scan_mcp_server

io.github.jamesdfinance-dev/lazaretto · Verify this server

Check an MCP server BEFORE you connect to it. Asks the server to introduce itself and list its tools, then analyzes the text it hands an agent: tool names, descriptions, parameter schemas and server instructions. Catches tool poisoning (hidden directives that point the agent at private keys or at an agent config file), parameters whose real purpose is to carry secrets or your conversation out, standing orders about ANOTHER server's tools (cross-server shadowing), and invisible-unicode payloads. Returns a verdict with the exact tool and line as evidence, plus a hash of what was advertised, so a server that changes its tools later does not inherit the old verdict. Metered like scan_artifact: an X-API-Key with credits, or pay per call over x402 at POST https://lazaretto.dev/v1/scan with target type mcp_server ($0.03 USDC on Base, no signup).