Lazaretto

Pre-install scan of an npm or PyPI package, GitHub repo, raw URL, ClawHub skill, MCP server or tool list, or inline content. Matches OSV and OpenSSF malicious-package advisories, then behavioral analysis for credential theft, exfiltration, obfuscation, prompt injection, install-time droppers and MCP tool poisoning. Returns a verdict, file-and-line evidence, a SHA-256 of the input and an Ed25519-si