{"x402Version":2,"resource":{"url":"https://www.lazaretto.dev/v1/scan","description":"Supply chain security scan of an npm or PyPI package, GitHub repo, raw URL, ClawHub skill or MCP server. Use it when an agent is about to install, clone or connect to something. Matches the target against OSV and OpenSSF advisories to catch known malware, then behavioral analysis for credential theft, exfiltration, obfuscation, prompt injection, install-time droppers and tool poisoning. Returns a verdict, file-and-line evidence, a SHA-256 and a signed attestation. An errored scan is free.","mimeType":"application/json","serviceName":"Lazaretto","iconUrl":"https://lazaretto.dev/icon.png","tags":["malware","npm","supply-chain","mcp-security","agent-skills"]},"accepts":[{"scheme":"exact","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","amount":"30000","payTo":"0x428df107e32E08288fcAC6567f4F40bc4eAB4Da0","maxTimeoutSeconds":60,"extra":{"name":"USD Coin","version":"2"}}],"extensions":{"bazaar":{"info":{"input":{"type":"http","bodyType":"json","body":{"target":{"type":"npm_package","ref":"left-pad@1.3.0"},"depth":"full"},"method":"POST"},"output":{"type":"json","example":{"verdict":"clear","confidence":"high","risk":"none","target_hash":"sha256:564bf7642f2912a7962cd3e24a3b996ff60bd5daec3ed0ac537738d731f5355d"}},"name":"Lazaretto pre-install scan","description":"Supply chain security scan of an npm or PyPI package, GitHub repo, raw URL, ClawHub skill or MCP server. Use it when an agent is about to install, clone or connect to something. Matches the target against OSV and OpenSSF advisories to catch known malware, then behavioral analysis for credential theft, exfiltration, obfuscation, prompt injection, install-time droppers and tool poisoning. Returns a verdict, file-and-line evidence, a SHA-256 and a signed attestation. An errored scan is free."},"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"input":{"type":"object","properties":{"type":{"type":"string","const":"http"},"method":{"type":"string","enum":["POST","PUT","PATCH"]},"bodyType":{"type":"string","enum":["json","form-data","text"]},"body":{"properties":{"target":{"type":"object","properties":{"type":{"type":"string","enum":["github_repo","raw_url","clawhub_skill","npm_package","pypi_package","mcp_server","mcp_tools","huggingface_model","inline"]},"ref":{"type":"string"},"content":{"type":"string"}},"required":["type"]},"depth":{"type":"string","enum":["lookup","full"]}},"required":["target"]}},"required":["type","method","bodyType","body"],"additionalProperties":false},"output":{"type":"object","properties":{"type":{"type":"string"},"example":{"type":"object"}},"required":["type"]}},"required":["input"]}}},"version":1,"resources":["https://www.lazaretto.dev/v1/scan","https://www.lazaretto.dev/v1/credits/topup"],"name":"lazaretto","description":"Deterministic pre-install verification for npm packages, AI agent skills and MCP tools. The free lockfile check matches every exactly pinned dependency against OSV and OpenSSF malicious-package advisories with no account. A paid scan adds behavioral analysis with file-and-line evidence.","live":true,"note":"Live on base. Discovery via the CDP Bazaar (x402 v2 extensions.bazaar; cataloged on settlement)."}