Server definition

Hash: sha256:7d03924e7b1eb35ca8de35444269741c5b8d7f3a8cbc47b47c65f6cf98c9929d
What it is: What a remote MCP server returned when asked what it offers: 2 tools

The blob, as servednamed by its sha256

{
  "instructions": "Malinois checks a deployed web app from the outside for the leaks AI-built apps most often ship: database tables anyone can read (Supabase RLS off, open Firebase rules), secret keys in the JavaScript bundle, and downloadable .env/.git files. It is passive — only the requests a visitor's browser would make. Only check an app the user owns or is authorized to test: ask the user to confirm before setting i_own_this. After the user fixes something, run scan_app again to confirm.",
  "tools": [
    {
      "description": "Returns the plain-language meaning and step-by-step fix for one Malinois finding.\nUse it while helping the user fix an issue reported by scan_app, or when they ask what a finding means. Pass the rule_id exactly as scan_app returned it. Read-only, no network, instant.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "lang": {
            "description": "Language for the explanations (default: en).",
            "enum": [
              "en",
              "ko",
              "es",
              "ja",
              "pt",
              "fr",
              "de",
              "zh"
            ],
            "type": "string"
          },
          "rule_id": {
            "description": "The rule_id of a finding, e.g. supabase_missing_rls",
            "type": "string"
          }
        },
        "required": [
          "rule_id"
        ],
        "type": "object"
      },
      "name": "explain_finding",
      "outputSchema": null
    },
    {
      "description": "Runs a passive, outside-in security check of a live web app and returns a letter grade (A–F), each issue in plain language with fix steps, and a report link.\nUse when the user asks whether their deployed app is safe, before launch, or after a redeploy to confirm a fix. It checks for publicly readable Supabase/Firebase data, secret keys (Stripe, OpenAI, Supabase service_role…) in client JavaScript, downloadable .env/.git files, source maps, permissive CORS and missing security headers.\nDo not use it for apps the user does not own or is not authorized to test, for localhost or private addresses, or to review source code — it only sees what the public URL serves.\nBehavior: sends ordinary GET requests like a browser (no login, exploitation or load testing); takes about 10–30 seconds; saves the result as a report page on malinois.app, linked in the response; secrets appear only masked. Each app can be checked at most 20 times per hour.",
      "inputSchema": {
        "additionalProperties": false,
        "properties": {
          "i_own_this": {
            "description": "Must be true. Set it only after the user has explicitly confirmed they own this app or are authorized to test it; without it the check is refused.",
            "type": "boolean"
          },
          "lang": {
            "description": "Language for the explanations (default: en).",
            "enum": [
              "en",
              "ko",
              "es",
              "ja",
              "pt",
              "fr",
              "de",
              "zh"
            ],
            "type": "string"
          },
          "url": {
            "description": "Public http(s) address of the deployed app, e.g. https://my-app.lovable.app (scheme optional).",
            "maxLength": 500,
            "type": "string"
          }
        },
        "required": [
          "url",
          "i_own_this"
        ],
        "type": "object"
      },
      "name": "scan_app",
      "outputSchema": {
        "properties": {
          "findings": {
            "description": "Most serious first.",
            "items": {
              "properties": {
                "evidence": {
                  "description": "Masked evidence; secrets are never returned in full.",
                  "type": [
                    "string",
                    "null"
                  ]
                },
                "rule_id": {
                  "type": "string"
                },
                "severity": {
                  "enum": [
                    "critical",
                    "high",
                    "medium",
                    "low",
                    "info"
                  ],
                  "type": "string"
                },
                "title": {
                  "type": "string"
                },
                "what_it_means": {
                  "type": [
                    "string",
                    "null"
                  ]
                },
                "what_to_do": {
                  "type": [
                    "string",
                    "null"
                  ]
                }
              },
              "required": [
                "rule_id",
                "severity",
                "title"
              ],
              "type": "object"
            },
            "type": "array"
          },
          "grade": {
            "description": "A (best) to F",
            "type": "string"
          },
          "host": {
            "type": "string"
          },
          "limited": {
            "description": "True when the app exposed little to a passive check; a good grade is then not proof of safety.",
            "type": "boolean"
          },
          "platform": {
            "description": "Detected builder/host, e.g. lovable, replit",
            "type": [
              "string",
              "null"
            ]
          },
          "report_url": {
            "type": "string"
          },
          "score": {
            "description": "0–100",
            "type": "number"
          }
        },
        "required": [
          "grade",
          "score",
          "host",
          "limited",
          "report_url",
          "findings"
        ],
        "type": "object"
      }
    }
  ]
}

Verify it yourself

curl -s https://api.teppi.xyz/v1/evidence/sha256:7d03924e7b1eb35ca8de35444269741c5b8d7f3a8cbc47b47c65f6cf98c9929d | sha256sum