Behaviorally scan every pinned dependency in a lockfile (paid, one credit per package)
scan_lockfile_deepScans every pinned dependency's code in a lockfile without executing it, reporting credential theft, exfiltration, obfuscation, prompt injection, and install-time droppers.
Instructions
Behaviorally scans EVERY exactly-pinned dependency in a lockfile, not just their identities: reads the code of each package, without executing it, and reports credential theft, exfiltration, obfuscation, prompt injection and install-time droppers. This is the paid counterpart to check_lockfile, which only matches names and versions against advisories.
WHEN TO USE: before installing a tree you have not vetted. Run the free check_lockfile first, since it covers every package at once for nothing. Use scan_artifact instead for one package, or when you need the file, line and evidence behind a finding.
COST AND EFFECTS: paid, one prepaid credit per package that returns a verdict and nothing for one that errors, authenticated by the LAZARETTO_API_KEY environment variable. Without a key it sends nothing, consumes nothing and returns payment_required (buy credits at https://lazaretto.dev/buy). Reads the lockfile from the working directory itself, like check_lockfile.
LIMITS: capped at 25 packages per call, and a call that runs out of time returns what finished.
Calling again with the same lockfile rescans, and bills again, the same first packages. To get
past them, pass packages instead: the name@version of the next ones to scan. Only exactly
pinned versions can be scanned. Each result gives a verdict, risk, the ids of the rules that
fired and a one-line summary, not the full evidence.
READING THE RESULT: trust complete_coverage. false means something was capped, errored, only
partly readable, or skipped (see not_scanned and errored), so the run is NOT a clean bill
of health for the whole tree. When not_scanned.packages lists what was left, next_call
gives the next up to 25 of them to pass as packages. Gate each package on its risk, not on
verdict. A clear with analysis_partial: true is not a clean result. billed_credits and
remaining_credits show what the call cost.
Tool call template
This tool declares no required parameters. Add optional parameters from the input schema as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {},
"name": "scan_lockfile_deep"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Lockfile path relative to the working directory, e.g. "package-lock.json" or "apps/web/pnpm-lock.yaml". Omit to auto-detect package-lock.json, npm-shrinkwrap.json, yarn.lock, or pnpm-lock.yaml in the working directory. Only those filenames are read. | |
| lockfile | No | The full text contents of a package-lock.json, yarn.lock, or pnpm-lock.yaml, for when it is not on disk. Supplying this skips reading from disk. Prefer omitting it and letting the tool read the file, which keeps a large lockfile out of the context window. | |
| packages | No | Exact name@version identities to scan instead of a lockfile, at most 25, e.g. ["chalk@5.6.1", "@babel/core@7.24.0"]. Use it to continue a run: when a result lists `not_scanned.packages`, call again with the next up to 25 of them (`next_call.packages` holds the first 25). When set, `path` and `lockfile` are ignored and no lockfile is read or sent. |