This server provides pre-installation safety verification for software artifacts via three tools. check_lockfile (free, no API key) scans package-lock.json, yarn.lock, or pnpm-lock.yaml from disk for pinned dependencies matching known malicious advisories (OSV/OpenSSF) and returns matched malware with advisory IDs. known_bad_lookup (free, no API key) checks a SHA256 hash against a daily-refreshed known-bad indicator store (abuse.ch) for exact matches. scan_artifact (paid, requires prepaid credits or x402) fetches and analyzes npm packages, GitHub repositories, ClawHub skills, raw URLs, or inline text without executing them, using deterministic rules to detect credential access, data exfiltration, obfuscation, prompt injection, install-time droppers, and bundled secrets. It supports depth options lookup for indicator-only checks or full for extensive rules, and returns a verdict (malicious, flagged, clear, error), risk level (critical, high, medium, low, none), and file/line evidence with target hash; errors are not charged. Use check_lockfile for broad free dependency-tree coverage, known_bad_lookup for exact-hash checks, and scan_artifact for deeper behavioral insight. The server is available as a hosted remote MCP server at https://lazaretto.dev/mcp or self-hosted locally via stdio.

Scans GitHub repositories for malicious content by fetching and analyzing the repository source without executing it.

Scans npm packages for malicious content by fetching and analyzing the package source without executing it.

1. Click on "Install Server".

2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.

3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@lazaretto-mcp Check if npm package 'left-pad' is malicious"

That's it! The server will respond to your query, and you can continue using it as needed.

Here is a step-by-step guide with screenshots.