Every change Wellknown observed on this MCP server, newest first, with what it was before and what it became. Tool-surface changes carry the definition diff. Nothing here is edited after the fact.
Recently observed → Live
Live → Recently observed
Changed the definition of "check_mcp_tools", "scan_artifact", "scan_lockfile_deep" and 1 more
⟨83 unchanged words⟩ ,"type":"array"},"risk":{"description":"`unknown` appears only with verdict `error`: the scan did not finish, so no level is asserted. It is not a clear result.","enum":["critical","high","medium","low","none","unknown"],"type":"string"},"risk_summary": ⟨138 unchanged words⟩
⟨107 unchanged words⟩ ,"type":"object"},"risk":{"description":"`unknown` appears only with verdict `error`: the scan did not finish, so no level is asserted. It is not a clear result.","enum":["critical","high","medium","low","none","unknown"],"type":"string"},"risk_summary": ⟨55 unchanged words⟩
⟨256 unchanged words⟩ {"type":"string"},"risk":{"description":"A package that errored is listed under `errored`, not here, so a result never carries `unknown`.","enum":["critical","high","medium","low","none","unknown"],"type":"string"},"risk_summary": ⟨85 unchanged words⟩
⟨99 unchanged words⟩ ,"type":"array"},"risk":{"description":"`unknown` appears only with verdict `error`: the scan did not finish, so no level is asserted. It is not a clear result.","enum":["critical","high","medium","low","none","unknown"],"type":"string"},"risk_summary": ⟨147 unchanged words⟩
Changed the definition of "verify_attestation"
⟨16 unchanged words⟩ WITHOUT re-scanning or paying. Free and anonymous. Returnswhether thesignatureis validvalidity andLazaretto's,theattestedsigned claims,(including verdict, risk,andthesubject. For a clear or flagged SHA-256 subject only, checks theverdictcurrentis
Changed the definition of "check_lockfile", "find_mcp_servers" and "verify_attestation"
⟨106 unchanged words⟩ link:, workspace:, git:).","properties":{"count":{"type":"integer"},"reason":{"type":"string"}},"required":["count","reason"],"type":"object"},"truncated":{"description":"True when ⟨66 unchanged words⟩
⟨41 unchanged words⟩ Claude Code, its tools, and what Lazaretto'sweeklylatest read found. Only servers whose tools we read ⟨58 unchanged words⟩
Changed the definition of "check_lockfile", "check_mcp_tools", "find_attestation" and 7 more
before
—after
Lockfile malware check (free, whole tree)before
—after
Check tool definitions you already have (metered, no network)Added "find_mcp_servers"; changed the definition of "check_mcp_tools" and "scan_mcp_server" (9 tools before, 10 now)
⟨112 unchanged words⟩ you supplied.","type":"string"},"tool_fingerprint":{"description":"Hashes of what the server tells an agent: one per tool and one over all of them. Keep `sha256` when you approve a server and compare it on a later scan; a different value means its tools changed since, and the keys of `tools` whose hash differs say which. `partial` means a cap cut the read.","properties":{"instructions":{"description":"SHA-256 of the server instructions, when it sets any.","type":"string"},"partial":{"type":"boolean"},"sha256":{"type":"string"},"tools":{"additionalProperties":{"type":"string"},"description":"Tool name to SHA-256. A name that is not a plain identifier is replaced by tool-<hash>.","type":"object"}},"type":"object"},"verdict":{"enum":["clear","flagged" ⟨10 unchanged words⟩
Recently observed → Live
Live → Recently observed
Changed the definition of "scan_artifact"
Deterministically analyze a package, repo, AI model, skill, or file for malicious behavior (credential ⟨4 unchanged words⟩ prompt injection aimed at the agent, install scripts, model files that run code on load) and return a verdict (malicious, flagged, ⟨67 unchanged words⟩
⟨82 unchanged words⟩ (name==version), a GitHub repo URL, a Hugging Face model id (org/name, org/name@revision, or its huggingface.co URL), a ClawHub skill id, or a raw file URL. ⟨16 unchanged words⟩ ","raw_url","clawhub_skill","npm_package","pypi_package","huggingface_model","mcp_server","mcp_tools","inline"]," ⟨6 unchanged words⟩
Changed the definition of "find_attestation" and "verify_attestation"
⟨20 unchanged words⟩ "type":["integer","null"]},"analysis_partial":{"description":"Present and true when the attested verdict covered only part of the artifact. A clear verdict with this set is not a clean result.","type":"boolean"},"answer":{"description":"\"identity_check\" when ⟨135 unchanged words⟩
⟨26 unchanged words⟩ "properties":{"claims":{"properties":{"analysis_partial":{"description":"Present and true when part of the artifact went unread. A clear verdict with this set is not a clean result.","type":"boolean"},"iat":{"type":"integer"},"risk" ⟨89 unchanged words⟩
Recently observed → Live
Live → Recently observed
Recently observed → Live
Live → Recently observed
Changed the definition of "scan_artifact"
⟨29 unchanged words⟩ ,"full"],"type":"string"},"name":{"description":"Filename for type=inline, for example SKILL.md or index.js. Which rules run depends on the kind of file, so pass the real name when you have it; without it the kind is inferred from the content.","type":"string"},"ref":{"description":"The locator: an ⟨49 unchanged words⟩
Added "get_free_key"; changed the definition of "check_lockfile" and "find_attestation" (8 tools before, 9 now)
CheckeveryEXACTLY-PINNEDdependency in anpmlockfiledependencies against published malicious-package advisories (OSV/OpenSSF). Free, anonymous, one call for the wholetree.set.AcceptsGive EITHER `lockfile`, thecontentsfull text of a package-lock.json, yarn.lock or pnpm-lock.yaml, OR `packages`, a list of "name@version" strings, which is the one to reach for when you only care about a few dependencies orpnpm-lock.yaml.
