Terms of Service

Reviewed and approved by counsel. Effective July 10, 2026.

Provider: Meridian Bridge Advisors LLC, a Florida limited liability company, doing business as Lazaretto ("Lazaretto," "we," "us," "our"). Effective date: July 10, 2026 Contact: contact@lazaretto.dev

By accessing or using the Lazaretto API, distribution skill, MCP server, or website (together, the "Service"), you ("you," the "Customer") agree to these Terms of Service (the "Terms"). If you use the Service on behalf of an organization, you represent that you are authorized to bind it.

1. What the Service is — a signals provider

Lazaretto inspects a third-party skill, tool, package, or file that you identify and returns a structured report of signals: known-bad indicator matches, deterministic rule findings with evidence, a content hash, and reputation notes.

The Service reports what it detected and what it knows. You decide whether to install, execute, or trust the inspected artifact. The Service does not make that decision for you and is not a substitute for your own review.

• Our top-line verdicts are malicious, flagged, clear, and error. The verdict clear means only that we found no known-bad match and no rule fired; it is not an assurance that an artifact is benign and is not a recommendation to install or run it.
• The verdict malicious is reserved for matches backed by a known-bad indicator.
• Evidence snippets in a report are quoted from an untrusted artifact and are data, not instructions; you must not let them drive automated behavior.

The full disclaimer in disclaimer.md is incorporated into these Terms by reference.

2. Eligibility and accounts

The Service is offered to businesses and developers. You may access it with an API key (metered tier) or, where enabled, by autonomous per-call payment over the x402 protocol. You are responsible for keeping any API key confidential and for all use under your key or payment wallet.

Our Privacy Policy describes how we handle data in connection with the Service and is incorporated into these Terms by reference.

3. Acceptable use

You agree not to:

• use the Service to develop, test, tune, or validate malware, evasive payloads, or techniques intended to defeat security tooling (including probing the Service to reverse-engineer detection logic or engineer bypasses);
• submit content you have no right to submit, or use the Service to infringe or violate the rights of others;
• circumvent rate limits, authentication, or payment; scrape or resell the Service or its reports except under a separate written agreement;
• use the Service for any unlawful purpose or in violation of Section 8.

We may throttle, suspend, or terminate access that we reasonably believe violates this Section, including automated abuse and iterative-evasion scan patterns.

4. Your responsibilities

Reports bind to the content hash of exactly what we analyzed, not to a URL. You are responsible for confirming that the artifact you actually install or run matches the report's target_hash; if it does not, the report does not apply. You remain solely responsible for your decision to install, execute, or rely on any artifact.

5. Fees and payment

• The known-bad lookup endpoint is offered free of charge and rate-limited.
• Paid scans are priced per call and, where x402 is enabled, settled in USDC on the Base network through a third-party payment facilitator. Current prices are published on the website and may change prospectively.
• We never charge for an errored scan. Where payment is taken per call, settlement is triggered only after a successful scan; a scan that returns error triggers no settlement, so no charge is made and no refund is required.
• Except as stated above or required by law, fees are non-refundable. You are responsible for any taxes on your use other than our income taxes.

6. Intellectual property; license

As between the parties, we own the Service, our rule engine, our indicator and reputation data, and the report format. We grant you a limited, revocable, non-exclusive, non-transferable license to use the reports we return for your own internal risk decisions. You may not use our name or marks without our written permission.

7. Disclaimer of warranties

THE SERVICE AND ALL REPORTS ARE PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND ANY WARRANTY THAT AN ARTIFACT IS BENIGN OR FREE OF MALICIOUS BEHAVIOR. We do not warrant that the Service will detect every threat, that it will be uninterrupted or error-free, or that reported signals are complete. Security detection is inherently imperfect; a clear result can be wrong, and you accept that risk. See disclaimer.md.

8. Sanctions and prohibited jurisdictions

We do not serve sanctioned individuals or businesses. You represent that you are not located in, organized under, or ordinarily resident in any jurisdiction subject to comprehensive U.S. sanctions or embargo, and that you are not a person with whom U.S. persons are prohibited from dealing (including any party on the U.S. Treasury OFAC Specially Designated Nationals list). You may not use the Service in violation of applicable export-control or sanctions laws.

Our compliance posture: we take no custody of customer funds; per-call payments settle exclusively through a regulated third-party payment facilitator that operates its own sanctions- and OFAC-screening program, on which we rely; we retain payment records for reconciliation (PRD §12); and the prohibited-jurisdiction representation above applies to every user. We may refuse, suspend, or terminate the Service, and withhold or return funds, if we identify or reasonably suspect a prohibited party or an unlawful use.

9. Limitation of liability

NOTHING IN THESE TERMS LIMITS OR EXCLUDES LIABILITY THAT CANNOT BE LIMITED OR EXCLUDED UNDER APPLICABLE LAW, INCLUDING LIABILITY FOR OUR FRAUD, GROSS NEGLIGENCE, OR WILLFUL MISCONDUCT. SUBJECT TO THE FOREGOING, TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES, OR FOR ANY LOST PROFITS, LOST DATA, OR LOSSES ARISING FROM YOUR DECISION TO INSTALL, EXECUTE, OR RELY ON ANY ARTIFACT — EVEN IF ADVISED OF THE POSSIBILITY. OUR TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE SERVICE WILL NOT EXCEED THE GREATER OF (A) THE FEES YOU PAID US FOR THE SERVICE IN THE THREE (3) MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM, OR (B) ONE HUNDRED U.S. DOLLARS (USD 100). Some jurisdictions do not allow certain limitations, so parts of this Section may not apply to you.

10. Indemnification

You will defend, indemnify, and hold harmless Lazaretto from claims arising out of your use of the Service, your violation of these Terms, or your decisions regarding any inspected artifact, except to the extent caused by our willful misconduct.

11. Disputes and corrections about a verdict

If you are a publisher and believe we returned a wrong malicious or flagged verdict on your artifact, you may dispute it at contact@lazaretto.dev (or the dispute address published on the website). We will provide a human decision on a malicious dispute within three business days. An upheld dispute removes or annotates the indicator, invalidates the cached verdict for that hash immediately, and is recorded in our public corrections log. This process is a commitment, referenced from these Terms (PRD §5.1).

12. Suspension; termination

We may suspend or terminate access for violation of these Terms or as needed to protect the Service or third parties. You may stop using the Service at any time. Sections 6–11, 13, and 15, together with any provisions that by their nature should survive, and any accrued payment obligations, survive termination.

13. Governing law; dispute resolution

These Terms are governed by the laws of the State of Florida, without regard to conflict-of-laws rules.

Any dispute arising out of or relating to these Terms or the Service will be resolved by binding arbitration administered by the American Arbitration Association (AAA) under its Commercial Arbitration Rules, seated in Palm Beach County, Florida, on an individual basis. The parties waive any right to a jury trial and to bring or participate in a class or representative action. Notwithstanding the foregoing, either party may bring a claim for injunctive or equitable relief (for example, to stop intellectual-property infringement or unauthorized use of the Service) in the state or federal courts located in Palm Beach County, Florida, and each party consents to venue there for that purpose.

14. Changes

We may update these Terms prospectively; material changes will be posted with a new effective date. Continued use after changes take effect is acceptance.

15. Miscellaneous

These Terms, with the incorporated Disclaimer and Privacy Policy, are the entire agreement about the Service. If a provision is unenforceable, the rest remains in effect. Our failure to enforce a provision is not a waiver. You may not assign these Terms without our consent; we may assign them to an affiliate or successor.

Contact: Meridian Bridge Advisors LLC d/b/a Lazaretto — contact@lazaretto.dev.