Malinois
Check a live app you own for public databases, leaked keys and exposed files.
사용해야 할까요
품질 및 안전성
도구 정의와 프로토콜 준수에 대한 자동 분석을 기반으로 합니다.
컨텍스트 비용
이는 서버의 도구가 모델의 컨텍스트에 로드될 때마다 소비되는 대략적인 토큰 수입니다. 수치가 높을수록 다른 작업에 사용할 수 있는 주의가 줄어듭니다.
설치
원클릭 설치
`claude_desktop_config.json` 파일에 다음을 추가하세요:
{
"mcpServers": {
"scan": {
"url": "https://malinois.app/mcp"
}
}
}원격 엔드포인트
https://malinois.app/mcpstreamable-http할 수 있는 일
도구 목록
도구 (2)
🟢scan_app(url, i_own_this, lang)
Runs a passive, outside-in security check of a live web app and returns a letter grade (A–F), each issue in plain language with fix steps, and a report link. Use when the user asks whether their deployed app is safe, before launch, or after a redeploy to confirm a fix. It checks for publicly readable Supabase/Firebase data, secret keys (Stripe, OpenAI, Supabase service_role…) in client JavaScript, downloadable .env/.git files, source maps, permissive CORS and missing security headers. Do not use it for apps the user does not own or is not authorized to test, for localhost or private addresses, or to review source code — it only sees what the public URL serves. Behavior: sends ordinary GET requests like a browser (no login, exploitation or load testing); takes about 10–30 seconds; saves the result as a report page on malinois.app, linked in the response; secrets appear only masked. Each app can be checked at most 20 times per hour.
입력 스키마
{
"type": "object",
"properties": {
"url": {
"type": "string",
"maxLength": 500,
"description": "Public http(s) address of the deployed app, e.g. https://my-app.lovable.app (scheme optional)."
},
"i_own_this": {
"type": "boolean",
"description": "Must be true. Set it only after the user has explicitly confirmed they own this app or are authorized to test it; without it the check is refused."
},
"lang": {
"type": "string",
"enum": [
"en",
"ko",
"es",
"ja",
"pt",
"fr",
"de",
"zh"
],
"description": "Language for the explanations (default: en)."
}
},
"required": [
"url",
"i_own_this"
],
"additionalProperties": false
}출력 스키마
{
"type": "object",
"properties": {
"grade": {
"type": "string",
"description": "A (best) to F"
},
"score": {
"type": "number",
"description": "0–100"
},
"host": {
"type": "string"
},
"platform": {
"type": [
"string",
"null"
],
"description": "Detected builder/host, e.g. lovable, replit"
},
"limited": {
"type": "boolean",
"description": "True when the app exposed little to a passive check; a good grade is then not proof of safety."
},
"report_url": {
"type": "string"
},
"findings": {
"type": "array",
"items": {
"type": "object",
"properties": {
"rule_id": {
"type": "string"
},
"severity": {
"type": "string",
"enum": [
"critical",
"high",
"medium",
"low",
"info"
]
},
"title": {
"type": "string"
},
"what_it_means": {
"type": [
"string",
"null"
]
},
"what_to_do": {
"type": [
"string",
"null"
]
},
"evidence": {
"type": [
"string",
"null"
],
"description": "Masked evidence; secrets are never returned in full."
}
},
"required": [
"rule_id",
"severity",
"title"
]
},
"description": "Most serious first."
}
},
"required": [
"grade",
"score",
"host",
"limited",
"report_url",
"findings"
]
}🟢explain_finding(rule_id, lang)
Returns the plain-language meaning and step-by-step fix for one Malinois finding. Use it while helping the user fix an issue reported by scan_app, or when they ask what a finding means. Pass the rule_id exactly as scan_app returned it. Read-only, no network, instant.
입력 스키마
{
"type": "object",
"properties": {
"rule_id": {
"type": "string",
"description": "The rule_id of a finding, e.g. supabase_missing_rls"
},
"lang": {
"type": "string",
"enum": [
"en",
"ko",
"es",
"ja",
"pt",
"fr",
"de",
"zh"
],
"description": "Language for the explanations (default: en)."
}
},
"required": [
"rule_id"
],
"additionalProperties": false
}커뮤니티
증거