What can Lazaretto do?

It exposes 9 tools: known_bad_lookup, check_lockfile, scan_artifact, scan_lockfile_deep, scan_mcp_server, check_mcp_tools, find_attestation, verify_attestation, get_free_key.

Is Lazaretto safe and reliable?

Trust score 77/100 (grade B), based on live reachability, verified publisher, maintenance, adoption, transparency and tool quality. See our methodology.

Servers / Finance & Payments

Lazaretto

io.github.jamesdfinance-dev/lazaretto

Free lockfile malware check plus paid behavioral scan of packages, agent skills and MCP tools.

Compare Website ↗Source ↗

Yes, your AI can use this right now.Answered a live MCP handshake in 511 ms with no sign-in needed and exposes 9 tools.

Connect it

Settings → Connectors → Add custom connector
URL: https://lazaretto.dev/mcp

Settings → Apps & Connectors → Advanced → Developer mode
Create connector with URL: https://lazaretto.dev/mcp

{
  "mcpServers": {
    "lazaretto": {
      "url": "https://lazaretto.dev/mcp",
      "headers": {
        "X-API-Key": "<YOUR_X_API_KEY>"
      }
    }
  }
}

claude mcp add --transport http lazaretto https://lazaretto.dev/mcp --header "X-API-Key: <value>"

{
  "servers": {
    "lazaretto": {
      "type": "http",
      "url": "https://lazaretto.dev/mcp",
      "headers": {
        "X-API-Key": "<YOUR_X_API_KEY>"
      }
    }
  }
}

{
  "mcpServers": {
    "lazaretto": {
      "command": "npx",
      "args": [
        "-y",
        "lazaretto-mcp@0.6.0"
      ],
      "env": {
        "LAZARETTO_API_KEY": "<value>"
      }
    }
  }
}

claude mcp add lazaretto -- npx -y lazaretto-mcp@0.6.0

9 tools, verified live

Pulled straight from the server with tools/list on 2026-10-17.

known_bad_lookupread-only

Check a SHA-256 against Lazaretto's known-bad indicator set (refreshed daily from abuse.ch). Free and anonymous. A miss only means this exact hash is not in the indicator set; it is not a clean verdict on the artifact.

check_lockfileread-only

Check EXACTLY-PINNED npm dependencies against published malicious-package advisories (OSV/OpenSSF). Free, anonymous, one call for the whole set. Give EITHER `lockfile`, the full text of a package-lock.json, yarn.lock or pnpm-lock.yaml, OR `packages`, a list of "name@version" strings, which is the one to reach for when you only care about a few dependencies or when an 800-package tree would not fit

scan_artifact

Deterministically analyze a package, repo, skill, or file for malicious behavior (credential theft, data exfiltration, obfuscation, prompt injection aimed at the agent, install scripts) and return a verdict (malicious, flagged, clear, error) with the exact evidence and a hash of what was scanned. Metered: present an X-API-Key holding credits. If you hold a wallet instead of an account, pay per cal

scan_lockfile_deep

Behaviorally scan the exactly-pinned dependencies in a lockfile, not just their identities: reads the code of each package and screens for credential theft, exfiltration, obfuscation, prompt injection and install-time droppers. Each result carries a verdict, a risk level, the ids of the rules that fired and a risk summary. It does not carry file-and-line evidence: for that, run scan_artifact on th

scan_mcp_server

Check an MCP server BEFORE you connect to it. Asks the server to introduce itself and list its tools, then analyzes the text it hands an agent: tool names, descriptions, parameter schemas and server instructions. Catches tool poisoning (hidden directives that point the agent at private keys or at an agent config file), parameters whose real purpose is to carry secrets or your conversation out, sta

check_mcp_tools

Check tool definitions you ALREADY HOLD, with no network call to anyone. Most MCP servers run locally over stdio and have no endpoint that can be reached, so this is the only way to check them, and your client already read their tool list at startup. Paste that JSON: a whole tools/list response, a {"tools":[...]} object, or a bare array. Analyzes the same text as scan_mcp_server and applies the sa

find_attestationread-only

Ask whether anyone has already attested an artifact, BEFORE you install it or pay to scan it. Free and anonymous. Give a package identity like "chalk@5.6.1", an MCP server endpoint URL, or a sha256 content hash. Returns the signed verdict if one exists, which you can verify offline against https://lazaretto.dev/.well-known/jwks.json, plus freshness: whether the corpus has since contradicted it and

verify_attestationread-only

Verify a Lazaretto scan attestation that another agent (or a README, or a lockfile) handed you, WITHOUT re-scanning or paying. Free and anonymous. Returns whether the signature is valid and Lazaretto's, the attested claims (verdict, risk, and the subject the verdict is about), and a `contradicted` flag if a previously-clear subject is now known-bad. You MUST still confirm the artifact you are abou

get_free_key

Get a free developer key for the metered tools on this server, without leaving this session. No payment, no account, no card. The key holds a small daily allowance that refills every day, and one credit is consumed per verdict, nothing on an error. Present it as the X-API-Key header on this MCP connection, or hand it to whoever configures your client. Throttled exactly as the equivalent HTTP endpo

Alternatives in Finance & Payments

Compare →

Lazaretto

Connect it

9 tools, verified live

Alternatives in Finance & Payments

Trade ItB

XLX402 List MCPB

Expense Budget TrackerB

AEAllRatesToday exchange rates (hosted)B

SAP MCP ServerB

TMTickDB Market DataB