mcpbeat Sign in

Malinois MCP Server

by malinois Your server? Claim it
answering

Malinois is answering right now. Last checked 3 min ago. It exposes 2 tools.

Check a live app you own for public databases, leaked keys and exposed files.

Uptime history 7 days of history
7 days agonow
100.0%
Uptime 24h
92 of 92 checks
2
Tools
read from the server
596 ms
Response time
average over 24h
open, no key
Access
streamable-http

Nothing serious here today

Today is the operative word: we check Malinois every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Three servers free · no card

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 3 min ago.

run in your terminal
claude mcp add scan --transport http https://malinois.app/mcp
~/Library/Application Support/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "scan": {
      "url": "https://malinois.app/mcp"
    }
  }
}
~/.codex/config.toml
[mcp_servers.scan]
url = "https://malinois.app/mcp"
.cursor/mcp.json
{
  "mcpServers": {
    "scan": {
      "url": "https://malinois.app/mcp"
    }
  }
}
.vscode/mcp.json
{
  "mcpServers": {
    "scan": {
      "url": "https://malinois.app/mcp"
    }
  }
}

Available tools 2

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

explain
explain_finding
Returns the plain-language meaning and step-by-step fix for one Malinois finding. Use it while helping the user fix an issue reported by scan_app, or when they ask what a finding means. Pass the rule_id exactly as scan_app returned it. Read-only, no network, instant.
scan
scan_app
Runs a passive, outside-in security check of a live web app and returns a letter grade (A–F), each issue in plain language with fix steps, and a report link. Use when the user asks whether their deployed app is safe, before launch, or after a redeploy to confirm a fix. It checks for publicly readable Supabase/Firebase data, secret keys (Stripe, OpenAI, Supabase service_role…) in client JavaScript, downloadable .env/.git files, source maps, permissive CORS and missing security headers. Do not use it for apps the user does not own or is not authorized to test, for localhost or private addresses, or to review source code — it only sees what the public URL serves. Behavior: sends ordinary GET requests like a browser (no login, exploitation or load testing); takes about 10–30 seconds; saves the result as a report page on malinois.app, linked in the response; secrets appear only masked. Each app can be checked at most 20 times per hour.

Endpoints

URLTransportStateLatencyChecked
https://malinois.app/mcp streamable-http answering 659 ms 3 min ago

Alternatives to Malinois

same job, measured the same way
Orbit
by orbitapps

An app builder for agents. Your agent creates screens, a Postgres database, and a live URL.

answering
Agent Memory MCP
by xultrax-web

Markdown memory for AI agents. Files you can read, edit, grep, and commit. Not a database.

113 installs/wk local only
Mako
by mako-ai

Explore your databases, validate SQL, and build & publish data apps in your Mako workspace.

answering
Grimoire
by ttrpg

Campaign manager for D&D and TTRPG GMs: your AI reads and writes a live typed campaign database.

answering
GuideDoc Documentary Database
by guidedoc

Search public documentary film reference pages and check which titles stream on GuideDoc.

2 tools answering
Fastbcp MCP
by arpe-io

MCP server for FastBCP — high-performance parallel database export to files and cloud

83 installs/wk local only
Aifp
by aryanduntley

Database-driven FP enforcement and project management for AI-maintained codebases

7 installs/wk local only
Magic Cloud
by polterguy

Generate secured CRUD APIs over your database, run SQL, manage files, tasks and a headless browser

local only

Malinois — questions

Answers built from our own checks of this server.

What can Malinois do?
It exposes 2 tools, read directly from the server on our last check. Among them: explain_finding, scan_app. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →
Is Malinois working right now?
We send a real MCP handshake every 15 minutes. Over the last 24 hours 92 of 92 checks got a reply (100.0%), average response time 596 ms. The bar chart above shows every period we have measured.
How do I connect Malinois?
Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.
Does Malinois need an API key?
No. Malinois completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 2 of them are readable on this page. This is what we observed, not what the docs claim.
How fast is Malinois?
It answers our handshake in 596 ms on average, which is faster than 21% of all working MCP servers we measure. That is on the slow side — worth knowing if the tool sits inside an interactive loop. The comparison comes from our own checks across the whole registry, every 15 minutes.