Add Lazaretto to your AI client

Claude

Tested: real tool call. On 2026-11-03, through a Claude connector. The one-click link is from Anthropic's docs and we have not clicked it.

1. Select Add to Claude. It opens the add dialog with the name and URL filled in. Or go to Customize, Connectors, + Add, Add custom connector, name it Lazaretto and paste https://lazaretto.dev/mcp/connector.
2. Select Continue, choose No sign in for authentication, then Add.
3. In a chat, open +, then Connectors, and turn Lazaretto on.

Ask this, and approve the tool when Claude asks: Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.

Web, Desktop and mobile. The Free plan allows one custom connector. On Team and Enterprise an Owner adds it under Organization settings, Connectors, Add, Custom, Web, and members then select Connect. Added on the web, it appears in the iOS and Android apps at next login.

Vendor docs: Anthropic: custom connectors · Anthropic: the prefill link

ChatGPT

Tested: real tool call. On 2026-11-01, in a private test of this connector. Steps re-read in OpenAI's docs on 2026-11-03.

1. Open chatgpt.com/plugins on the web. Setup is not available on mobile.
2. Select +, then Add custom MCP server. Name it Lazaretto and paste https://lazaretto.dev/mcp/connector as the server URL.
3. Set authentication to No authentication, tick I understand and want to continue, and select Create as a plugin.
4. Under your personal plugins, open Lazaretto and select + to install it.

Start a new chat, type @, pick Lazaretto, and ask: Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.

Your plan decides whether you see this. OpenAI's help page offers it on Business, Enterprise and Edu (on Business, admins and owners create it) and read and fetch tools on Pro; every tool on this connector is read-only. It does not cover Plus, Go or Free, so you may not see the option there. A listing in ChatGPT's plugin directory is coming, with no date yet. You do not need Developer Mode.

Vendor docs: OpenAI: custom MCP servers in ChatGPT · OpenAI: connect to ChatGPT

Perplexity

Read only. Not run by us. From Perplexity's help pages, which we could read only as search excerpts, checked 2026-11-03. If a label has moved, tell us at contact@lazaretto.dev.

1. Open Plugins in the sidebar, or Customize, Connectors if you do not see Plugins.
2. Select Add custom, then Add MCP connector, and Remote if it asks. Name it Lazaretto and paste https://lazaretto.dev/mcp/connector.
3. Under Advanced, set authentication to None and transport to Streamable HTTP. Tick the risk box and select Add.
4. Select the connector card to enable it.

In a new thread, switch it on under Sources, and ask: Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.

Pro, Max and Enterprise, not Free. On Enterprise an admin turns custom connectors on first, under Organization settings, Connectors. There is no one-click link. Building on Perplexity's Agent API? See the developer guide.

Vendor docs: Perplexity: custom remote connectors

Gemini

Read only. Not run by us. From Google's docs, checked 2026-11-03.

Gemini CLI

Google moved individual accounts off Gemini CLI on 2026-06-18. It still serves paid API keys and Code Assist Standard or Enterprise.

gemini mcp add --transport http --scope user lazaretto "https://lazaretto.dev/mcp?ref=gemini"

Or install the extension, which also tells the agent when to check. It sends no key, and you restart the CLI after:

gemini extensions install https://github.com/jamesdfinance-dev/lazaretto-mcp

Run /mcp to confirm it connected.

Antigravity CLI

The replacement for individual accounts. Add this to ~/.gemini/config/mcp_config.json. Google's docs do not say whether a server with no sign-in works, and we have not tried it.

{
  "mcpServers": {
    "lazaretto": {
      "serverUrl": "https://lazaretto.dev/mcp?ref=gemini"
    }
  }
}

The Gemini app

On gemini.google.com, with a personal account, in the US, 18 or over, with Keep Activity on: Settings, Connected Apps, Custom apps, Add a custom app, paste https://lazaretto.dev/mcp/connector, Next. Google's pages describe only servers with a sign-in, so it may refuse this one. Then type @ to select it.

In any of them, ask: Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.

gemini mcp add --transport http --scope user --header "X-API-Key: YOUR_KEY" lazaretto "https://lazaretto.dev/mcp?ref=gemini"

Vendor docs: Gemini CLI: MCP servers · Google: Gemini CLI to Antigravity CLI · Antigravity: MCP · Google: custom apps in Gemini

Claude Code

Tested: install and connection. On 2026-11-03, version 2.1.305: the command ran and claude mcp list showed the server connected. The prompt below was run through a Claude connector, not this CLI.

claude mcp add --transport http --scope user lazaretto "https://lazaretto.dev/mcp?ref=claude-code"

Run claude mcp list. It should show lazaretto as connected. Leave out --scope user and it is added to this project only.

Start a session, ask this, and approve the tool: Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.

