SniffPup

io.github.sniffpupPublished by GitHub account sniffpupv1.0.0Updated Oct 29, 2026

Free passive outside security scan of a live web app: leaked keys, exposed files, open Supabase

The publisher's own server: Sniff Mcp

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

SniffPup runs a free passive security scan of a live website and returns a score, issues, masked evidence and fix steps.

What you can do
  • Run a passive outside-in security scan of a live site and get its score and issues
  • Review critical findings with masked evidence, fix steps and a fix prompt
  • Re-scan after applying fixes and redeploying
  • With a SniffPup API token, list the user's own sites and read their latest results
When to use it
Useful when you want an assistant to check a web app you own for leaked keys, exposed files, open databases or missing security headers, and to walk through fixes and a re-scan.
Requirements
Remote endpoint at sniffpup.com over streamable HTTP; no environment variables or headers declared. A scan takes up to about a minute. Listing the user's own sites and reading their latest results requires a SniffPup API token on a paid plan (Solo, Starter, Pro or Ultimate).
Before you install
Only scan sites the user owns or has permission to test; the server asks for confirmation before scanning. Findings are sent to SniffPup's service, so the target site is disclosed to a third party. Evidence is masked, so never ask the user to paste full keys. Fixes are applied to the user's own code and require a redeploy.

Installation

In SourceWeft

  1. Open SniffPup in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.sniffpup%2Fsniffpup/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "sniffpup": {
      "type": "http",
      "url": "https://sniffpup.com/api/mcp"
    }
  }
}

Tools

1

scan_site

Free scan of a site

Runs SniffPup's free passive scan of a live website (takes up to about a minute) and returns the score and the issues found. Every critical issue comes with masked evidence, fix steps and a fix prompt (with no critical issue, one other issue does). Only scan a site the user owns or has permission to test, and set consent to true only after the user confirms: I own this site or have permission to test it, and I agree to the Terms (including individual arbitration), Acceptable Use Policy and Privacy Policy. Free scans are passive: we only look at what any visitor's browser can see.

Parametersurlrequiredconsentrequired

Version history

1
  1. v1.0.0LatestOct 29, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.

Other Sniff integrations

Sniff Mcp

world.sniffOfficial publisher

Open remote MCP server over the Sniff Atlas, giving assistants breed-stratified canine variant frequencies, gene and disease annotations, and a grounded…

Streamable HTTPWeb executable
Knowledge & MemoryNot indexed yetNov 2, 2026

Sniff

Published by GitHub account Aboudjem

Sniff walks a running web app in a real browser, clicks and fills forms like a user, and reports broken flows with proof.

STDIODesktop only
Browser AutomationNot validated yetOct 24, 2026