mcpbeat Sign in

Malinois MCP Server

by malinois Your server? Claim it
answering

Malinois is answering right now. Last checked 9 min ago. It exposes 2 tools.

Check a live app you own for public databases, leaked keys and exposed files.

Uptime history 52 days of history · worst day 91%
52 days agonow
100.0%
Uptime 24h
91 of 91 checks
2
Tools
read from the server
546 ms
Response time
average over 24h
open, no key
Access
streamable-http

Malinois missed one check this week

Everything else answered, so this is steady rather than shaky. We check every 15 minutes, which is how a one-off gets told apart from the start of a pattern, and how you hear about the next one within the hour instead of from your users.

Three servers free · no card

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 9 min ago.

run in your terminal
claude mcp add scan --transport http https://malinois.app/mcp
Settings → Connectors → Add custom connector, then paste this address
https://malinois.app/mcp
~/.codex/config.toml
[mcp_servers.scan]
url = "https://malinois.app/mcp"
.cursor/mcp.json
{
  "mcpServers": {
    "scan": {
      "url": "https://malinois.app/mcp"
    }
  }
}
.vscode/mcp.json
{
  "servers": {
    "scan": {
      "type": "http",
      "url": "https://malinois.app/mcp"
    }
  }
}

Available tools 2

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

explain
explain_finding
Returns the plain-language meaning and step-by-step fix for one Malinois finding. Use it while helping the user fix an issue reported by scan_app, or when they ask what a finding means. Pass the rule_id exactly as scan_app returned it. Read-only, no network, instant.
scan
scan_app
Runs a passive, outside-in security check of a live web app and returns a letter grade (A–F), each issue in plain language with fix steps, and a report link. Use when the user asks whether their deployed app is safe, before launch, or after a redeploy to confirm a fix. It checks for publicly readable Supabase/Firebase data, secret keys (Stripe, OpenAI, Supabase service_role…) in client JavaScript, downloadable .env/.git files, source maps, permissive CORS and missing security headers. Do not use it for apps the user does not own or is not authorized to test, for localhost or private addresses, or to review source code — it only sees what the public URL serves. Behavior: sends ordinary GET requests like a browser (no login, exploitation or load testing); takes about 10–30 seconds; saves the result as a report page on malinois.app, linked in the response; secrets appear only masked. Each app can be checked at most 20 times per hour.

Endpoints

URLTransportStateLatencyChecked
https://malinois.app/mcp streamable-http answering 572 ms 9 min ago

Alternatives to Malinois

same job, measured the same way
Arbiter
by arbiterscan

Security checks for apps built with AI: leaked keys, open routes, database rules, each with a fix.

answering
Orbit
by orbitapps

An app builder for agents. Your agent creates screens, a Postgres database, and a live URL.

answering
Agent Memory MCP
by xultrax-web

Markdown memory for AI agents. Files you can read, edit, grep, and commit. Not a database.

191 installs/wk local only
Mako
by mako-ai

Explore your databases, validate SQL, and build & publish data apps in your Mako workspace.

answering
Rowsend
by rowsend

Draft and test marketing email for contacts in your own database, from a local desktop app.

133 installs/wk local only
taivo
by taivo

EU web hosting for sites built in chat: publish, own domains, mail, a Postgres database, Node apps.

answering
S
Shippable
by egarter

Find leaks in AI-built apps: open Supabase/Firebase data, exposed keys, unsafe edge functions

414 installs/wk local only
GuideDoc Documentary Database
by guidedoc

Search public documentary film reference pages and check which titles stream on GuideDoc.

16 tools answering

Malinois — questions

Answers built from our own checks of this server.

What can Malinois do?
It exposes 2 tools, read directly from the server on our last check. Among them: explain_finding, scan_app. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →
Is Malinois working right now?
We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 546 ms. The bar chart above shows every period we have measured.
How do I connect Malinois?
Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.
Does Malinois need an API key?
No. Malinois completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 2 of them are readable on this page. This is what we observed, not what the docs claim.
How fast is Malinois?
It answers our handshake in 546 ms on average, which is faster than 21% of all working MCP servers we measure. That is on the slow side — worth knowing if the tool sits inside an interactive loop. The comparison comes from our own checks across the whole registry, every 15 minutes.