{"x402Version":2,"resource":{"url":"https://lazaretto.dev/v1/scan","description":"Pre-install scan of an npm or PyPI package, GitHub repo, raw URL, ClawHub skill, MCP server or tool list, or inline content. Matches OSV and OpenSSF malicious-package advisories, then behavioral analysis for credential theft, exfiltration, obfuscation, prompt injection, install-time droppers and MCP tool poisoning. Returns a verdict, file-and-line evidence, a SHA-256 of the input and an Ed25519-signed attestation that verifies offline. No LLM in the scan path; a scan that errors is not charged.","mimeType":"application/json","serviceName":"Lazaretto","tags":["malware","npm","supply-chain","mcp-security","agent-skills"]},"accepts":[{"scheme":"exact","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","amount":"30000","payTo":"0x428df107e32E08288fcAC6567f4F40bc4eAB4Da0","maxTimeoutSeconds":60,"extra":{"name":"USD Coin","version":"2"}}],"extensions":{"bazaar":{"info":{"input":{"type":"http","bodyType":"json","body":{"target":{"type":"npm_package","ref":"left-pad@1.3.0"},"depth":"full"},"method":"POST"},"output":{"type":"json","example":{"verdict":"clear","confidence":"high","risk":"none","target_hash":"sha256:aa57b3ac555f3bfe2357e8a2e7ddfaa77934597887502db9ca0e660d388bf85f"}},"name":"Lazaretto pre-install scan","description":"Pre-install scan of an npm or PyPI package, GitHub repo, raw URL, ClawHub skill, MCP server or tool list, or inline content. Matches OSV and OpenSSF malicious-package advisories, then behavioral analysis for credential theft, exfiltration, obfuscation, prompt injection, install-time droppers and MCP tool poisoning. Returns a verdict, file-and-line evidence, a SHA-256 of the input and an Ed25519-signed attestation that verifies offline. No LLM in the scan path; a scan that errors is not charged."},"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"input":{"type":"object","properties":{"type":{"type":"string","const":"http"},"method":{"type":"string","enum":["POST","PUT","PATCH"]},"bodyType":{"type":"string","enum":["json","form-data","text"]},"body":{"properties":{"target":{"type":"object","properties":{"type":{"type":"string","enum":["github_repo","raw_url","clawhub_skill","npm_package","pypi_package","mcp_server","mcp_tools","huggingface_model","inline"]},"ref":{"type":"string"},"content":{"type":"string"}},"required":["type"]},"depth":{"type":"string","enum":["lookup","full"]}},"required":["target"]}},"required":["type","method","bodyType","body"],"additionalProperties":false},"output":{"type":"object","properties":{"type":{"type":"string"},"example":{"type":"object"}},"required":["type"]}},"required":["input"]}}},"name":"lazaretto","description":"Deterministic pre-install verification for npm packages, AI agent skills and MCP tools. The free lockfile check matches every exactly pinned dependency against OSV and OpenSSF malicious-package advisories with no account. A paid scan adds behavioral analysis with file-and-line evidence.","live":true,"note":"Live on base. Discovery via the CDP Bazaar (x402 v2 extensions.bazaar; cataloged on settlement)."}