From dacb2160b0225c4377724729fa9d1f57850552d7 Mon Sep 17 00:00:00 2001 From: James Dykstra Date: Thu, 16 Jul 2026 11:40:25 -0400 Subject: [PATCH 1/3] Add lazaretto-mcp to Security (deterministic pre-install package/skill scanner) --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index a1980e06d..2d09dc7f8 100644 --- a/README.md +++ b/README.md @@ -2778,6 +2778,7 @@ Tools for conducting research, surveys, interviews, and data collection. ### 🔒 Security +- [jamesdfinance-dev/lazaretto-mcp](https://github.com/jamesdfinance-dev/lazaretto-mcp) 📇 ☁️ 🏠 - Verify a skill, tool, or npm/GitHub package for malicious behavior *before* an agent installs it. Deterministic — no LLM in the serving path: a known-bad indicator match (abuse.ch feeds, refreshed daily) plus static rules for credential theft, exfiltration, obfuscation, prompt injection, and install-time droppers. Every verdict is SHA-256-bound so you can re-verify what landed on disk, with the file/line/evidence that triggered it. Free known-bad lookup; paid full scan $0.03 USDC on Base (x402) or prepaid credits. Also a ClawHub skill. `npx lazaretto-mcp` - [RoscoNL/intodns-mcp-server](https://github.com/RoscoNL/intodns-mcp-server) [![RoscoNL/intodns-mcp-server MCP server](https://glama.ai/mcp/servers/RoscoNL/intodns-mcp-server/badges/score.svg)](https://glama.ai/mcp/servers/RoscoNL/intodns-mcp-server) 📇 ☁️ 🏠 🍎 🪟 🐧 - Free DNS and email security scanner for AI assistants. DNS, SPF, DKIM, DMARC, DNSSEC, MTA-STS, BIMI, TLS/STARTTLS, FCrDNS, CAA, TLSA/DANE, blacklist and full-deliverability checks, plus security-header/CSP analysis and bookmarkable report snapshots, via the IntoDNS.ai API. No signup or API key. `npx intodns-mcp` - [astafford8488/agentaegis-mcp](https://github.com/astafford8488/agentaegis-mcp) [![astafford8488/agentaegis-mcp MCP server](https://glama.ai/mcp/servers/astafford8488/agentaegis-mcp/badges/score.svg)](https://glama.ai/mcp/servers/astafford8488/agentaegis-mcp) 📇 ☁️ - Security & trust layer for AI agents. Scan an MCP server or skill *before* you install it (`scan_mcp_plugin`, `scan_skill`) — flags exfiltration, prompt-injection sinks, dangerous capabilities, install hooks and obfuscation → PROCEED/CAUTION/BLOCK. Plus `vet_endpoint` (endpoint safety verdict before an agent calls or pays it) and 25 more tools: vuln scans, threat intel, compliance (SOC 2/ISO 27001/HIPAA), code security (SAST/secret/dependency), identity — 28 total. Per-call billing via API key or x402 USDC on Base; free discovery tier. - [hernaninverso/eleion-scanner-mcp](https://github.com/hernaninverso/eleion-scanner-mcp) [![hernaninverso/eleion-scanner-mcp MCP server](https://glama.ai/mcp/servers/hernaninverso/eleion-scanner-mcp/badges/score.svg)](https://glama.ai/mcp/servers/hernaninverso/eleion-scanner-mcp) 📇 ☁️ - Register/verify your domains, queue security scans (headers, TLS, DNS, ports, CVEs + AI-specific checks) and read findings, for AI agents. Install with `npx -y eleion-scanner-mcp`. @@ -3459,4 +3460,4 @@ Now Claude can answer questions about writing MCP servers and how they work Star History Chart - \ No newline at end of file + From 3f00a5afa1fed25be8b17dd7d8311a1dc815e7f2 Mon Sep 17 00:00:00 2001 From: James Dykstra Date: Thu, 16 Jul 2026 12:24:22 -0400 Subject: [PATCH 2/3] Add Glama score badge (per listing requirements) --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 2d09dc7f8..7197a7dee 100644 --- a/README.md +++ b/README.md @@ -2778,7 +2778,7 @@ Tools for conducting research, surveys, interviews, and data collection. ### 🔒 Security -- [jamesdfinance-dev/lazaretto-mcp](https://github.com/jamesdfinance-dev/lazaretto-mcp) 📇 ☁️ 🏠 - Verify a skill, tool, or npm/GitHub package for malicious behavior *before* an agent installs it. Deterministic — no LLM in the serving path: a known-bad indicator match (abuse.ch feeds, refreshed daily) plus static rules for credential