Koskamo

SniffPup MCP

A remote MCP server that enables AI coding tools like Claude Code and Cursor to perform passive security scans of live web applications. It checks for leaked keys, exposed files, and open Supabase tables without logging in or sending exploit payloads, returning scores and fix steps.

Visit SniffPup

Endpoint and access

No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.

SniffPup MCP logo, by SniffPupCommunity listingStreamable HTTPNo sign-inEndpoint checked 2026-11-01Published by SniffPup
MCP endpoint (Streamable HTTP)
https://sniffpup.com/api/mcp
Vendor documentation

What you can do with it

  • Scan a live site for leaked keys and exposed files
  • Check if anonymous visitors can read Supabase tables
  • Integrate security scanning into Claude Code workflows
  • Integrate security scanning into Cursor workflows

Source and maintenance

Community listingRegistry 1.0.0
mcp-registry: io.github.sniffpup/sniffpup@1.0.0Project website

Protocol and capabilities

Server
sniffpup 1.0.0
MCP protocol
2025-06-18
Tools
1 advertised
Resources
Not advertised
Resource templates
Not advertised
Prompts
Not advertised
Server-advertised capabilities
{
  "tools": {
    "listChanged": false
  }
}

Server-provided instructions

Untrusted server output shown for inspection. It is not Koskamo guidance and is excluded from knowledge search.

SniffPup runs a free, passive security scan of a live website (leaked keys, open databases, missing security headers and more), like any visitor would see it. Only scan sites the user owns or has permission to test: ask the user to confirm that first, then call scan_site with consent: true. A scan takes up to about a minute. Every critical issue comes with fix steps and a prompt; apply fixes to the user's code, redeploy, then scan again. Evidence is masked: never ask the user to paste full keys. With a SniffPup API token (Solo, Starter, Pro or Ultimate), the server also lists the user's own sites and reads their latest results.

Tools

1 advertised

scan_site — Free scan of a site
Advertised by the server during the last successful anonymous check.
Open-world

Runs SniffPup's free passive scan of a live website (takes up to about a minute) and returns the score and the issues found. Every critical issue comes with masked evidence, fix steps and a fix prompt (with no critical issue, one other issue does). Only scan a site the user owns or has permission to test, and set consent to true only after the user confirms: I own this site or can test it, and agree to the Terms, including individual arbitration.

scan_site input schema
{
  "type": "object",
  "required": [
    "url",
    "consent"
  ],
  "properties": {
    "url": {
      "type": "string",
      "description": "The live site to scan, like https://your-app.com or your-app.com."
    },
    "consent": {
      "type": "boolean",
      "const": true,
      "description": "true only if the user confirmed: I own this site or can test it, and agree to the Terms, including individual arbitration."
    }
  },
  "additionalProperties": false
}
scan_site annotations
{
  "readOnlyHint": false,
  "openWorldHint": true,
  "idempotentHint": false,
  "destructiveHint": false
}

Prompts

Not advertised

No prompt definitions available.

Resources

Not advertised

No resource definitions available.

30-day availability

Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.

Successful checks
1 of 1 (100%)
Average latency
713 ms
95th percentile latency
713 ms

Maintenance history

Public check and source-refresh events. Editorial and ownership records remain private.

  • · probe · passed · 713 ms · metadata changed · 1 tool(s)

Connect from your client

Each snippet registers the same endpoint; pick the client you use.

This server is operated by the named third party. Listing and endpoint checks are not an endorsement or a security audit. Review the operator's permissions, terms, and data handling before connecting. How listings are checked and corrected.

Claude Code

Run this once in a terminal. It registers the remote server. Use --scope project to write .mcp.json for the repo.
Claude Code configuration
claude mcp add --transport http sniffpup-mcp https://sniffpup.com/api/mcp

Codex

Run this once. Codex stores MCP servers in ~/.codex/config.toml (or .codex/config.toml in a trusted project).
Codex configuration
codex mcp add sniffpup-mcp --url https://sniffpup.com/api/mcp

Cursor

Merge this server into .cursor/mcp.json in your project, then enable sniffpup-mcp in your MCP settings.
Cursor configuration
{
  "mcpServers": {
    "sniffpup-mcp": {
      "url": "https://sniffpup.com/api/mcp"
    }
  }
}

Cline

Merge this into cline_mcp_settings.json (Cline → MCP Servers → Configure).
Cline configuration
{
  "mcpServers": {
    "sniffpup-mcp": {
      "type": "streamableHttp",
      "url": "https://sniffpup.com/api/mcp",
      "disabled": false
    }
  }
}

VS Code

Merge this server into .vscode/mcp.json. Use MCP: List Servers to start sniffpup-mcp and inspect its tools.
VS Code configuration
{
  "servers": {
    "sniffpup-mcp": {
      "type": "http",
      "url": "https://sniffpup.com/api/mcp"
    }
  }
}

Gemini CLI

Run this once. It writes .gemini/settings.json in the current project; pass --scope user for ~/.gemini/settings.json.
Gemini CLI configuration
gemini mcp add --transport http sniffpup-mcp https://sniffpup.com/api/mcp

Claude Desktop

Merge this into claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/, Windows: %APPDATA%\Claude\), then restart Claude Desktop.
Claude Desktop configuration
{
  "mcpServers": {
    "sniffpup-mcp": {
      "url": "https://sniffpup.com/api/mcp"
    }
  }
}

Windsurf

Merge this into ~/.codeium/windsurf/mcp_config.json, then refresh MCP in Cascade. Windsurf remote servers use serverUrl, not url.
Windsurf configuration
{
  "mcpServers": {
    "sniffpup-mcp": {
      "serverUrl": "https://sniffpup.com/api/mcp"
    }
  }
}

Let your agent find its tools

Find servers like SniffPup MCP from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.

Connect Koskamo Explore workflows
See all 6,904