Changed the definition of "scan_lockfile_deep"
⟨28 unchanged words⟩ for the whole tree.","properties":{"auto_reload_possible":{"description":"On an error result (batch_failed) only, present and true when the key has auto-reload switched on. \"Nothing was billed\" there means no scan credits; with this set, reserving them may have started a reload, and if it did, that pack was charged to the saved card and its credits are on the key.","type":"boolean"},"billed_credits":{"type":"integer"},"complete_coverage" ⟨63 unchanged words⟩ },"packages":{"description":"name@version ofeachevery package not scanned, in lockfileorder, at most 200.order.","items":{"type":"string"}, ⟨181 unchanged words⟩
Changed the definition of "scan_lockfile_deep"
Behaviorally scanEVERYthe exactly-pinneddependencydependencies in a lockfile, not just their identities: reads the code of each package andreportsscreens for credential theft, exfiltration, obfuscation, prompt injection and install-timedroppersdroppers.withEach result carries a verdict, a risk level, the ids of the rules that fired and a risk summary. It does not carry file-and-lineevidence.evidence: for that, run scan_artifact on the package you want to look at. This is the paid counterpart to check_lockfile, which
Verified owner set by github_owner proof on jamesdfinance-dev
Certificate recorded, valid to 2026-12-08
Authorization not required
First tool surface recorded: 8 tools (server version 1.0.0)
Showing the latest 23 events. The API returns up to 500 and filters by kind: ?kind=tool_surface_changed
⟨96 unchanged words⟩ object"},"contradicted":{"description":"Present only when apreviouslyclear or flaggedsubjectSHA-256issubject nowamatches the known-badmatchindicator set. Omitted for package identities,soalready-malicioustheclaims,attestationmissesisandstale.unavailable lookups; omission does not establish freshness or safety.","properties":{"now":{"const": ⟨41 unchanged words⟩
⟨96 unchanged words⟩ :"object"},"contradicted":{"description":"TruePresent when a previously clear or flagged subject is now a known-bad match, so the attestation is stale.","properties":{"now":{"const":"known_bad","type":"booleanstring"},"sources":{"items":{"type":"string"},"type":"array"}},"required":["now"],"type":"object"},"reason":{"description":"Why an ⟨24 unchanged words⟩
before
—after
Find an existing attestation (free)⟨90 unchanged words⟩ package identity, the answer falls back toa freean identity check against published advisories: `answer: " ⟨68 unchanged words⟩
⟨55 unchanged words⟩ " when nobody has attested the subject anda freean advisory lookup answered instead.","type":"string ⟨121 unchanged words⟩
before
—after
Find an MCP server for a job (free)before
—after
Get a free developer key (free)before
—after
Known-bad hash lookup (free)before
—after
Full behavioral scan (metered)before
—after
Deep scan a whole lockfile (metered, one credit per package)before
—after
Scan an MCP server before connecting (metered)before
—after
Verify a scan attestation (free)Find an MCP server for a job, free and with no key: describe what you need ("postgres", "send slack messages", "browser automation") and get matching servers from the official MCP registry, each with its endpoint, the command to add it to Claude Code, its tools, and what Lazaretto's weekly read found. Only servers whose tools we read with nothing matching our tool-poisoning rules, or live servers that ask you to sign in before listing tools (said plainly), are returned; servers we flagged or could not reach are left out. Remote servers only: for a local stdio server, check its tool list with …
⟨12 unchanged words⟩ yarn.lock, or pnpm-lock.yaml.","type":"string"}},"requiredpackages":{"description":"Exactly pinned packages, as \"name@version\" strings (for example [\"lockfile[email protected]\",\"[email protected]\"]). Use instead of `lockfile` when you know which dependencies you care about, so a whole tree need not pass through your context. Mutually exclusive with `lockfile`.","items":{"type":"string"},"type":"array"}},"type":"object"}