theft, exfiltration, obfuscation, prompt injection, and install-time droppers. Every verdict is SHA-256-bound so you can re-verify what landed on disk, with the file/line/evidence that triggered it. Free known-bad lookup; paid full scan $0.03 USDC on Base (x402) or prepaid credits. Also a ClawHub skill. `npx lazaretto-mcp` +- [jamesdfinance-dev/lazaretto-mcp](https://github.com/jamesdfinance-dev/lazaretto-mcp) [![jamesdfinance-dev/lazaretto-mcp MCP server](https://glama.ai/mcp/servers/jamesdfinance-dev/lazaretto-mcp/badges/score.svg)](https://glama.ai/mcp/servers/jamesdfinance-dev/lazaretto-mcp) 📇 ☁️ 🏠 - Verify a skill, tool, or npm/GitHub package for malicious behavior *before* an agent installs it. Deterministic — no LLM in the serving path: a known-bad indicator match (abuse.ch feeds, refreshed daily) plus static rules for credential theft, exfiltration, obfuscation, prompt injection, and install-time droppers. Every verdict is SHA-256-bound so you can re-verify what landed on disk, with the file/line/evidence that triggered it. Free known-bad lookup; paid full scan $0.03 USDC on Base (x402) or prepaid credits. Also a ClawHub skill. `npx lazaretto-mcp` - [RoscoNL/intodns-mcp-server](https://github.com/RoscoNL/intodns-mcp-server) [![RoscoNL/intodns-mcp-server MCP server](https://glama.ai/mcp/servers/RoscoNL/intodns-mcp-server/badges/score.svg)](https://glama.ai/mcp/servers/RoscoNL/intodns-mcp-server) 📇 ☁️ 🏠 🍎 🪟 🐧 - Free DNS and email security scanner for AI assistants. DNS, SPF, DKIM, DMARC, DNSSEC, MTA-STS, BIMI, TLS/STARTTLS, FCrDNS, CAA, TLSA/DANE, blacklist and full-deliverability checks, plus security-header/CSP analysis and bookmarkable report snapshots, via the IntoDNS.ai API. No signup or API key. `npx intodns-mcp` - [astafford8488/agentaegis-mcp](https://github.com/astafford8488/agentaegis-mcp) [![astafford8488/agentaegis-mcp MCP server](https://glama.ai/mcp/servers/astafford8488/agentaegis-mcp/badges/score.svg)](https://glama.ai/mcp/servers/astafford8488/agentaegis-mcp) 📇 ☁️ - Security & trust layer for AI agents. Scan an MCP server or skill *before* you install it (`scan_mcp_plugin`, `scan_skill`) — flags exfiltration, prompt-injection sinks, dangerous capabilities, install hooks and obfuscation → PROCEED/CAUTION/BLOCK. Plus `vet_endpoint` (endpoint safety verdict before an agent calls or pays it) and 25 more tools: vuln scans, threat intel, compliance (SOC 2/ISO 27001/HIPAA), code security (SAST/secret/dependency), identity — 28 total. Per-call billing via API key or x402 USDC on Base; free discovery tier. - [hernaninverso/eleion-scanner-mcp](https://github.com/hernaninverso/eleion-scanner-mcp) [![hernaninverso/eleion-scanner-mcp MCP server](https://glama.ai/mcp/servers/hernaninverso/eleion-scanner-mcp/badges/score.svg)](https://glama.ai/mcp/servers/hernaninverso/eleion-scanner-mcp) 📇 ☁️ - Register/verify your domains, queue security scans (headers, TLS, DNS, ports, CVEs + AI-specific checks) and read findings, for AI agents. Install with `npx -y eleion-scanner-mcp`. From cb90c3682ab014d5637a00daba51d20461035646 Mon Sep 17 00:00:00 2001 From: James Dykstra Date: Wed, 22 Jul 2026 15:24:04 -0400 Subject: [PATCH 3/3] Resolve conflict with main and refresh the entry Keeps the newly-merged privacyscrubber-mcp entry alongside ours. Also updates the description: the server is now published to npm and has a free check_lockfile tool that needs no API key, neither of which existed when the entry was written. