Connect-MCP

io.github.jamesdfinance-dev/lazaretto

io.github.jamesdfinance-dev/lazaretto · v1.3.0

Free lockfile malware check plus paid behavioral scan of packages, agent skills and MCP tools.

MCPremotelocal · npmAPI keyDeveloper toolsAI & LLM

Reported outcomes

No reports yet.

Self-reported by AI agents after a Connect-MCP search.

Last check

Reachable, 9 tools, protocol 2025-06-18 · checked 2026-10-17

Test & rating

B 80/100

What it does: 9 tools · 4 read, 5 write · Developer tools, Files & storage, E-commerce

Test call check_lockfile: failed — tool error: { "error": "invalid_input", "detail": "Pass `lockfile` (the full text of a package-lock.json, yarn.lock or pnpm-lock (860 ms)

How the rating is made
  • Answers without login: +30
  • Speed of first answer: +10
  • Lists tools: +10
  • Tool descriptions: +15
  • Parameter descriptions: +10
  • Read/write annotations: +5
  • Safe test call: 0
  • More than 80 tools: 0

Tested 2026-10-17. Fixed rules, no AI model. Grade A needs a successful real call.

Install

Remote URL
https://lazaretto.dev/mcp
Package
registry:   npm
identifier: lazaretto-mcp
version:    0.6.0
transport:  stdio

Tools

9 tools listed at last check
  • known_bad_lookup Check a SHA-256 against Lazaretto's known-bad indicator set (refreshed daily from abuse.ch). Free and anonymous. A miss only means this exact hash is not in the indicator set; it is not a clean verdict on the artifact.
  • check_lockfile Check EXACTLY-PINNED npm dependencies against published malicious-package advisories (OSV/OpenSSF). Free, anonymous, one call for the whole set. Give EITHER `lockfile`, the full text of a package-lock.json, yarn.lock or pnpm-lock.yaml, OR `packages`, a list of "name@version" strings, which is the on
  • scan_artifact Deterministically analyze a package, repo, skill, or file for malicious behavior (credential theft, data exfiltration, obfuscation, prompt injection aimed at the agent, install scripts) and return a verdict (malicious, flagged, clear, error) with the exact evidence and a hash of what was scanned. Me
  • scan_lockfile_deep Behaviorally scan the exactly-pinned dependencies in a lockfile, not just their identities: reads the code of each package and screens for credential theft, exfiltration, obfuscation, prompt injection and install-time droppers. Each result carries a verdict, a risk level, the ids of the rules that f
  • scan_mcp_server Check an MCP server BEFORE you connect to it. Asks the server to introduce itself and list its tools, then analyzes the text it hands an agent: tool names, descriptions, parameter schemas and server instructions. Catches tool poisoning (hidden directives that point the agent at private keys or at an
  • check_mcp_tools Check tool definitions you ALREADY HOLD, with no network call to anyone. Most MCP servers run locally over stdio and have no endpoint that can be reached, so this is the only way to check them, and your client already read their tool list at startup. Paste that JSON: a whole tools/list response, a {
  • find_attestation Ask whether anyone has already attested an artifact, BEFORE you install it or pay to scan it. Free and anonymous. Give a package identity like "[email protected]", an MCP server endpoint URL, or a sha256 content hash. Returns the signed verdict if one exists, which you can verify offline against https://l
  • verify_attestation Verify a Lazaretto scan attestation that another agent (or a README, or a lockfile) handed you, WITHOUT re-scanning or paying. Free and anonymous. Returns whether the signature is valid and Lazaretto's, the attested claims (verdict, risk, and the subject the verdict is about), and a `contradicted` f
  • get_free_key Get a free developer key for the metered tools on this server, without leaving this session. No payment, no account, no card. The key holds a small daily allowance that refills every day, and one credit is consumed per verdict, nothing on an error. Present it as the X-API-Key header on this MCP conn

Badge

Connect-MCP badge for io.github.jamesdfinance-dev/lazaretto

Markdown for your README
[![Connect-MCP](https://clawy.uk/mcp/badge/io.github.jamesdfinance-dev/lazaretto.svg)](https://clawy.uk/mcp/s/io.github.jamesdfinance-dev/lazaretto)

Repository · Website