Skip to content
Malinois logo

Malinois MCP server

Which servers in the official MCP registry are Malinois's own, whether they answer, and what they offer. A program checked each of these, nobody copied them from a product page.

read 2026-10-24

← Back to Malinois

Whose server it is
  • Registry nameapp.malinois/scanverified in the MCP registry

The registry name sits under malinois.app. The registry only lets a publisher use that namespace after proving control of the domain through DNS or HTTP.

When we asked itchecked 2026-10-24
  • Stateanswerschecked 2026-10-24
  • Tools2
  • Server calls itselfmalinois
  • Server version1.1.0
  • Protocol version2025-06-18

On 2026-10-24 the server answered initialize and tools/list without a sign-in. First answer in 339 ms.

Should an agent connect itNot proven either way yet
  • Its tools do scan a live app for open databases and leaked keys, but not get email alerts when a new leak appears.
  • Checked on 3 of the 7 days it takes to judge reliability.

Once connected

  • For "scan a live app for open databases and leaked keys", the likely first call is scan_app.

Said by rules from the measurements above. The likely first call is a model's pick from the tool list; read its description before relying on it.

Measured dailydaily checks: 3, the first on 2026-10-24
  • INITE MCP scoreafter a weeka score needs 7 daily checks: 3 so far
  • What an agent can do with it1 of 2 use cases
  • Answeredmeasuring3 of the 7 daily checks it takes to print a share
  • Median first answer390 ms
  • Space in an agent's context≈ 555 tokensthe definitions of all its tools (2), which an agent carries on every turn
  • Tool definitionsA · 100 of 100
  • Typed results1 of 2 toolsdeclared outputSchema: results come typed, read once
  • Every tool passes all six checks.

What an agent can do with it

  • can do · scan a live app for open databases and leaked keys
  • cannot · get email alerts when a new leak appears
  • not sure · share an inspection history report with a client or auditor

Each of the product's use cases, put to Jev against this server's tool list: can an agent do it with these tools?

Worth a look

None of the five warning signs in these definitions.

A program checks the server once a day: initialize and tools/list, no model. Tokens are the definitions' length at about four characters a token. The grade averages six checks of every tool's name, description, schema and annotations; it says how well the tools are described, not whether they work. The score weighs what was measured and nothing else: answering (30%), doing the product's job (25%), definitions (20%), context (10%) and use (15%). A part that was not measured is left out, and a hidden instruction caps the score at 40. The state of vendors' MCP servers: method and numbers →

Tools it offers2 tools · read 2026-10-24
  • scan_app

    Runs a passive, outside-in security check of a live web app and returns a letter grade (A–F), each issue in plain language with fix steps, and a report link. Use when the user asks whether their deployed app is safe, before launch, or…

  • explain_finding

    Returns the plain-language meaning and step-by-step fix for one Malinois finding. Use it while helping the user fix an issue reported by scan_app, or when they ask what a finding means. Pass the rule_id exactly as scan_app returned it…

How to connect

Add the server to your MCP client config. Claude Desktop, Cursor and most other clients read this shape:

{
  "mcpServers": {
    "scan": {
      "type": "http",
      "url": "https://malinois.app/mcp"
    }
  }
}

Add it

Claude Code, in a terminal

claude mcp add --transport http malinois https://malinois.app/mcp

Add to CursorAdd to VS Code

claude.ai, ChatGPT and other clients: add https://malinois.app/mcp as a custom connector in the settings.

Each line is something a program found when it went looking: the registry entry, the server's own answer, a spec that parses. A missing line means we did not find it, not that it does not exist.