--- title: "Add Lazaretto to Claude, ChatGPT, Perplexity, Cursor, VS Code and more" description: "Steps from nothing to a working tool call in each AI client, with one-click links where the client has them. No account and no key." url: "https://lazaretto.dev/add" --- [Home](https://lazaretto.dev/) / Add to your AI client Setup # Add Lazaretto to your AI client No account and no key. Pick your client, follow the steps, then ask it one question to see it work. ## Chat apps `https://lazaretto.dev/mcp/connector` Claude, ChatGPT, Perplexity and the Gemini app. Seven read-only tools, no key. ## Coding tools `https://lazaretto.dev/mcp` Everything else. Six free tools with no key, and scans that read code on a free key. Quickest, if you use Claude Code ```sh claude mcp add --transport http --scope user lazaretto "https://lazaretto.dev/mcp?ref=claude-code" ``` ## The question that proves it works Every setup below ends with this. It costs nothing and needs no key: `Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.` You should hear that **chalk@5.6.1 is listed as malware, advisory MAL-2025-46969**, and that chalk@5.3.0 is not listed. Some clients show this answer as an error. That is deliberate: a listed package comes back flagged so an agent cannot pass over it. Not listed means no advisory in the feeds we read names that version. It says nothing about the code. ## Claude **Tested: real tool call.** On 2026-11-03, through a Claude connector. The one-click link is from Anthropic's docs and we have not clicked it. [Add to Claude](https://claude.ai/customize/connectors?modal=add-custom-connector&connectorName=Lazaretto&connectorUrl=https%3A%2F%2Flazaretto.dev%2Fmcp%2Fconnector) 1. Select **Add to Claude**. It opens the add dialog with the name and URL filled in. Or go to **Customize**, **Connectors**, **+ Add**, **Add custom connector**, name it `Lazaretto` and paste `https://lazaretto.dev/mcp/connector`. 2. Select **Continue**, choose **No sign in** for authentication, then **Add**. 3. In a chat, open **+**, then **Connectors**, and turn Lazaretto on. Ask this, and approve the tool when Claude asks: `Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.` Web, Desktop and mobile. The Free plan allows one custom connector. On Team and Enterprise an Owner adds it under **Organization settings**, **Connectors**, **Add**, **Custom**, **Web**, and members then select **Connect**. Added on the web, it appears in the iOS and Android apps at next login. Vendor docs: [Anthropic: custom connectors](https://support.claude.com/en/articles/11175166-getting-started-with-custom-connectors-using-remote-mcp) · [Anthropic: the prefill link](https://claude.com/docs/connectors/custom/add-unlisted) ## ChatGPT **Tested: real tool call.** On 2026-11-01, in a private test of this connector. Steps re-read in OpenAI's docs on 2026-11-03. 1. Open [chatgpt.com/plugins](https://chatgpt.com/plugins) on the web. Setup is not available on mobile. 2. Select **+**, then **Add custom MCP server**. Name it `Lazaretto` and paste `https://lazaretto.dev/mcp/connector` as the server URL. 3. Set authentication to **No authentication**, tick **I understand and want to continue**, and select **Create as a plugin**. 4. Under your personal plugins, open Lazaretto and select **+** to install it. Start a new chat, type `@`, pick Lazaretto, and ask: `Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.` Your plan decides whether you see this. OpenAI's help page offers it on Business, Enterprise and Edu (on Business, admins and owners create it) and read and fetch tools on Pro; every tool on this connector is read-only. It does not cover Plus, Go or Free, so you may not see the option there. A listing in ChatGPT's plugin directory is coming, with no date yet. You do not need Developer Mode. Vendor docs: [OpenAI: custom MCP servers in ChatGPT](https://help.openai.com/en/articles/12584461-connecting-custom-mcp-servers-in-chatgpt) · [OpenAI: connect to ChatGPT](https://developers.openai.com/plugins/deploy/connect-chatgpt) ## Perplexity **Read only.** Not run by us. From Perplexity's help pages, which we could read only as search excerpts, checked 2026-11-03. If a label has moved, tell us at [contact@lazaretto.dev](mailto:contact@lazaretto.dev). 