lazaretto

verify_attestation

Read-onlyIdempotent

Verify a Lazaretto scan attestation that another agent (or a README, or a lockfile) handed you, WITHOUT re-scanning or paying. Free and anonymous. Returns whether the signature is valid and Lazaretto's, the attested claims (verdict, risk, and the subject the verdict is about), and a contradicted flag if a previously-clear subject is now known-bad. You MUST still confirm the artifact you are about to run matches claims.sub (its sha256, or its package identity).

Input Schema

Name	Required	Description	Default
`attestation`	Yes	The compact-JWS attestation string from a scan report.

Output Schema

Name	Required	Description
`valid`	Yes	Whether the signature verifies against Lazaretto's published keys.
`claims`	No
`reason`	No	Why an invalid attestation failed, for example malformed_jws.
`contradicted`	No	True when a previously clear or flagged subject is now a known-bad match, so the attestation is stale.

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedOct 27, 2026

addedOutput schema / properties / claims / properties / analysis_partial

Added value: +{
+  "description": "Present and true when part of the artifact went unread. A clear verdict with this set is not a clean result.",
+  "type": "boolean"
+}

Changed1 schema field changedAug 30, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "description": "A valid signature proves Lazaretto issued the verdict. It does NOT prove the artifact in front of you is the one attested: check claims.sub yourself.",
+  "properties": {
+    "claims": {
+      "properties": {
+        "iat": {
+          "type": "integer"
+        },
+        "risk": {
+          "type": "string"
+        },
+        "rules_version": {
+          "type": "string"
+        },
+        "sub": {
+          "description": "The subject the verdict is about: a sha256 or a package identity. Confirm this matches what you are about to run.",
+          "type": "string"
+        },
+        "verdict": {
+          "enum": [
+            "clear",
+            "flagged",
+            "malicious"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "contradicted": {
+      "description": "True when a previously clear or flagged subject is now a known-bad match, so the attestation is stale.",
+      "type": "boolean"
+    },
+    "reason": {
+      "description": "Why an invalid attestation failed, for example malformed_jws.",
+      "type": "string"
+    },
+    "valid": {
+      "description": "Whether the signature verifies against Lazaretto's published keys.",
+      "type": "boolean"
+    }
+  },
+  "required": [
+    "valid"
+  ],
+  "type": "object"
+}

AddedAug 4, 2026

TDQS

A4.3/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (which already declare a safe, idempotent, read-only, open-world call), the description adds the cost model ('free and anonymous', no re-scan), the returned semantics (signature validity, attested claims, contradicted flag), and a critical security caveat that the agent MUST confirm the artifact matches claims.sub. That caveat is the kind of operational context annotations cannot carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose and the free/no-rescan scope are front-loaded in the first two sentences, followed by return semantics and then the caveat. Sentences are dense but each carries decision-relevant information; the final MUST-confirm sentence is long but earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need not be spelled out, and the description still summarizes them adequately, plus adds the artifact-matching requirement. The only gap is how a failed or malformed attestation is surfaced (error vs. boolean false), which an agent would want to know.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single required parameter with 100% schema description coverage ('compact-JWS attestation string'), so the schema already does the documentation work. The description does not add format or source details about where to obtain that string, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Verify a Lazaretto scan attestation') and immediately scopes it against the obvious alternative by saying it works 'WITHOUT re-scanning or paying'. An agent can distinguish it from scan_artifact and find_attestation without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear triggering condition: an attestation was handed to you by another agent, a README, or a lockfile. It also notes the free/anonymous constraint, which helps decide whether to use it versus a paid scan. It stops short of naming sibling tools like find_attestation explicitly, so the routing is implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All lazaretto tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.