The Lazaretto MCP server

This URL is the server. It speaks MCP over Streamable HTTP, so the protocol traffic is a JSON-RPC POST to this same address. There is no server-initiated event stream and no server-side session, so a GET gets this page and a DELETE does nothing. You are reading it because you opened the endpoint rather than connected to it.

https://lazaretto.dev/mcp

Connect

Add it to any MCP-capable client. Nothing to install, no local process:

{
  "mcpServers": {
    "lazaretto": {
      "type": "http",
      "url": "https://lazaretto.dev/mcp"
    }
  }
}

That is enough for every free tool below. For the metered ones, add a key:

{
  "mcpServers": {
    "lazaretto": {
      "type": "http",
      "url": "https://lazaretto.dev/mcp",
    "headers": { "X-API-Key": "your-key" }
    }
  }
}

A free developer key with 10 scans a day comes from POST https://lazaretto.dev/v1/trial, or from the get_free_key tool on this server, so an agent can get one without leaving the session. Agents holding a wallet can pay per call in USDC on Base over x402 at POST https://lazaretto.dev/v1/scan, with no account.

A person without a crypto wallet can buy the same packs with a card at https://lazaretto.dev/buy.

Setup steps for Claude Code, Cursor, VS Code and more

Tools

Free, no key

Tool	Cost	What it does
`known_bad_lookup`	free, no key	Known-bad hash lookup
`check_lockfile`	free, no key	Lockfile malware check
`find_attestation`	free, no key	Find an existing attestation
`verify_attestation`	free, no key	Verify a scan attestation
`get_free_key`	free, no key	Get a free developer key

Metered, on an `X-API-Key` holding credits

Tool	Cost	What it does
`scan_artifact`	one credit	Full behavioral scan
`scan_lockfile_deep`	one credit	Deep scan a whole lockfile
`scan_mcp_server`	one credit	Scan an MCP server before connecting
`check_mcp_tools`	one credit	Check tool definitions you already have

One credit per verdict, and per package for the lockfile scan. An error verdict is never billed.

Check it from a terminal

curl -s -X POST https://lazaretto.dev/mcp \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Machine contract: /openapi.json · /llms.txt · API reference · server card: /.well-known/mcp/server-card.json