1. Open **Plugins** in the sidebar, or **Customize**, **Connectors** if you do not see Plugins. 2. Select **Add custom**, then **Add MCP connector**, and **Remote** if it asks. Name it `Lazaretto` and paste `https://lazaretto.dev/mcp/connector`. 3. Under **Advanced**, set authentication to **None** and transport to **Streamable HTTP**. Tick the risk box and select **Add**. 4. Select the connector card to enable it. In a new thread, switch it on under **Sources**, and ask: `Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.` Pro, Max and Enterprise, not Free. On Enterprise an admin turns custom connectors on first, under **Organization settings**, **Connectors**. There is no one-click link. Building on Perplexity's Agent API? See [the developer guide](https://lazaretto.dev/developers#sdks). Vendor docs: [Perplexity: custom remote connectors](https://www.perplexity.ai/help-center/en/articles/13915507-adding-custom-remote-connectors) ## Gemini **Read only.** Not run by us. From Google's docs, checked 2026-11-03. ### Gemini CLI Google moved individual accounts off Gemini CLI on 2026-06-18. It still serves paid API keys and Code Assist Standard or Enterprise. ```sh gemini mcp add --transport http --scope user lazaretto "https://lazaretto.dev/mcp?ref=gemini" ``` Or install the extension, which also tells the agent when to check. It sends no key, and you restart the CLI after: ```sh gemini extensions install https://github.com/jamesdfinance-dev/lazaretto-mcp ``` Run `/mcp` to confirm it connected. ### Antigravity CLI The replacement for individual accounts. Add this to `~/.gemini/config/mcp_config.json`. Google's docs do not say whether a server with no sign-in works, and we have not tried it. ```json { "mcpServers": { "lazaretto": { "serverUrl": "https://lazaretto.dev/mcp?ref=gemini" } } } ``` ### The Gemini app On [gemini.google.com](https://gemini.google.com), with a personal account, in the US, 18 or over, with Keep Activity on: **Settings**, **Connected Apps**, **Custom apps**, **Add a custom app**, paste `https://lazaretto.dev/mcp/connector`, **Next**. Google's pages describe only servers with a sign-in, so it may refuse this one. Then type `@` to select it. In any of them, ask: `Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.` **Add a key for the scans that read code** In Gemini CLI, put the key itself in the command: ```sh gemini mcp add --transport http --scope user --header "X-API-Key: YOUR_KEY" lazaretto "https://lazaretto.dev/mcp?ref=gemini" ``` Vendor docs: [Gemini CLI: MCP servers](https://geminicli.com/docs/tools/mcp-server/) · [Google: Gemini CLI to Antigravity CLI](https://developers.googleblog.com/an-important-update-transitioning-gemini-cli-to-antigravity-cli/) · [Antigravity: MCP](https://antigravity.google/docs/mcp) · [Google: custom apps in Gemini](https://support.google.com/gemini/answer/17209137) ## Claude Code **Tested: install and connection.** On 2026-11-03, version 2.1.305: the command ran and `claude mcp list` showed the server connected. The prompt below was run through a Claude connector, not this CLI. ```sh claude mcp add --transport http --scope user lazaretto "https://lazaretto.dev/mcp?ref=claude-code" ``` Run `claude mcp list`. It should show `lazaretto` as connected. Leave out `--scope user` and it is added to this project only. Start a session, ask this, and approve the tool: `Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.` Optional: [lazaretto-guard](https://lazaretto.dev/agents#guard) is a plugin that checks install commands before they run. That page says what it sends. Install it, then restart Claude Code: ```sh claude plugin marketplace add jamesdfinance-dev/lazaretto-plugins claude plugin install lazaretto-guard@lazaretto-plugins ``` **Add a key for the scans that read code** The header goes after the URL: ```sh claude mcp add --transport http --scope user lazaretto "https://lazaretto.dev/mcp?ref=claude-code" --header "X-API-Key: YOUR_KEY" ``` For a team, `--scope project` writes `.mcp.json`, which can read the key from the environment: .mcp.json ```json { "mcpServers": { "lazaretto": { "type": "http", "url": "https://lazaretto.dev/mcp?ref=claude-code", "headers": { "X-API-Key": "${LAZARETTO_API_KEY}" } } } } ``` Vendor docs: [Claude Code: MCP](https://code.claude.com/docs/en/mcp) ## Codex **Read only.