⟨7 unchanged words⟩ is an all-clear ONLY when `unverified` is alsoempty.empty AND `truncated` is false. Packages past the per-request limit appear in no list at all.","properties":{"checked":{"description": ⟨76 unchanged words⟩ ","type":"integer"},"truncated":{"description":"True when the lockfile ran past the per-request package limit. The packages past it are in neither `malicious` nor `unverified`: they were never checked. Send them as `packages` in another call.","type":"boolean"},"unverified":{"description ⟨33 unchanged words⟩
⟨76 unchanged words⟩ it only means nobody has scanned this yet. When nobody has attested an npm package identity, the answer falls back to a free identity check against published advisories: `answer: "identity_check"` with an `identity_check` object, and `found` still false, because an identity check is unsigned, looks at the identity rather than the code, and absence from the corpus is not a verdict. `identity_check.listed_as_malware: true` comes back as an error result, so a published malware version cannot be read as "nothing found"; `null` there means the corpus could not be consulted, which is unchecked and never clear.
⟨20 unchanged words⟩ "type":["integer","null"]},"answer":{"description":"\"identity_check\" when nobody has attested the subject and a free advisory lookup answered instead.","type":"string"},"attestation":{"description":"Compact JWS you can ⟨38 unchanged words⟩ not a clean verdict.","type":"boolean"},"identity_check":{"description":"The fallback answer, never an attestation. `listed_as_malware` is true (published as malware, returned as an error), false (not in the corpus, which is not a verdict on the code), or null (the corpus could not be consulted: unchecked, never clear).","type":"object"},"risk":{"type":"string"} ⟨23 unchanged words⟩
Get a free developer key for the metered tools on this server, without leaving this session. No payment, no account, no card. The key holds a small daily allowance that refills every day, and one credit is consumed per verdict, nothing on an error. Present it as the X-API-Key header on this MCP connection, or hand it to whoever configures your client. Throttled exactly as the equivalent HTTP endpoint is: one key per source per window, so calling this again shortly after will be refused rather than minting a second key. Store the key when you get it: it is shown once and cannot be recovered.
⟨8 unchanged words⟩ contents of a package-lock.json, yarn.lock, or pnpm-lock.yaml. Give this or packages.","type":"string"}},"requiredpackages":{"description":"Exactly pinned name@version strings, for example [\"lockfile[email protected]\", \"@scope/[email protected]\"]. Use it to continue a capped run with the not_scanned.packages list from the previous result. Give this or lockfile.","items":{"type":"string"},"type":"array"}},"type":"object"}
⟨56 unchanged words⟩ "description":"What was left out and why. null when nothing was.","properties":{"by_reason":{"description":"count split by cause; the three always sum to count.","properties":{"cap":{"type":"integer"},"credits":{"type":"integer"},"time":{"type":"integer"}},"type":"object"},"count":{"description":"Unique packages not scanned.","type":"integer"},"packages":{"description":"name@version of each package not scanned, in lockfile order, at most 200.","items":{"type":"string"},"type":"array"},"reasons":{"items":{"type":"string"},"type":"array"}},"type":["object","null"]},"refund_failed":{"description":"True when those credits could not be returned automatically; refund_note says what to do.","type":"boolean"},"refunded_credits":{"description":"Credits reserved for packages that were not billed (errored or not started) and were given back.","type":"integer" ⟨43 unchanged words⟩ ,"none"],"type":"string"},"risk_summary":{"description":"One line on why the risk is what it is. Run scan_artifact for file-and-line evidence.","type":"string"},"rule_ids":{"items":{"type":"string" ⟨15 unchanged words⟩ "array"},"scanned":{"type":"integer"},"ways_to_pay":{"description":"Present only when the key ran out of credits partway: how to buy credits for the rest.","type":"object"},"worst_verdict":{"properties":{"name" ⟨20 unchanged words⟩