Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "scan": {
      "type": "http",
      "url": "https://malinois.app/mcp"
    }
  }
}

claude mcp add --transport http scan https://malinois.app/mcp

[mcp_servers.scan]
url = "https://malinois.app/mcp"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "scan": {
      "type": "remote",
      "url": "https://malinois.app/mcp",
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "scan": {
      "type": "http",
      "url": "https://malinois.app/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=scan&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vbWFsaW5vaXMuYXBwL21jcCJ9"
}

{
  "servers": {
    "scan": {
      "type": "http",
      "url": "https://malinois.app/mcp"
    }
  }
}

{
  "mcpServers": {
    "scan": {
      "httpUrl": "https://malinois.app/mcp"
    }
  }
}

extensions:
  "scan":
    enabled: true
    name: "scan"
    type: streamable_http
    uri: "https://malinois.app/mcp"
    timeout: 300

Quality 96 / 100strong

protocol88 · weight 25

pass
protocol.modernsupports 2026-07-28 (server/discover)
pass
protocol.statelessanswers without a session
pass
protocol.transportstreamable HTTP
warn
protocol.list_ttltools/list carries no ttlMs, so clients re-fetch it

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene100 · weight 30

pass
tools.descriptionsevery tool has a description
pass
tools.description_lengthdescriptions are concise
pass
tools.schemasevery tool has an object input schema
pass
tools.annotations2 of 2 tools declare readOnlyHint or destructiveHint
pass
tools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
pass
tools.token_costabout 596 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability100 · weight 15

pass
stability.changesno tool changes in 30 days
pass
stability.rug_pullno tool changed its meaning under the same name

dependenciesn/a · weight 15

n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

2 tools, about 596 tokens to load them all · tool set c96af7427be4 · checked 2026-10-19 10:52 UTC

Tool changes

No tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 79 / 100

no-repository

provenance55

liveness99

freshness85

hygiene80

+dns-namespace +website +reachable +uptime-97% ~updated-38d-ago -no-repository

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://malinois.app/mcp` streamable-http	none	yes	97%	658 ms	2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26	2026-10-19

Tools (2)

explain_findingread-only Returns the plain-language meaning and step-by-step fix for one Malinois finding. Use it while helping the user fix an issue reported by scan_app, or when they ask what a finding means. Pass the rule_id exactly as scan_app returned it. Read-only, no network, instant.

scan_app Runs a passive, outside-in security check of a live web app and returns a letter grade (A–F), each issue in plain language with fix steps, and a report link. Use when the user asks whether their deployed app is safe, before launch, or after a redeploy to confirm a fix. It checks for publicly readable Supabase/Firebase data, secret keys (Stripe, OpenAI, Supabase service_role…) in client JavaScript, downloadable .env/.git files, source maps, permissive CORS and missing security headers. Do not use it for apps the user does not own or is not authorized to test, for localhost or private addresses, or to review source code — it only sees what the public URL serves. Behavior: sends ordinary GET requests like a browser (no login, exploitation or load testing); takes about 10–30 seconds; saves the result as a report page on malinois.app, linked in the response; secrets appear only masked. Each app can be checked at most 20 times per hour.

Schemas: list_tools.

Similar MCP servers

Official server.json

{
  "name": "app.malinois/scan",
  "title": "Malinois",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://malinois.app/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "1.1.0",
  "websiteUrl": "https://malinois.app/mcp",
  "description": "Check a live app you own for public databases, leaked keys and exposed files."
}