** Not run by us. From OpenAI's docs and source, checked 2026-11-03. ```sh codex mcp add lazaretto --url "https://lazaretto.dev/mcp?ref=codex" ``` Run `codex mcp list` to confirm. It may print that the server may or may not require login; this one does not. The ChatGPT desktop app and the IDE extension share this config. Then ask: `Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.` **Add a key for the scans that read code** The command has no header flag. Edit `~/.codex/config.toml`; `env_http_headers` reads the key from an environment variable: ~/.codex/config.toml ```toml [mcp_servers.lazaretto] url = "https://lazaretto.dev/mcp?ref=codex" env_http_headers = { "X-API-Key" = "LAZARETTO_API_KEY" } ``` Vendor docs: [OpenAI: MCP in Codex](https://learn.chatgpt.com/docs/extend/mcp?surface=cli) ## Cursor **Read only.** Not run by us. From Cursor's docs, checked 2026-11-03. [Add to Cursor](cursor://anysphere.cursor-deeplink/mcp/install?name=lazaretto&config=eyJ1cmwiOiJodHRwczovL2xhemFyZXR0by5kZXYvbWNwP3JlZj1jdXJzb3IifQ%3D%3D) Select **Add to Cursor** and confirm in Cursor. Or add this to `~/.cursor/mcp.json` for every project, or `.cursor/mcp.json` for one: mcp.json ```json { "mcpServers": { "lazaretto": { "url": "https://lazaretto.dev/mcp?ref=cursor" } } } ``` In Agent chat, ask this, and approve the tool: `Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.` **Add a key for the scans that read code** mcp.json ```json { "mcpServers": { "lazaretto": { "url": "https://lazaretto.dev/mcp?ref=cursor", "headers": { "X-API-Key": "${env:LAZARETTO_API_KEY}" } } } } ``` On a Mac, Cursor started from the Dock may not see variables set in your shell profile. Launch it from a terminal, or put the key in the file directly. Vendor docs: [Cursor: MCP](https://cursor.com/docs/context/mcp) · [Cursor: install links](https://cursor.com/docs/context/mcp/install-links) ## VS Code **Tested: install command.** On 2026-11-03, version 1.144.0: the command below wrote the right config. We have not clicked the link or run a chat in it. Both are from the VS Code docs. [Install in VS Code](vscode:mcp/install?%7B%22name%22%3A%22lazaretto%22%2C%22type%22%3A%22http%22%2C%22url%22%3A%22https%3A%2F%2Flazaretto.dev%2Fmcp%3Fref%3Dvscode%22%7D) Select **Install in VS Code**, or run: ```sh code --add-mcp '{"name":"lazaretto","type":"http","url":"https://lazaretto.dev/mcp?ref=vscode"}' ``` Or search `@mcp lazaretto` in the Extensions view. Trust the server if VS Code asks. Open Chat, pick Agent, check Lazaretto is on under the tools icon, and ask: `Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.` **Add a key for the scans that read code** Use `.vscode/mcp.json`. The top-level key is `servers`, and VS Code prompts for the key once: .vscode/mcp.json ```json { "inputs": [ { "type": "promptString", "id": "lazaretto-key", "description": "Lazaretto API key", "password": true } ], "servers": { "lazaretto": { "type": "http", "url": "https://lazaretto.dev/mcp?ref=vscode", "headers": { "X-API-Key": "${input:lazaretto-key}" } } } } ``` Needs GitHub Copilot. On Copilot Business and Enterprise an admin has to turn on the MCP servers policy, which is off by default. Vendor docs: [VS Code: MCP servers](https://code.visualstudio.com/docs/copilot/customization/mcp-servers) · [VS Code: install URLs](https://code.visualstudio.com/api/extension-guides/ai/mcp) ## GitHub Copilot **Read only.** Not run by us. From GitHub's and Microsoft's docs, checked 2026-11-03. ### In VS Code Use the [VS Code steps](https://lazaretto.dev/add#vscode). ### Copilot CLI ```sh copilot mcp add --transport http lazaretto "https://lazaretto.dev/mcp?ref=copilot" ``` Check it with `/mcp show lazaretto`. ### Copilot in JetBrains In Copilot Chat, select Agent mode, the tools icon, then **Add MCP Tools**, and add this to `mcp.json`: mcp.json ```json { "servers": { "lazaretto": { "url": "https://lazaretto.dev/mcp?ref=copilot" } } } ``` ### Copilot in Xcode and Eclipse Open **Browse MCP Servers**, which reads the GitHub registry, and search for `lazaretto`. ### Copilot coding agent Add this under the repository's **Settings**, **Copilot**, **MCP servers**. It runs tools with no approval, so list only the ones you want: ```json { "mcpServers": { "lazaretto": { "type": "http", "url": "https://lazaretto.dev/mcp?ref=copilot", "tools": ["check_lockfile", "find_attestation"] } } } ``` Then ask: `Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.