Optional: lazaretto-guard is a plugin that checks install commands before they run. That page says what it sends. Install it, then restart Claude Code:

claude plugin marketplace add jamesdfinance-dev/lazaretto-plugins
claude plugin install lazaretto-guard@lazaretto-plugins

claude mcp add --transport http --scope user lazaretto "https://lazaretto.dev/mcp?ref=claude-code" --header "X-API-Key: YOUR_KEY"

{
  "mcpServers": {
    "lazaretto": {
      "type": "http",
      "url": "https://lazaretto.dev/mcp?ref=claude-code",
      "headers": { "X-API-Key": "${LAZARETTO_API_KEY}" }
    }
  }
}

Vendor docs: Claude Code: MCP

Codex

Read only. Not run by us. From OpenAI's docs and source, checked 2026-11-03.

codex mcp add lazaretto --url "https://lazaretto.dev/mcp?ref=codex"

Run codex mcp list to confirm. It may print that the server may or may not require login; this one does not. The ChatGPT desktop app and the IDE extension share this config.

Then ask: Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.

[mcp_servers.lazaretto]
url = "https://lazaretto.dev/mcp?ref=codex"
env_http_headers = { "X-API-Key" = "LAZARETTO_API_KEY" }

Vendor docs: OpenAI: MCP in Codex

Cursor

Read only. Not run by us. From Cursor's docs, checked 2026-11-03.

Select Add to Cursor and confirm in Cursor. Or add this to ~/.cursor/mcp.json for every project, or .cursor/mcp.json for one:

{
  "mcpServers": {
    "lazaretto": {
      "url": "https://lazaretto.dev/mcp?ref=cursor"
    }
  }
}

In Agent chat, ask this, and approve the tool: Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.

{
  "mcpServers": {
    "lazaretto": {
      "url": "https://lazaretto.dev/mcp?ref=cursor",
      "headers": { "X-API-Key": "${env:LAZARETTO_API_KEY}" }
    }
  }
}

Vendor docs: Cursor: MCP · Cursor: install links

VS Code

Tested: install command. On 2026-11-03, version 1.144.0: the command below wrote the right config. We have not clicked the link or run a chat in it. Both are from the VS Code docs.

Select Install in VS Code, or run:

code --add-mcp '{"name":"lazaretto","type":"http","url":"https://lazaretto.dev/mcp?ref=vscode"}'

Or search @mcp lazaretto in the Extensions view. Trust the server if VS Code asks.

Open Chat, pick Agent, check Lazaretto is on under the tools icon, and ask: Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.

{
  "inputs": [
    { "type": "promptString", "id": "lazaretto-key", "description": "Lazaretto API key", "password": true }
  ],
  "servers": {
    "lazaretto": {
      "type": "http",
      "url": "https://lazaretto.dev/mcp?ref=vscode",
      "headers": { "X-API-Key": "${input:lazaretto-key}" }
    }
  }
}

Needs GitHub Copilot. On Copilot Business and Enterprise an admin has to turn on the MCP servers policy, which is off by default.

Vendor docs: VS Code: MCP servers · VS Code: install URLs

GitHub Copilot

Read only. Not run by us. From GitHub's and Microsoft's docs, checked 2026-11-03.

In VS Code

Use the VS Code steps.

Copilot CLI

copilot mcp add --transport http lazaretto "https://lazaretto.dev/mcp?ref=copilot"

Check it with /mcp show lazaretto.

Copilot in JetBrains

In Copilot Chat, select Agent mode, the tools icon, then Add MCP Tools, and add this to mcp.json:

{
  "servers": {
    "lazaretto": {
      "url": "https://lazaretto.dev/mcp?ref=copilot"
    }
  }
}

Copilot in Xcode and Eclipse

Open Browse MCP Servers, which reads the GitHub registry, and search for lazaretto.

Copilot coding agent

Add this under the repository's Settings, Copilot, MCP servers. It runs tools with no approval, so list only the ones you want:

{
  "mcpServers": {
    "lazaretto": {
      "type": "http",
      "url": "https://lazaretto.dev/mcp?ref=copilot",
      "tools": ["check_lockfile", "find_attestation"]
    }
  }
}

Then ask: Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.

copilot mcp add --transport http --header "X-API-Key: YOUR_KEY" lazaretto "https://lazaretto.dev/mcp?ref=copilot"

Microsoft 365 Copilot has no way for a person to add a server by URL. It goes through an app manifest, or through Copilot Studio under Tools, Add a tool, New tool, Model Context Protocol.

Vendor docs: GitHub: Copilot CLI · GitHub: coding agent · GitHub: Copilot Chat

Windsurf (Devin Desktop)

Read only. Not run by us. From Devin's docs, checked 2026-11-03. They disagree on some details, and an older FAQ names a different config path. This is the path on the current CLI and desktop pages.

