Lazaretto MCP Server: Install & Setup

Install Lazaretto in Claude Code

Remote URL

Claude Code

claude mcp add --transport http lazaretto https://lazaretto.dev/mcp

mcp.json (Claude Desktop, Cursor, VS Code, Windsurf)

{
  "mcpServers": {
    "lazaretto": {
      "url": "https://lazaretto.dev/mcp"
    }
  }
}

npm

Claude Code

claude mcp add lazaretto -- npx -y lazaretto-mcp

mcp.json (Claude Desktop, Cursor, VS Code, Windsurf)

{
  "mcpServers": {
    "lazaretto": {
      "command": "npx",
      "args": [
        "-y",
        "lazaretto-mcp"
      ]
    }
  }
}

Frequently asked questions

What does the Lazaretto MCP server do?

Check lockfiles against malicious-package advisories and scan artifacts for credential theft, exfiltration, obfuscation, prompt injection and droppers.

Is the Lazaretto MCP server free?

The server is free, but you will likely need an account. The server itself is free, but it connects to a service that needs an account or API key, which may have paid tiers. Check the provider for current pricing.

Does Lazaretto run locally or remotely?

Local + Remote. Can run locally or be used as a hosted remote server.

How do I add Lazaretto to Claude Code?

Run: claude mcp add --transport http lazaretto https://lazaretto.dev/mcp

More security & identity MCP servers

View all

OPA

OrygnsCode/opa-mcp-server

OPA and Rego policy toolkit wrapping the OPA CLI and Regal: format, lint, evaluate, test and benchmark policies, manage the OPA REST API and explain decisions.

LocalAccount neededTypeScript

Job Verify

yessGlory17/job-verify

Check recruiters and job offers for scams: cross-checks company registration, domain age, look-alike domains, blocklists and crypto-scam databases.

LocalAccount neededPython

Tamperlens

0240

haruodev/tamperlens-mcp

Document forensics via the Tamperlens API: detect post-creation edits, failed redactions and embedded prompt injection in PDFs, Office files and images.

LocalAccount neededTypeScript

SDK

rohan-protocol/sdk

Stateless privacy shield, WebMCP semantic firewall, and gasless on-chain state settlement for autonomous AI agents on Midnight Network.

LocalAccount neededTypeScript

Agent Envelope

1220

BlackBoxEngineering/agent-envelope-mcp

Neutral MCP server for AgentEnvelope authority: sovereign verify + vault verify/lookup/mint.

LocalFree

Audit

P4ST4S/mcp-audit

Transparent proxy that intercepts, signs, rate-limits, redacts and audits MCP tool calls without modifying client or server.

LocalFreeGo