` **Add a key for the scans that read code** Copilot CLI ```sh copilot mcp add --transport http --header "X-API-Key: YOUR_KEY" lazaretto "https://lazaretto.dev/mcp?ref=copilot" ``` In the coding agent, add `"headers": { "X-API-Key": "$COPILOT_MCP_LAZARETTO_KEY" }`. The secret's name must start with `COPILOT_MCP_`. Microsoft 365 Copilot has no way for a person to add a server by URL. It goes through an app manifest, or through Copilot Studio under **Tools**, **Add a tool**, **New tool**, **Model Context Protocol**. Vendor docs: [GitHub: Copilot CLI](https://docs.github.com/en/copilot/how-tos/copilot-cli/customize-copilot/add-mcp-servers) · [GitHub: coding agent](https://docs.github.com/en/copilot/how-tos/use-copilot-agents/coding-agent/extend-coding-agent-with-mcp) · [GitHub: Copilot Chat](https://docs.github.com/en/copilot/how-tos/provide-context/use-mcp/extend-copilot-chat-with-mcp) ## Windsurf (Devin Desktop) **Read only.** Not run by us. From Devin's docs, checked 2026-11-03. They disagree on some details, and an older FAQ names a different config path. This is the path on the current CLI and desktop pages. Windsurf became Devin Desktop in June 2026. Add this to `~/.config/devin/mcp_config.json`: ```json { "mcpServers": { "lazaretto": { "url": "https://lazaretto.dev/mcp?ref=windsurf", "transport": "http" } } } ``` Or, with the Devin CLI: ```sh devin mcp add -s user lazaretto "https://lazaretto.dev/mcp?ref=windsurf" ``` Run `devin mcp list` to confirm. Ask this, and approve the tool: `Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.` **Add a key for the scans that read code** Add `"headers": { "X-API-Key": "YOUR_KEY" }` next to `url`, or pass it to the CLI: ```sh devin mcp add -s user -H "X-API-Key: YOUR_KEY" lazaretto "https://lazaretto.dev/mcp?ref=windsurf" ``` Vendor docs: [Devin: MCP configuration](https://docs.devin.ai/cli/extensibility/mcp/configuration) · [Devin Desktop: MCP](https://docs.devin.ai/desktop/cascade/mcp) ## Cline **Read only.** Not run by us. From Cline's docs, checked 2026-11-03. 1. Open the MCP Servers panel, the stacked servers icon, and the **Remote Servers** tab. 2. Set the name to `lazaretto`, the URL to `https://lazaretto.dev/mcp?ref=cline`, and the transport to **Streamable HTTP**. Select **Add Server**. Or with the Cline CLI: ```sh cline mcp add lazaretto "https://lazaretto.dev/mcp?ref=cline" --transport http --yes ``` Ask this, and approve the tool: `Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.` **Add a key for the scans that read code** Under the **Configure** tab, **Configure MCP Servers**. Keep `"type": "streamableHttp"`: without it Cline uses the legacy SSE transport, which this server does not offer. ```json { "mcpServers": { "lazaretto": { "type": "streamableHttp", "url": "https://lazaretto.dev/mcp?ref=cline", "headers": { "X-API-Key": "YOUR_KEY" } } } } ``` Vendor docs: [Cline: remote servers](https://docs.cline.bot/mcp/connecting-to-a-remote-server) ## Zed **Read only.** Not run by us. From Zed's docs, checked 2026-11-03. They say Zed may offer a sign-in when no auth header is set, and its code does that only after a 401, which this server does not send. If it asks you to sign in, tell us at [contact@lazaretto.dev](mailto:contact@lazaretto.dev). **Settings**, **AI**, **MCP Servers**, **Add Server**, **Add Remote Server**. Or in `settings.json`: settings.json ```json { "context_servers": { "lazaretto": { "url": "https://lazaretto.dev/mcp?ref=zed" } } } ``` Open the Agent Panel, check for the green dot, and ask: `Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.` **Add a key for the scans that read code** Add `"headers": { "X-API-Key": "YOUR_KEY" }` next to `url`. Vendor docs: [Zed: MCP](https://zed.dev/docs/ai/mcp) ## JetBrains IDEs **Read only.** Not run by us. From JetBrains' docs, checked 2026-11-03. ### AI Assistant **Settings**, **Tools**, **AI Assistant**, **Model Context Protocol (MCP)**, **Add**. Choose JSON, paste this, then **OK** and **Apply**. Your organization may have locked this setting. ```json { "mcpServers": { "lazaretto": { "url": "https://lazaretto.dev/mcp?ref=jetbrains" } } } ``` ### Junie CLI Add the same block to `~/.junie/mcp/mcp.json`, or `.junie/mcp/mcp.json` for one project. Check it with `/mcp`. Then ask: `Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.