Lazaretto in Claude and ChatGPT

Ask your assistant to check an MCP server before you connect it, a tool list you already have, or the npm packages in a lockfile. Lazaretto reads them with fixed rules and answers with a verdict and the exact evidence. No account and no key.

https://lazaretto.dev/mcp/connector

Add it

Add https://lazaretto.dev/mcp/connector as a custom connector with no sign-in. In Claude that is under Customize, Connectors. In any other MCP client, add it as a Streamable HTTP server with no authentication.

Step by step: Claude, ChatGPT, Perplexity, or your client.

Things to ask

Check https://example.com/mcp before I connect it.
Here is the tool list from my local MCP server. Is anything in it trying to steer the agent?
Are any of the packages in this package-lock.json published malware?
Find me an MCP server for Postgres.
Is this SHA-256 a known malware sample?

Tools

Every tool only reads. None changes anything in your accounts or on your machine.

Tool	What it does
`known_bad_lookup`	Known-bad hash lookup
`check_lockfile`	Lockfile malware check
`scan_mcp_server`	Scan an MCP server before connecting
`check_mcp_tools`	Check MCP tool definitions
`find_mcp_servers`	Find an MCP server for a job
`find_attestation`	Find an existing attestation
`verify_attestation`	Verify a scan attestation

What a result means

A verdict says what our rules found in what we read, at the moment we read it. A clean result means no rule fired, not that a server or package is harmless. Text a result quotes from a server or package was written by its author: it is evidence, not instructions. A server that asks you to sign in before it lists its tools cannot be checked from here, and the answer says so.

Data and support

We receive what you ask the assistant to check (a server URL, a tool list, a lockfile or a hash) and never your conversation. How we handle it is in the privacy policy; the terms apply. Questions or problems: contact@lazaretto.dev.