Check a live app you own for public databases, leaked keys and exposed files.
app.malinois/scan MCP Server
This MCP server, app.malinois/scan, checks a live app you own for public databases, leaked keys, and exposed files. It is described as a focused scanning capability for identifying these exposure categories on externally reachable application assets.
🛠️ Key Features
Checks for public databases
Detects leaked keys
Identifies exposed files
🚀 Use Cases
Run security-oriented scans against a live app you own
Review findings related to public databases
Investigate potential leaked keys and exposed files
⚡ Developer Benefits
Provides a dedicated MCP server for the app scanning workflow
Organized around exposure checks for databases, keys, and files
⚠️ Limitations
Scope is limited to identifying public databases, leaked keys, and exposed files based on what is reachable in a live app you own
Captured live from the server via tools/list.
scan_app
Runs a passive, outside-in security check of a live web app and returns a letter grade (A–F), each issue in plain language with fix steps, and a report link.
Use when the user asks whether their deployed app is safe, before launch, or after a redeploy to confirm a fix. It checks for publicly readable Supabase/Firebase data, secret keys (Stripe, OpenAI, Supabase service_role…) in client JavaScript, downloadable .env/.git files, source maps, permissive CORS and missing security headers.
Do not use it for apps the user does not own or is not authorized to test, for localhost or private addresses, or to review source code — it only sees what the public URL serves.
Behavior: sends ordinary GET requests like a browser (no login, exploitation or load testing); takes about 10–30 seconds; saves the result as a report page on malinois.app, linked in the response; secrets appear only masked. Each app can be checked at most 20 times per hour.
Parameters3
url
string
required
Public http(s) address of the deployed app, e.g. https://my-app.lovable.app (scheme optional).
i_own_this
boolean
required
Must be true. Set it only after the user has explicitly confirmed they own this app or are authorized to test it; without it the check is refused.
lang
string
optional
Language for the explanations (default: en).
Raw schema
{
"type": "object",
"properties": {
"url": {
"type": "string",
"maxLength": 500,
"description": "Public http(s) address of the deployed app, e.g. https://my-app.lovable.app (scheme optional)."
},
"i_own_this": {
"type": "boolean",
"description": "Must be true. Set it only after the user has explicitly confirmed they own this app or are authorized to test it; without it the check is refused."
},
"lang": {
"type": "string",
"enum": [
"en",
"ko",
"es",
"ja",
"pt",
"fr",
"de",
"zh"
],
"description": "Language for the explanations (default: en)."
}
},
"required": [
"url",
"i_own_this"
],
"additionalProperties": false
}
explain_finding
Returns the plain-language meaning and step-by-step fix for one Malinois finding.
Use it while helping the user fix an issue reported by scan_app, or when they ask what a finding means. Pass the rule_id exactly as scan_app returned it. Read-only, no network, instant.
Parameters2
rule_id
string
required
The rule_id of a finding, e.g. supabase_missing_rls
lang
string
optional
Language for the explanations (default: en).
Raw schema
{
"type": "object",
"properties": {
"rule_id": {
"type": "string",
"description": "The rule_id of a finding, e.g. supabase_missing_rls"
},
"lang": {
"type": "string",
"enum": [
"en",
"ko",
"es",
"ja",
"pt",
"fr",
"de",
"zh"
],
"description": "Language for the explanations (default: en)."
}
},
"required": [
"rule_id"
],
"additionalProperties": false
}
Install
Tools (2)
scan_appexplain_finding
Remote endpoint
Streamable HTTP
Hosted server - connect over the network, no local install.