{"server":{"name":"app.malinois/scan","title":"Malinois","$schema":"https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json","remotes":[{"url":"https://malinois.app/mcp","type":"streamable-http"}],"version":"1.1.0","websiteUrl":"https://malinois.app/mcp","description":"Check a live app you own for public databases, leaked keys and exposed files."},"_meta":{"io.modelcontextprotocol.registry/official":{"status":"active","isLatest":true,"updatedAt":"2026-09-11T03:49:27.42357Z","publishedAt":"2026-09-11T03:49:27.42357Z","statusChangedAt":"2026-09-11T03:49:27.42357Z"},"dev.protogrid/connectability":{"class":"R0","autonomous":true,"human_steps":[],"preferred":{"kind":"remote","idx":0},"remotes":[{"idx":0,"url":"https://malinois.app/mcp","transport":"streamable-http","templated":false,"headers":[],"auth":{"type":"none","location":null,"secret_name":null,"oauth":null},"protocol":{"supported_versions":["2026-07-28","2025-11-25","2025-06-18","2025-03-26"],"stateless":true},"health":{"reachable":true,"uptime_30d":0.9741379,"latency_ms_p50":656,"consecutive_failures":0,"last_probe_at":"2026-10-20T01:39:38.960Z","last_ok_at":"2026-10-20T01:39:38.960Z"}}],"packages":[]},"dev.protogrid/tools":[{"name":"explain_finding","title":"Explain a Malinois finding","description":"Returns the plain-language meaning and step-by-step fix for one Malinois finding.\nUse it while helping the user fix an issue reported by scan_app, or when they ask what a finding means. Pass the rule_id exactly as scan_app returned it. Read-only, no network, instant.","annotations":{"title":"Explain a Malinois finding","readOnlyHint":true,"openWorldHint":false,"idempotentHint":true,"destructiveHint":false},"source":"probe","observed_at":"2026-10-20T01:39:38.960Z"},{"name":"scan_app","title":"Check a deployed app for data leaks","description":"Runs a passive, outside-in security check of a live web app and returns a letter grade (A–F), each issue in plain language with fix steps, and a report link.\nUse when the user asks whether their deployed app is safe, before launch, or after a redeploy to confirm a fix. It checks for publicly readable Supabase/Firebase data, secret keys (Stripe, OpenAI, Supabase service_role…) in client JavaScript, downloadable .env/.git files, source maps, permissive CORS and missing security headers.\nDo not use it for apps the user does not own or is not authorized to test, for localhost or private addresses, or to review source code — it only sees what the public URL serves.\nBehavior: sends ordinary GET requests like a browser (no login, exploitation or load testing); takes about 10–30 seconds; saves the result as a report page on malinois.app, linked in the response; secrets appear only masked. Each app can be checked at most 20 times per hour.","annotations":{"title":"Check a deployed app for data leaks","readOnlyHint":false,"openWorldHint":true,"idempotentHint":true,"destructiveHint":false},"source":"probe","observed_at":"2026-10-20T01:39:38.960Z"}],"dev.protogrid/trust":{"score":79,"components":{"hygiene":80,"liveness":99,"freshness":85,"provenance":55},"drivers":["+dns-namespace","+website","+reachable","+uptime-97%","~updated-39d-ago","-no-repository"],"flags":["no-repository"],"blocked":false,"computed_at":"2026-10-20T06:44:57.172Z","disclaimer":"Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed."},"dev.protogrid/quality":{"score":96,"label":"strong","components":{"auth":null,"hygiene":100,"protocol":88,"stability":100,"dependencies":null},"checks":[{"id":"protocol.modern","detail":"supports 2026-07-28 (server/discover)","status":"pass","category":"protocol"},{"id":"protocol.stateless","detail":"answers without a session","status":"pass","category":"protocol"},{"id":"protocol.transport","detail":"streamable HTTP","status":"pass","category":"protocol"},{"id":"protocol.list_ttl","detail":"tools/list carries no ttlMs, so clients re-fetch it","status":"warn","category":"protocol"},{"id":"auth.prm","detail":"no remote uses OAuth","status":"na","category":"auth"},{"id":"auth.as_metadata","detail":"no remote uses OAuth","status":"na","category":"auth"},{"id":"auth.cimd","detail":"no remote uses OAuth","status":"na","category":"auth"},{"id":"auth.secret_in_url","detail":"no templated URL","status":"na","category":"auth"},{"id":"tools.descriptions","detail":"every tool has a description","status":"pass","category":"hygiene"},{"id":"tools.description_length","detail":"descriptions are concise","status":"pass","category":"hygiene"},{"id":"tools.schemas","detail":"every tool has an object input schema","status":"pass","category":"hygiene"},{"id":"tools.annotations","detail":"2 of 2 tools declare readOnlyHint or destructiveHint","status":"pass","category":"hygiene"},{"id":"tools.directory_hints","detail":"every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint","status":"pass","category":"hygiene"},{"id":"tools.token_cost","detail":"about 596 tokens to load every tool","status":"pass","category":"hygiene"},{"id":"tools.api_dump","detail":"tools are not a one-to-one API dump","status":"pass","category":"hygiene"},{"id":"stability.changes","detail":"no tool changes in 30 days","status":"pass","category":"stability"},{"id":"stability.rug_pull","detail":"no tool changed its meaning under the same name","status":"pass","category":"stability"},{"id":"deps.known_vulns","detail":"no npm or PyPI package","status":"na","category":"dependencies"},{"id":"deps.mcp_sdk_version","detail":"no npm or PyPI package","status":"na","category":"dependencies"},{"id":"deps.resolvable","detail":"no npm or PyPI package","status":"na","category":"dependencies"}],"drivers":["~protocol.list_ttl"],"flags":[],"tool_count":2,"token_estimate":596,"tools_hash":"c96af7427be4ce3b3855bbe35a92da5c","tools_changed_at":null,"computed_at":"2026-10-20T06:49:33.418Z","disclaimer":"Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed."},"dev.protogrid/identity":{"canonical_id":"app.malinois/scan","aliases":[],"alias_count":0,"repository_key":null,"owner":{"verified":false,"method":null,"since":null}}},"next_actions":[{"action":"list_tools","description":"Every current tool with input schemas","href":"/v1/servers/app.malinois%2Fscan/tools","arguments":{"name":"app.malinois/scan"}},{"action":"get_connection","description":"Minimal connection block for the preferred remote or package","href":"/v1/servers/app.malinois%2Fscan/connection?target=mcpServers","arguments":{"name":"app.malinois/scan","target":"mcpServers"}},{"action":"search","description":"Find other servers by intent","href":"/v1/search?q={query}","arguments":{"q":"{query}"}}]}