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index a3c9375ba..af035dec8 100644 --- a/README.md +++ b/README.md @@ -2923,7 +2923,7 @@ Tools for conducting research, surveys, interviews, and data collection. ### 🔒 Security - [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) [![moxno/privacyscrubber-mcp MCP server](https://glama.ai/mcp/servers/moxno/privacyscrubber-mcp/badges/score.svg)](https://glama.ai/mcp/servers/moxno/privacyscrubber-mcp) 📇 🏠 - Zero-trust local PII and secrets masking server for Cursor, Windsurf, and Claude Desktop. `npx pii-masking-run` -- [jamesdfinance-dev/lazaretto-mcp](https://github.com/jamesdfinance-dev/lazaretto-mcp) [![jamesdfinance-dev/lazaretto-mcp MCP server](https://glama.ai/mcp/servers/jamesdfinance-dev/lazaretto-mcp/badges/score.svg)](https://glama.ai/mcp/servers/jamesdfinance-dev/lazaretto-mcp) 📇 ☁️ 🏠 - Verify a skill, tool, or npm/GitHub package for malicious behavior *before* an agent installs it. Deterministic — no LLM in the serving path: a known-bad indicator match (abuse.ch feeds, refreshed daily) plus static rules for credential theft, exfiltration, obfuscation, prompt injection, and install-time droppers. Every verdict is SHA-256-bound so you can re-verify what landed on disk, with the file/line/evidence that triggered it. Free known-bad lookup; paid full scan $0.03 USDC on Base (x402) or prepaid credits. Also a ClawHub skill. `npx lazaretto-mcp` +- [jamesdfinance-dev/lazaretto-mcp](https://github.com/jamesdfinance-dev/lazaretto-mcp) [![jamesdfinance-dev/lazaretto-mcp MCP server](https://glama.ai/mcp/servers/jamesdfinance-dev/lazaretto-mcp/badges/score.svg)](https://glama.ai/mcp/servers/jamesdfinance-dev/lazaretto-mcp) 📇 ☁️ 🏠 - Check whether anything you depend on is known malware, before an agent installs it. `check_lockfile` takes a package-lock.json, yarn.lock or pnpm-lock.yaml and matches every pinned version against published malicious-package advisories in one call, free and with no API key, catching compromised releases like chalk@5.6.1 while leaving their clean releases alone. `scan_artifact` adds deterministic behavioral analysis (no LLM in the serving path) for credential theft, exfiltration, obfuscation, prompt injection and install-time droppers, with the file, line and evidence that triggered it; verdicts are SHA-256-bound so you can re-verify what landed on disk. Paid scans settle at $0.03 USDC on Base (x402) or prepaid credits. `npx lazaretto-mcp` - [RoscoNL/intodns-mcp-server](https://github.com/RoscoNL/intodns-mcp-server) [![RoscoNL/intodns-mcp-server MCP server](https://glama.ai/mcp/servers/RoscoNL/intodns-mcp-server/badges/score.svg)](https://glama.ai/mcp/servers/RoscoNL/intodns-mcp-server) 📇 ☁️ 🏠 🍎 🪟 🐧 - Free DNS and email security scanner for AI assistants. DNS, SPF, DKIM, DMARC, DNSSEC, MTA-STS, BIMI, TLS/STARTTLS, FCrDNS, CAA, TLSA/DANE, blacklist and full-deliverability checks, plus security-header/CSP analysis and bookmarkable report snapshots, via the IntoDNS.ai API. No signup or API key. `npx intodns-mcp` - [astafford8488/agentaegis-mcp](https://github.com/astafford8488/agentaegis-mcp) [![astafford8488/agentaegis-mcp MCP server](https://glama.ai/mcp/servers/astafford8488/agentaegis-mcp/badges/score.svg)](https://glama.ai/mcp/servers/astafford8488/agentaegis-mcp) 📇 ☁️ - Security & trust layer for AI agents. Scan an MCP server or skill *before* you install it (`scan_mcp_plugin`, `scan_skill`) — flags exfiltration, prompt-injection sinks, dangerous capabilities, install hooks and obfuscation → PROCEED/CAUTION/BLOCK. Plus `vet_endpoint` (endpoint safety verdict before an agent calls or pays it) and 25 more tools: vuln scans, threat intel, compliance (SOC 2/ISO 27001/HIPAA), code security (SAST/secret/dependency), identity — 28 total. Per-call billing via API key or x402 USDC on Base; free discovery tier. - [hernaninverso/eleion-scanner-mcp](https://github.com/hernaninverso/eleion-scanner-mcp) [![hernaninverso/eleion-scanner-mcp MCP server](https://glama.ai/mcp/servers/hernaninverso/eleion-scanner-mcp/badges/score.svg)](https://glama.ai/mcp/servers/hernaninverso/eleion-scanner-mcp) 📇 ☁️ - Register/verify your domains, queue security scans (headers, TLS, DNS, ports, CVEs + AI-specific checks) and read findings, for AI agents. Install with `npx -y eleion-scanner-mcp`.