The Lazaretto MCP server,
connected in one click.
Free lockfile malware check plus paid behavioral scan of packages, agent skills and MCP tools. Connect the official Lazaretto MCP server to Claude, ChatGPT, or Cursor through gate — one gateway URL, no config files, security-checked.
Free to start · No credit card · No hosting needed
Add Lazaretto to your AI in one minute
Pick your client. Copy, paste, done — or let gate handle sign-ins and policies for you.
claude mcp add --transport http lazaretto https://lazaretto.dev/mcpRun in your terminal, then restart Claude Code.
Lazaretto · https://lazaretto.dev/mcp
What your AI can do with Lazaretto
Real prompts you can type the moment it's connected — no setup, no docs to read.
“Use “known_bad_lookup”: Check a SHA-256 against Lazaretto's known-bad indicator set (refreshed daily from abuse.ch). Free and anonymous. A miss only means this exac.”
“Use “check_lockfile”: Check EXACTLY-PINNED npm dependencies against published malicious-package advisories (OSV/OpenSSF). Free, anonymous, one call for the whole.”
“Use “scan_artifact”: Deterministically analyze a package, repo, skill, or file for malicious behavior (credential theft, data exfiltration, obfuscation, prompt i.”
“Use “scan_lockfile_deep”: Behaviorally scan the exactly-pinned dependencies in a lockfile, not just their identities: reads the code of each package and screens for c.”
How secure is the Lazaretto MCP server?
Every server in the gate directory has to pass the same four checks before your AI can touch it. Here's how Lazaretto holds up.
Official endpoint
Operated by Lazaretto (lazaretto.dev) at its documented MCP endpoint — not a third-party mirror or community re-host.
No sign-in needed
This server only exposes public data — no account and no credentials are involved when you connect.
Scanned before it goes live
gate checks every tool for prompt injection, hidden instructions, data-exfiltration hints, and over-broad permissions before the server is available through your gateway.
Watched for drift
If Lazaretto adds or changes tools later, gate re-scans and alerts you — before your AI acts on the change.
Connected in three steps
Connect your gate
Add one gateway URL to Claude, ChatGPT, or any MCP client. One-time setup, about two minutes.
Pick Lazaretto
Choose Lazaretto in the gate directory. No sign-in needed.
Use it anywhere
Lazaretto's tools are live in every AI client you've connected — with rules and logging built in.
Free to start · No credit card · No hosting needed
The actual tools Lazaretto exposes
Fetched live from the official endpoint and re-checked daily by gate — not marketing copy.
known_bad_lookup — Check a SHA-256 against Lazaretto's known-bad indicator set (refreshed daily from abuse.ch). Free and anonymous. A miss only means this exac
check_lockfile — Check EXACTLY-PINNED npm dependencies against published malicious-package advisories (OSV/OpenSSF). Free, anonymous, one call for the whole
scan_artifact — Deterministically analyze a package, repo, skill, or file for malicious behavior (credential theft, data exfiltration, obfuscation, prompt i
scan_lockfile_deep — Behaviorally scan the exactly-pinned dependencies in a lockfile, not just their identities: reads the code of each package and screens for c
scan_mcp_server — Check an MCP server BEFORE you connect to it. Asks the server to introduce itself and list its tools, then analyzes the text it hands an age
check_mcp_tools — Check tool definitions you ALREADY HOLD, with no network call to anyone. Most MCP servers run locally over stdio and have no endpoint that c
find_attestation — Ask whether anyone has already attested an artifact, BEFORE you install it or pay to scan it. Free and anonymous. Give a package identity li
verify_attestation — Verify a Lazaretto scan attestation that another agent (or a README, or a lockfile) handed you, WITHOUT re-scanning or paying. Free and anon
+ 1 more tools once connected
Who runs the Lazaretto MCP server?
The Lazaretto MCP server at a glance
https://lazaretto.dev/mcpQuestions, answered
Is there an official Lazaretto MCP server?
Yes — Lazaretto operates its own remote MCP server at lazaretto.dev. gate connects you to that official endpoint and adds security scanning, per-tool access rules, and an activity log on top.
How do I connect Lazaretto to Claude or ChatGPT?
Add gate's gateway URL to your AI client once, then pick Lazaretto in the directory. No account or sign-in is needed. From then on, Lazaretto's tools are available in every client you've connected to gate.
Do I need to host anything?
No. Lazaretto runs the server, and gate is fully managed. You just connect one URL — there's nothing to install, deploy, or maintain.
Is the Lazaretto MCP server safe to connect?
It's the vendor's official endpoint, and gate scans its tools for prompt injection and hidden instructions before it goes live, re-checks it whenever it changes, and lets you allow, block, or require approval for every single tool.
Is it free?
Yes — you can get started with gate for free and connect Lazaretto in minutes. No credit card required.
Connect more than just Lazaretto
Every server below works through the same gateway URL — connect once, add tools anytime.
Squarespace DomainsDesignView →Set up Lazaretto in: Claude · Claude Code · ChatGPT · Cursor · VS Code