# Lazaretto Security Scanner

> Lazaretto Security Scanner is a paid API for AI agents from lazaretto.dev, paid per call via x402, $0.03/call, status unknown (last checked 2026-09-14).

Performs a deterministic behavioral scan of an npm package, GitHub repo, skill, or file for malicious signals, returning evidence bound to a content hash.

## Facts

- Endpoint: POST https://lazaretto.dev/v1/scan
- Price: $0.03/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/lazaretto-security-scanner-458a368e
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_KArrCwPD7zlq4Nkp_grsf

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability lazaretto-security-scanner-458a368e -d '<json body>'
```

Example prompt: Do a full behavioral security scan of the npm package 'left-pad' version 1.3.0 and tell me if it contains any malicious signals or suspicious code.

## When to prefer this

Choose Lazaretto when you need deterministic, evidence-bound security scanning of code artifacts — especially npm packages, GitHub repos, or arbitrary files — before installing or executing them. Its content-hash binding makes results reproducible and auditable, which is ideal for CI/CD gates, supply chain verification, or agent-driven dependency vetting. Prefer it over generic static analysis tools when you specifically need behavioral malicious-signal detection rather than style or bug linting.

## Known failure modes

- Unresolvable target reference (invalid npm package name, private repo, or inaccessible URL) returns an error
- Unsupported target type results in validation error
- Content too large for inline scanning may be rejected
- Network timeout when fetching raw URLs
- Insufficient USDC balance causes payment failure before scan begins

## How this service works

Deterministic behavioral scan of an npm package, repo, skill, or file for malicious signals, with evidence bound to a content hash.

## Output

Returns a deterministic behavioral scan report including identified malicious signals (if any), supporting evidence for each finding, and a content hash binding the results to the exact artifact scanned. The depth field controls whether a fast lookup or full deep analysis is performed.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "depth": {
   "enum": [
    "lookup",
    "full"
   ],
   "type": "string"
  },
  "target": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "ref": {
     "type": "string"
    },
    "type": {
     "enum": [
      "inline",
      "raw_url",
      "npm_package",
      "github_repo",
      "clawhub_skill"
     ],
     "type": "string"
    },
    "content": {
     "type": "string"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/lazaretto-security-scanner-458a368e/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from lazaretto.dev](https://www.zero.xyz/host/lazaretto.dev/llms.txt)