Lazaretto

Supply chain security scan of an npm or PyPI package, GitHub repo, raw URL, ClawHub skill or MCP server. Use it when an agent is about to install, clone or connect to something. Matches the target against OSV and OpenSSF advisories to catch known malware, then behavioral analysis for credential theft, exfiltration, obfuscation, prompt injection, install-time droppers and tool poisoning. Returns a

Open endpoint ↗

Price per call: $0.03
Chain: Base
Method: POST
Paid calls · 30 days: 3

Call it from code

This API is run by its own provider and paid directly through x402. We list it so you can find it; we don't route or hold the payment.

import { x402Client, wrapFetchWithPayment } from "@x402/fetch";
import { registerExactEvmScheme } from "@x402/evm/exact/client";

const client = new x402Client();
registerExactEvmScheme(client, { signer: agentAccount });

const pay = wrapFetchWithPayment(fetch, client);
const res = await pay("https://lazaretto.dev/v1/scan", { method: "POST" });
console.log(await res.json());

https://lazaretto.dev/v1/scan