` **Add a key for the scans that read code** Junie CLI takes `"headers": { "X-API-Key": "YOUR_KEY" }` next to `url`. JetBrains does not document headers for AI Assistant, so use the free tools there. Vendor docs: [JetBrains: AI Assistant MCP](https://www.jetbrains.com/help/ai-assistant/mcp.html) · [JetBrains: Junie CLI MCP](https://junie.jetbrains.com/docs/junie-cli-mcp-configuration.html) ## Goose **Read only.** Not run by us. From Goose's docs and source, checked 2026-11-03. [Add to Goose](goose://extension?url=https%3A%2F%2Flazaretto.dev%2Fmcp%3Fref%3Dgoose&type=streamable_http&id=lazaretto&name=lazaretto&description=Check%20a%20package%20or%20MCP%20server%20before%20you%20install%20it&timeout=300) Select **Add to Goose**. Or run `goose configure`, **Add Extension**, **Remote Extension (Streamable HTTP)**, and enter `https://lazaretto.dev/mcp?ref=goose`. Start a new session and ask: `Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.` **Add a key for the scans that read code** ~/.config/goose/config.yaml ```yaml extensions: lazaretto: name: lazaretto type: streamable_http uri: https://lazaretto.dev/mcp?ref=goose enabled: true timeout: 300 headers: X-API-Key: YOUR_KEY ``` Goose runs tools without asking by default. Vendor docs: [Goose: using extensions](https://goose-docs.ai/docs/getting-started/using-extensions) ## LM Studio **Read only.** Not run by us. From LM Studio's docs, checked 2026-11-03. [Add to LM Studio](lmstudio://add_mcp?name=lazaretto&config=eyJ1cmwiOiJodHRwczovL2xhemFyZXR0by5kZXYvbWNwP3JlZj1sbXN0dWRpbyJ9) Needs version 0.3.17 or later. Select **Add to LM Studio**. Or open the **Program** tab in the right sidebar, **Install**, **Edit mcp.json**, and add: ~/.lmstudio/mcp.json ```json { "mcpServers": { "lazaretto": { "url": "https://lazaretto.dev/mcp?ref=lmstudio" } } } ``` Load a model that supports tools, ask this, and allow the call: `Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.` **Add a key for the scans that read code** Add `"headers": { "X-API-Key": "YOUR_KEY" }` next to `url`. Vendor docs: [LM Studio: MCP](https://lmstudio.ai/docs/app/mcp) · [LM Studio: install links](https://lmstudio.ai/docs/app/mcp/deeplink) ## Raycast **Read only.** Not run by us. From Raycast's manual, checked 2026-11-03. [Add to Raycast](raycast://mcp/install?%7B%22name%22%3A%22lazaretto%22%2C%22type%22%3A%22stdio%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22lazaretto-mcp%22%5D%7D) Raycast for Mac only runs local servers, so this uses our npm package and needs Node 20 or newer. Select **Add to Raycast**. Or copy this, then open the **Install Server** command, which tries to fill the form from what you copied: ```json { "mcpServers": { "lazaretto": { "command": "npx", "args": ["-y", "lazaretto-mcp"] } } } ``` In AI Chat, @-mention lazaretto and ask: `Use Lazaretto to check the npm packages chalk@5.6.1 and chalk@5.3.0.` **Add a key for the scans that read code** Add `"env": { "LAZARETTO_API_KEY": "YOUR_KEY" }` next to `args`. Raycast's manual lists this under Pro and does not state a plan requirement. Vendor docs: [Raycast: MCP](https://manual.raycast.com/v1/model-context-protocol) ## Getting a key You need one for the scans that read a package's code. [The tool list](https://lazaretto.dev/agents#endpoint) shows which tools take one. A free developer key carries 10 scans a day: get one at [/start](https://lazaretto.dev/start), or ask your agent to call `get_free_key` on `/mcp`. Send it as the `X-API-Key` header. Or skip the key: the connector URL, `https://lazaretto.dev/mcp/connector`, checks MCP servers with no key in any client. ## Once it works Tools only help if the agent reaches for them. [Paste a few lines into your agent's instructions](https://lazaretto.dev/agents#instructions) so it checks before it installs. For what each tool does, see [the tool list](https://lazaretto.dev/agents#endpoint) and [the connector](https://lazaretto.dev/mcp/connector). --- Machine-readable index: https://lazaretto.dev/llms.txt. OpenAPI: https://lazaretto.dev/openapi.json. MCP endpoint: https://lazaretto.dev/mcp. Any page on this site is available as markdown by adding .md to its path.