Malinois
Check a live app you own for public databases, leaked keys and exposed files.
| Endpoint | https://malinois.app/mcp (streamable-http) |
|---|---|
| Registry version | 1.1.0 |
| Now | 2 tools · grade A (99) · pin ts_557c34f60f08faf2552808c58f1c56e1 · protocol 2025-06-18 |
| First / last listed | 2026-10-24 19:09 UTC / 2026-10-24 19:09 UTC |
| Grade over time | 2026-10-24: A (99), 2 tools |
Is this your server? Own a server? ToolFit hosted watch re-checks it every 24 h ($0.25 per 30 days) or 6 h ($0.60) and sends you an HMAC-signed webhook when its tools or grade change: POST https://api.youraitools.co/toolfit/v1/watch. To opt out, see About & opt-out.
Tools: scan_app explain_finding
scan_app | Runs a passive, outside-in security check of a live web app and returns a letter grade (A–F), each issue in plain language with fix steps, and a report link.
Use when the user asks whether their deployed app is safe, before launch, or after a redeploy to confirm a fix. It checks for publicly readable Supabase/Firebase data, secret keys (Stripe, OpenAI, Supabase service_role…) in client JavaScript, params: url*, i_own_this*, lang |
explain_finding | Returns the plain-language meaning and step-by-step fix for one Malinois finding.
Use it while helping the user fix an issue reported by scan_app, or when they ask what a finding means. Pass the rule_id exactly as scan_app returned it. Read-only, no network, instant. params: rule_id*, lang |
Entries describe changes in tool definitions. They are not statements about a server, its quality or its author. The grade measures how the tool definitions fit model providers (token cost, schema compatibility, confusable names) as scored by the ToolFit engine at the time of the listing. JSON: append .json. Opt-out: how or hello@youraitools.co.