--- title: "Blog. Lazaretto" description: "Guides on verifying AI agent skills, tools, and packages before install: supply-chain security, malware detection, and the x402 pay-per-call model." url: "https://lazaretto.dev/blog" --- [Home](https://lazaretto.dev/) / Blog Blog # Notes on verifying what agents install Supply-chain attacks, malware detection, false positives, and paying per call over x402. - 2026-11-03 [How to check your lockfile for malicious packages, free and without installing anything](https://lazaretto.dev/blog/check-your-lockfile-for-malicious-packages) Your lockfile pins the exact version of every package you install, including the ones you never chose. Match all of them against published malware advisories, with no install and nothing stored. - 2026-11-03 [How many MCP servers change their tools after you connect them? We read 118 servers twice](https://lazaretto.dev/blog/how-many-mcp-servers-change-their-tools) An MCP server can change the tools and instructions it hands your agent at any time, with no version to compare. We read a set of servers in the official MCP registry, waited about three days, and read them again. 18 of 118 had changed. - 2026-10-20 [What 2,760 MCP servers tell your agent: a read of the official registry](https://lazaretto.dev/blog/what-2760-mcp-servers-tell-your-agent) We connected to a sample of the remote servers in the official MCP registry, read the 34,764 tools they hand an agent, and checked them for tool poisoning. What we found, and what our own first rules got wrong. - 2026-10-20 [MCP tool poisoning: what it looks like, and how to catch it before a server is connected](https://lazaretto.dev/blog/mcp-tool-poisoning-how-to-catch-it) An MCP server can hide instructions for your agent inside its tool descriptions. What that looks like, how to read a server’s tools yourself, and how to check every server Claude Code adds before it connects. - 2026-07-17 [How to vet an MCP server before you connect it to your agent](https://lazaretto.dev/blog/vet-an-mcp-server-before-you-connect-it) An MCP server runs with your agent’s access to files, tools, and credentials. A practical checklist for deciding whether to trust one, before you connect it. - 2026-07-17 [Why an automated dependency scan flags packages that are fine](https://lazaretto.dev/blog/why-dependency-scanners-cry-wolf) We ran a behavioral scan over the most-installed npm packages. Most are clean, and the ones that get flagged are mostly legitimate code that happens to look like an attack. Here is how to tell the difference. - 2026-07-17 [Scan your dependencies for malware in GitHub Actions](https://lazaretto.dev/blog/scan-dependencies-for-malware-github-actions) Add one step to CI and every pull request that touches your dependencies gets checked for malicious behavior before it merges. Here is how, with the Lazaretto GitHub Action. - 2026-07-16 [How to tell if an npm package is malicious before you install it](https://lazaretto.dev/blog/how-to-tell-if-an-npm-package-is-malicious) Most malicious npm packages give themselves away if you know where to look: install scripts, credential reads, odd network calls, obfuscation. Here is what to check, and how to automate it. - 2026-07-16 [Why a scan verdict has to be tied to a hash](https://lazaretto.dev/blog/why-a-scan-verdict-needs-a-hash) A scan tells you a package was fine when it was scanned, not when you install it. Binding the verdict to a content hash closes that time-of-check to time-of-use gap. - 2026-07-14 [SSH keys, cloud creds, wallets: what a malicious agent skill actually steals](https://lazaretto.dev/blog/what-a-malicious-agent-skill-steals) Malicious AI-agent skills and packages target the same high-value secrets every time. Here is what they go after, how they hide it, and how to check a skill before it runs on a machine full of credentials. - 2026-07-14 [How to check an MCP server for malware before you add it](https://lazaretto.dev/blog/check-an-mcp-server-for-malware-before-adding-it) MCP servers run with real access to your tools and data. Before an agent connects to a third-party one, verify it: a free known-bad lookup and a deterministic scan of the package it ships. - 2026-07-14 [Pay-per-call verification: how an agent scans a package without an account](https://lazaretto.dev/blog/pay-per-call-verification-x402-for-agents) Lazaretto is priced per call over x402 (USDC on Base), so an autonomous agent can discover the price, pay, and get a scan inline, with no signup and no key. Here is how the flow works. - 2026-07-14 [How to verify a skill or package before your AI agent installs it](https://lazaretto.dev/blog/verify-a-skill-before-your-agent-installs-it) Autonomous agents install third-party skills, MCP servers, and npm packages on the fly. Here is how to check one for malicious behavior before it runs, with a free known-bad lookup and a deterministic scan. --- Machine-readable index: https://lazaretto.dev/llms.txt. OpenAPI: https://lazaretto.dev/openapi.json. MCP endpoint: https://lazaretto.dev/mcp. Any page on this site is available as markdown by adding .md to its path.