---
title: "Remote MCP server (Streamable HTTP, JSON-RPC). Zero-install for any MCP-capable agent."
method: POST
path: "/mcp"
---

# Remote MCP server (Streamable HTTP, JSON-RPC). Zero-install for any MCP-capable agent.

`POST /mcp`

## Request

- Base URL: `https://lazaretto.dev`
- URL: `https://lazaretto.dev/mcp`
- Auth: none declared

Add this URL as an MCP server. Free and anonymous tools: check_lockfile, known_bad_lookup, verify_attestation, find_attestation, get_free_key. Metered tools, against an X-API-Key header holding credits: scan_artifact, scan_mcp_server and check_mcp_tools (one credit per non-error verdict) and scan_lockfile_deep (one credit per package that returns a verdict). JSON-RPC methods: initialize, tools/list, tools/call, ping.

## Response `200`

JSON-RPC response.

## Other responses

- `202`: Notification accepted (no body).
- `400`: Malformed JSON-RPC (parse error, or a batch array).

---

[API](https://skmtc.dev/lazaretto/apis/lazaretto-skill-tool-verification-api.md) · [All operations](https://skmtc.dev/lazaretto/apis/lazaretto-skill-tool-verification-api/llms.txt) · [OpenAPI document](https://skmtc.dev/lazaretto/apis/lazaretto-skill-tool-verification-api/revisions/2bd4e34d0067?raw)