Lazaretto

Pre-install verification for npm packages, agent skills, and MCP tools. A free lockfile check (no API key) matches every exactly pinned dependency in `package-lock.json`, `yarn.lock`, or `pnpm-lock.yaml` against OSV and OpenSSF malicious-package advisories; a paid scan adds deterministic behavioral analysis (credential theft, exfiltration, obfuscation, prompt injection, install-time droppers) with file and line evidence. No LLM in the scan path, so verdicts are reproducible.

Project

Browse this MCP server in the TensorBlock MCP Index.