Lazaretto MCP Server

Verify a skill, tool, or package for malicious behavior before your agent installs it. Hosted.

Remote serverstreamable-http

What is the Lazaretto MCP server?

If you already use Lazaretto, the lazaretto mcp server is the piece that lets your assistant work with it directly. Verify a skill, tool, or package for malicious behavior before your agent installs it. Hosted.

What the server does

Checks every exactly-pinned dependency in your lockfile against published malicious-package advisories. Reads package-lock.json, yarn.lock, or pnpm-lock.yaml from the working directory, so the agent never has to paste a lockfile through its context. One call covers the whole tree.

Credentials and setup notes

Configuration is passed through the environment: LAZARETTO_API_KEY, LAZARETTO_BASE_URL. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.

Installation

Because this one is hosted, setup is mostly authentication — you point your client at the endpoint and approve access. Nothing runs on your machine, so there is no runtime to keep patched.

Where it fits

This sits in the developer tooling group, where several servers overlap in what they claim to do but differ sharply once you actually set them up. It is maintained by jamesdfinance-dev; worth a glance at recent repository activity before you build anything load-bearing on it.

This entry was verified against Lazaretto's own documentation before publication; SyncDev keeps the directory reviewed rather than auto-generated.

Worth knowing first

  • Your data travels to the provider's service, so the usual questions apply about what you send and what they retain.
  • Missing credentials fail quietly in some clients — if no tools show up, check the environment block first.
  • Keep per-call confirmation enabled while you learn its behaviour; it is the cheapest safeguard you have.

How to install the Lazaretto MCP server

{
  "mcpServers": {
    "lazaretto": {
      "url": "https://lazaretto.dev/mcp",
      "headers": {
        "X-API-Key": "your-prepaid-key (optional; known_bad_lookup is free)"
      }
    }
  }
}

Configuration as documented by the project. Restart the client after saving.

Configuration

VariableDescriptionRequired
LAZARETTO_API_KEYCredential the server authenticates with.Yes
LAZARETTO_BASE_URLEndpoint or connection string the server talks to.Yes

Frequently asked questions

It connects Lazaretto to MCP-compatible AI assistants such as Claude and Cursor. Instead of copying data back and forth by hand, the assistant works with Lazaretto directly.