# io.github.jamesdfinance-dev/lazaretto (remote · lazaretto.dev)

Verify a skill, tool, or package for malicious behavior before your agent installs it. Hosted.

- Trust score: 67/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `lazaretto.dev`: 67/100 (this document), [markdown](https://verifymcp.io/servers/jamesdfinance-dev-lazaretto/lazaretto.md), [page](https://verifymcp.io/servers/jamesdfinance-dev-lazaretto/lazaretto)

## Channel facts

- Endpoint: `https://lazaretto.dev/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 3 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 72/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 493 tokens (~164/item across 3 items; 3 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http jamesdfinance-dev-lazaretto https://lazaretto.dev/mcp
```

### Codex

```toml
[mcp_servers.jamesdfinance-dev-lazaretto]
url = "https://lazaretto.dev/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "jamesdfinance-dev-lazaretto": {
      "type": "remote",
      "url": "https://lazaretto.dev/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add jamesdfinance-dev-lazaretto --url https://lazaretto.dev/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  jamesdfinance-dev-lazaretto:
    url: "https://lazaretto.dev/mcp"
```

### Other

```json
{
  "mcpServers": {
    "jamesdfinance-dev-lazaretto": {
      "type": "http",
      "url": "https://lazaretto.dev/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-01 (score 66, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 65, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 64, −2)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-29 (score 66, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-28 (score 65, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-27 (score 64, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 64)

First indexed and scored.

## MCP tools (3)

### `known_bad_lookup` (~80 tokens)

Check a SHA-256 against Lazaretto's known-bad indicator set (refreshed daily from abuse.ch). Free and anonymous. A miss only means this exact hash is not in the indicator set; it is not a clean verdict on the artifact.

Input parameters:

- `sha256` (string, required): 64 hex chars, optionally sha256: prefixed

### `check_lockfile` (~159 tokens)

Check every EXACTLY-PINNED dependency in a lockfile against published malicious-package advisories (OSV/OpenSSF). Free, anonymous, one call for the whole tree. Accepts the contents of a package-lock.json, yarn.lock, or pnpm-lock.yaml. Only exact versions can be answered: a range like ^5.0.0 has no definitive answer because a compromised release usually sits between clean ones. Fail-closed: anything that could not be checked is returned in `unverified`, so an empty `malicious` list is an all-clear only when `unverified` is empty too.

Input parameters:

- `lockfile` (string, required): The full text contents of a package-lock.json, yarn.lock, or pnpm-lock.yaml.

### `scan_artifact` (~215 tokens)

Deterministically analyze a package, repo, skill, or file for malicious behavior (credential theft, data exfiltration, obfuscation, prompt injection aimed at the agent, install scripts) and return a verdict (malicious, flagged, clear, error) with the exact evidence and a hash of what was scanned. Requires prepaid credits presented as an X-API-Key request header; consumes one credit per successful scan. Buy credits at POST https://lazaretto.dev/v1/credits/topup. For a free check, use known_bad_lookup.

Input parameters:

- `content` (string): Raw file content, required when type=inline.
- `depth` (string): lookup = known-bad match only; full = full behavioral analysis.
- `ref` (string): The locator: an npm spec (name@version), a GitHub repo URL, a ClawHub skill id, or a raw file URL. Omit for type=inline.
- `type` (string, required): What kind of artifact ref points at.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/jamesdfinance-dev-lazaretto/lazaretto#diagnostics

## Score history

- 2026-08-03: 67
- 2026-08-02: 66
- 2026-08-01: 66
- 2026-07-31: 65
- 2026-07-30: 64
- 2026-07-29: 66
- 2026-07-28: 65
- 2026-07-27: 64
- 2026-07-26: 64

## Links

- Remote endpoint: https://lazaretto.dev/mcp
- Repository: https://github.com/jamesdfinance-dev/lazaretto-mcp
- Changelog RSS feed: https://verifymcp.io/servers/jamesdfinance-dev-lazaretto/lazaretto/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/jamesdfinance-dev-lazaretto/lazaretto/changelog.json
- HTML version of this page: https://verifymcp.io/servers/jamesdfinance-dev-lazaretto/lazaretto