It is not a verdict either way.
- **verify_attestation**: free, no key. A scan verdict ships with a signed
attestation (compact JWS). Hand this tool one that another agent, a README, or
a lockfile gave you: it confirms the signature is Lazaretto's, returns the
attested claims, and flags contradicted if a once-clear subject is now
known-bad, so a verdict can be trusted without re-scanning or re-paying. Still
confirm the artifact you will run matches claims.sub.
- **scan_artifact**: fetches a target (npm or PyPI package, GitHub repo,
ClawHub skill, raw URL, or inline text) without running it and returns a
deterministic verdict (malicious, flagged, clear, error) with
evidence. A full scan needs prepaid credits: the X-API-Key header on the
hosted server, or LAZARETTO_API_KEY for the stdio package. Buy them at
https://lazaretto.dev/buy.
- **scan_lockfile_deep**: paid, one credit per package that returns a
verdict. The behavioral counterpart to check_lockfile: reads the code of
every exactly pinned dependency, up to 25 per call, instead of only matching
names and versions. Trust complete_coverage: false means something was
capped, errored or only partly read, so the run is not a clean bill of health
for the tree. Calling again with the same lockfile rescans, and bills again,
the same first packages. The result lists every package it left in
not_scanned.packages, as name@version strings. To continue a run, pass