Windsurf became Devin Desktop in June 2026. Add this to ~/.config/devin/mcp_config.json:

{
  "mcpServers": {
    "lazaretto": {
      "url": "https://lazaretto.dev/mcp?ref=windsurf",
      "transport": "http"
    }
  }
}

Or, with the Devin CLI:

devin mcp add -s user lazaretto "https://lazaretto.dev/mcp?ref=windsurf"

Run devin mcp list to confirm.

Ask this, and approve the tool: Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.

devin mcp add -s user -H "X-API-Key: YOUR_KEY" lazaretto "https://lazaretto.dev/mcp?ref=windsurf"

Vendor docs: Devin: MCP configuration · Devin Desktop: MCP

Cline

Read only. Not run by us. From Cline's docs, checked 2026-11-03.

1. Open the MCP Servers panel, the stacked servers icon, and the Remote Servers tab.
2. Set the name to lazaretto, the URL to https://lazaretto.dev/mcp?ref=cline, and the transport to Streamable HTTP. Select Add Server.

Or with the Cline CLI:

cline mcp add lazaretto "https://lazaretto.dev/mcp?ref=cline" --transport http --yes

Ask this, and approve the tool: Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.

{
  "mcpServers": {
    "lazaretto": {
      "type": "streamableHttp",
      "url": "https://lazaretto.dev/mcp?ref=cline",
      "headers": { "X-API-Key": "YOUR_KEY" }
    }
  }
}

Vendor docs: Cline: remote servers

Zed

Read only. Not run by us. From Zed's docs, checked 2026-11-03. They say Zed may offer a sign-in when no auth header is set, and its code does that only after a 401, which this server does not send. If it asks you to sign in, tell us at contact@lazaretto.dev.

Settings, AI, MCP Servers, Add Server, Add Remote Server. Or in settings.json:

{
  "context_servers": {
    "lazaretto": {
      "url": "https://lazaretto.dev/mcp?ref=zed"
    }
  }
}

Open the Agent Panel, check for the green dot, and ask: Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.

Vendor docs: Zed: MCP

JetBrains IDEs

Read only. Not run by us. From JetBrains' docs, checked 2026-11-03.

AI Assistant

Settings, Tools, AI Assistant, Model Context Protocol (MCP), Add. Choose JSON, paste this, then OK and Apply. Your organization may have locked this setting.

{
  "mcpServers": {
    "lazaretto": {
      "url": "https://lazaretto.dev/mcp?ref=jetbrains"
    }
  }
}

Junie CLI

Add the same block to ~/.junie/mcp/mcp.json, or .junie/mcp/mcp.json for one project. Check it with /mcp.

Then ask: Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.

Vendor docs: JetBrains: AI Assistant MCP · JetBrains: Junie CLI MCP

Goose

Read only. Not run by us. From Goose's docs and source, checked 2026-11-03.

Select Add to Goose. Or run goose configure, Add Extension, Remote Extension (Streamable HTTP), and enter https://lazaretto.dev/mcp?ref=goose.

Start a new session and ask: Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.

extensions:
  lazaretto:
    name: lazaretto
    type: streamable_http
    uri: https://lazaretto.dev/mcp?ref=goose
    enabled: true
    timeout: 300
    headers:
      X-API-Key: YOUR_KEY

Goose runs tools without asking by default.

Vendor docs: Goose: using extensions

LM Studio

Read only. Not run by us. From LM Studio's docs, checked 2026-11-03.

Needs version 0.3.17 or later. Select Add to LM Studio. Or open the Program tab in the right sidebar, Install, Edit mcp.json, and add:

{
  "mcpServers": {
    "lazaretto": {
      "url": "https://lazaretto.dev/mcp?ref=lmstudio"
    }
  }
}

Load a model that supports tools, ask this, and allow the call: Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.

Vendor docs: LM Studio: MCP · LM Studio: install links

Raycast

Read only. Not run by us. From Raycast's manual, checked 2026-11-03.

Raycast for Mac only runs local servers, so this uses our npm package and needs Node 20 or newer. Select Add to Raycast. Or copy this, then open the Install Server command, which tries to fill the form from what you copied:

{
  "mcpServers": {
    "lazaretto": {
      "command": "npx",
      "args": ["-y", "lazaretto-mcp"]
    }
  }
}

In AI Chat, @-mention lazaretto and ask: Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.

Raycast's manual lists this under Pro and does not state a plan requirement.

Vendor docs: Raycast: MCP

Getting a key

You need one for the scans that read a package's code. The tool list shows which tools take one. A free developer key carries 10 scans a day: get one at /start, or ask your agent to call get_free_key on /mcp. Send it as the X-API-Key header.

Or skip the key: the connector URL, https://lazaretto.dev/mcp/connector, checks MCP servers with no key in any client.

Once it works

Tools only help if the agent reaches for them. Paste a few lines into your agent's instructions so it checks before it installs. For what each tool does, see the tool list and the connector.