Lazaretto is a remote MCP server that gives an AI agent 8 tools, among them check_lockfile, check_mcp_tools, find_attestation. It answers at https://lazaretto.dev/mcp over streamable HTTP, and it listed its tools to an anonymous client, so no sign-in was needed for that. Our probes reached it 6 of 6 times since 11 September 2026; the last check, on 22 October 2026, succeeded.
Free lockfile malware check plus paid behavioral scan of packages, agent skills and MCP tools.
Description as the publisher wrote it.
| Tool | What it does |
|---|---|
check_lockfile | Check every EXACTLY-PINNED dependency in a lockfile against published malicious-package advisories (OSV/OpenSSF). Free, anonymous, one call for the whole tree. Accepts the contents of a package-lock.json, yarn.lock, or pnpm-lock.yaml. Only Inputs: lockfile |
check_mcp_tools | Check tool definitions you ALREADY HOLD, with no network call to anyone. Most MCP servers run locally over stdio and have no endpoint that can be reached, so this is the only way to check them, and your client already read their tool list a Inputs: tools_json |
find_attestation | Ask whether anyone has already attested an artifact, BEFORE you install it or pay to scan it. Free and anonymous. Give a package identity like "[email protected]", an MCP server endpoint URL, or a sha256 content hash. Returns the signed verdict i Inputs: subject |
known_bad_lookup | Check a SHA-256 against Lazaretto's known-bad indicator set (refreshed daily from abuse.ch). Free and anonymous. A miss only means this exact hash is not in the indicator set; it is not a clean verdict on the artifact. Inputs: sha256 |
scan_artifact | Deterministically analyze a package, repo, skill, or file for malicious behavior (credential theft, data exfiltration, obfuscation, prompt injection aimed at the agent, install scripts) and return a verdict (malicious, flagged, clear, error Inputs: type, ref, content, depth |
scan_lockfile_deep | Behaviorally scan EVERY exactly-pinned dependency in a lockfile, not just their identities: reads the code of each package and reports credential theft, exfiltration, obfuscation, prompt injection and install-time droppers with file-and-lin Inputs: lockfile |
scan_mcp_server | Check an MCP server BEFORE you connect to it. Asks the server to introduce itself and list its tools, then analyzes the text it hands an agent: tool names, descriptions, parameter schemas and server instructions. Catches tool poisoning (hid Inputs: url |
verify_attestation | Verify a Lazaretto scan attestation that another agent (or a README, or a lockfile) handed you, WITHOUT re-scanning or paying. Free and anonymous. Returns whether the signature is valid and Lazaretto's, the attested claims (verdict, risk, a Inputs: attestation |
Every block below points at https://lazaretto.dev/mcp. Pick your client and copy.
claude mcp add --transport http lazaretto https://lazaretto.dev/mcp
{
"mcpServers": {
"lazaretto": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://lazaretto.dev/mcp"]
}
}
}{
"mcpServers": {
"lazaretto": {
"url": "https://lazaretto.dev/mcp"
}
}
}{
"servers": {
"lazaretto": {
"type": "http",
"url": "https://lazaretto.dev/mcp"
}
}
}{
"context_servers": {
"lazaretto": {
"url": "https://lazaretto.dev/mcp"
}
}
}{
"mcpServers": {
"lazaretto": {
"serverUrl": "https://lazaretto.dev/mcp"
}
}
}{
"mcpServers": {
"lazaretto": {
"url": "https://lazaretto.dev/mcp"
}
}
}name: Lazaretto
version: 0.0.1
schema: v1
mcpServers:
- name: Lazaretto
type: streamable-http
url: https://lazaretto.dev/mcp{
"mcpServers": {
"lazaretto": {
"httpUrl": "https://lazaretto.dev/mcp"
}
}
}{
"mcpServers": {
"lazaretto": {
"type": "http",
"url": "https://lazaretto.dev/mcp"
}
}
}{
"mcpServers": {
"lazaretto": {
"url": "https://lazaretto.dev/mcp"
}
}
}goose://extension?url=https%3A%2F%2Flazaretto.dev%2Fmcp&type=streamable_http&id=lazaretto&name=Lazaretto
It answered our last check on 22 October 2026 in 337 ms. Over 6 checks since 11 September 2026 it answered 6. Status here comes from Neuronto's own probes, not from the publisher.
8, as returned by the server's own tools/list on 14 September 2026: check_lockfile, check_mcp_tools, find_attestation, known_bad_lookup, scan_artifact, scan_lockfile_deep, scan_mcp_server, verify_attestation.
It answered our last check on 22 October 2026 in 337 ms. Over 6 checks since 11 September 2026 it answered 6.
Put the server under mcpServers in ~/.cursor/mcp.json with the URL https://lazaretto.dev/mcp. The exact JSON is above, with the same setup for Claude Code, Claude Desktop, VS Code, Windsurf, Zed, Gemini CLI and the rest.
It listed its tools to an anonymous client, so reading the tool list needs no key. Individual tools can still ask for credentials in their own inputs.
Publisher: io.github.jamesdfinance-dev. Endpoint host: lazaretto.dev. ARD identifier: urn:air:io.github.jamesdfinance-dev:mcp:lazaretto.
First indexed 10 September 2026. The tools are exactly what the server returned; nothing on this page
is inferred from its name. Ranking in Neuronto search is never for sale.