{"x402Version":2,"resource":{"url":"https://lazaretto.dev/v1/scan","description":"Deterministic pre-install verification for npm packages, AI agent skills and MCP tools. Matches the exact version against OSV and OpenSSF malicious-package advisories, then runs behavioral analysis for credential theft, exfiltration, obfuscation, prompt injection and install-time droppers, returning a verdict with file-and-line evidence, a SHA-256 of what was analyzed, and a signed attestation that verifies offline. No LLM in the scan path, so the same input yields the same verdict.","mimeType":"application/json"},"accepts":[{"scheme":"exact","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","amount":"30000","payTo":"0x428df107e32E08288fcAC6567f4F40bc4eAB4Da0","maxTimeoutSeconds":60,"extra":{"name":"USD Coin","version":"2"}}],"extensions":{"bazaar":{"info":{"input":{"type":"http","bodyType":"json","body":{"target":{"type":"npm_package","ref":"left-pad@1.3.0"},"depth":"full"},"method":"POST"},"output":{"type":"json","example":{"verdict":"clear","confidence":"high","risk":"none","target_hash":"sha256:aa57b3ac555f3bfe2357e8a2e7ddfaa77934597887502db9ca0e660d388bf85f"}},"name":"Lazaretto pre-install scan","description":"Deterministic pre-install verification for npm packages, AI agent skills and MCP tools. Matches the exact version against OSV and OpenSSF malicious-package advisories, then runs behavioral analysis for credential theft, exfiltration, obfuscation, prompt injection and install-time droppers, returning a verdict with file-and-line evidence, a SHA-256 of what was analyzed, and a signed attestation that verifies offline. No LLM in the scan path, so the same input yields the same verdict."},"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"input":{"type":"object","properties":{"type":{"type":"string","const":"http"},"method":{"type":"string","enum":["POST","PUT","PATCH"]},"bodyType":{"type":"string","enum":["json","form-data","text"]},"body":{"properties":{"target":{"type":"object","properties":{"type":{"type":"string","enum":["inline","raw_url","npm_package","github_repo","clawhub_skill"]},"ref":{"type":"string"},"content":{"type":"string"}},"required":["type"]},"depth":{"type":"string","enum":["lookup","full"]}},"required":["target"]}},"required":["type","method","bodyType","body"],"additionalProperties":false},"output":{"type":"object","properties":{"type":{"type":"string"},"example":{"type":"object"}},"required":["type"]}},"required":["input"]}}},"name":"lazaretto","description":"Deterministic pre-install verification for npm packages, AI agent skills and MCP tools. The free lockfile check matches every exactly pinned dependency against OSV and OpenSSF malicious-package advisories with no account. A paid scan adds behavioral analysis with file-and-line evidence.","live":true,"note":"Live on base. Discovery via the CDP Bazaar (x402 v2 extensions.bazaar; cataloged on settlement)."}