lazaretto

find_attestation

Read-onlyIdempotent

Ask whether anyone has already attested an artifact, BEFORE you install it or pay to scan it. Free and anonymous. Give a package identity like "chalk@5.6.1", an MCP server endpoint URL, or a sha256 content hash. Returns the signed verdict if one exists, which you can verify offline against https://lazaretto.dev/.well-known/jwks.json, plus freshness: whether the corpus has since contradicted it and whether it was attested under an older rules version. A miss is not a verdict, it only means nobody has scanned this yet. When nobody has attested an npm package identity, the answer falls back to a free identity check against published advisories: answer: "identity_check" with an identity_check object, and found still false, because an identity check is unsigned, looks at the identity rather than the code, and absence from the corpus is not a verdict. identity_check.listed_as_malware: true comes back as an error result, so a published malware version cannot be read as "nothing found"; null there means the corpus could not be consulted, which is unchecked and never clear.

Input Schema

Name	Required	Description	Default
`subject`	Yes	A package identity ("chalk@5.6.1"), an MCP server endpoint URL, or a sha256 content hash, optionally sha256: prefixed.

Output Schema

Name	Required	Description
`risk`	No
`found`	Yes	False means nobody has attested it, which is not a clean verdict.
`answer`	No	"identity_check" when nobody has attested the subject and a free advisory lookup answered instead.
`verdict`	No
`age_days`	No
`attestation`	No	Compact JWS you can verify offline; it carries the verdict, never the evidence.
`attested_at`	No
`stale_rules`	No	True when attested under an older rules version.
`contradicted`	No	Non-null when this subject is NOW a known-bad match.
`identity_check`	No	The fallback answer, never an attestation. `listed_as_malware` is true (published as malware, returned as an error), false (not in the corpus, which is not a verdict on the code), or null (the corpus could not be consulted: unchecked, never clear).
`analysis_partial`	No	Present and true when the attested verdict covered only part of the artifact. A clear verdict with this set is not a clean result.

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedOct 27, 2026

addedOutput schema / properties / analysis_partial

Added value: +{
+  "description": "Present and true when the attested verdict covered only part of the artifact. A clear verdict with this set is not a clean result.",
+  "type": "boolean"
+}

Changed2 schema fields changedSep 22, 2026

addedOutput schema / properties / answer

Added value: +{
+  "description": "\"identity_check\" when nobody has attested the subject and a free advisory lookup answered instead.",
+  "type": "string"
+}

addedOutput schema / properties / identity_check

Added value: +{
+  "description": "The fallback answer, never an attestation. `listed_as_malware` is true (published as malware, returned as an error), false (not in the corpus, which is not a verdict on the code), or null (the corpus could not be consulted: unchecked, never clear).",
+  "type": "object"
+}

Changed1 schema field changedAug 31, 2026

changedInput schema / properties / subject / description

Previous value: -"A package identity (\"chalk@5.6.1\") or a sha256 content hash, optionally sha256: prefixed."New value: +"A package identity (\"chalk@5.6.1\"), an MCP server endpoint URL, or a sha256 content hash, optionally sha256: prefixed."

AddedAug 30, 2026

TDQS

A4.1/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the readOnly/idempotent annotations: free and anonymous, signed verdicts verifiable offline against a JWKS URL, freshness/contradiction reporting, and the rules-version caveat. It also discloses the fallback identity_check path, the semantics of found=false, and the important edge case where listed_as_malware=true is returned as an error and null means unchecked.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and timing constraint are front-loaded in the first sentence, and the remaining detail is high-value edge-case guidance rather than filler. It is dense and unsectioned, which slightly hurts scanability, but nearly every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given an output schema exists, the description need not document return shape, yet it still explains the semantically tricky fields (found, identity_check, listed_as_malware). Combined with the offline verification path and the miss-is-not-a-verdict rule, an agent has everything needed to call and interpret this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the description's examples (package identity, MCP endpoint URL, sha256 hash with optional prefix) largely restate the schema's own definition. The schema already carries the parameter meaning, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: asking whether an artifact has already been attested, with a clear pre-install/pre-scan framing. The purpose is unmistakable, though it never names the adjacent sibling verify_attestation, so the find-vs-verify boundary is left implicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says to call this BEFORE installing or paying to scan, which routes the agent away from scan_artifact in the expensive case. It also warns that a miss is not a verdict, but it does not explicitly say when to prefer verify_attestation or the lockfile siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All lazaretto tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.