lazaretto-mcp
Check whether anything you depend on is known malware, before an agent installs it. check_lockfile takes a package-lock.json, yarn.lock or pnpm-lock.yaml and matches every pinned version against published malicious-package advisories in one call, free and with no API key, catching compromised releases like chalk@5.6.1…