mcpField
M
mcp-secret-scrub

mcp-secret-scrub

Local
github.com/sudo-ai-gitSecurity0Updated 9w ago
Repository

About mcp-secret-scrub

mcp-secret-scrub is a deterministic MCP server that detects and removes secrets from text before it reaches an agent or a stored transcript. It uses structural detection without an LLM or network and does not return the original secret value.

Key features

  1. 01Detect provider keys, credentials, and connection strings
  2. 02Redact, mask, or hash detected secrets
  3. 03Scan text without modifying it
  4. 04Return a combined scan and redacted preview
  5. 05List supported detection profiles

Use cases

  1. 01Scrub logs before sending them to an agent
  2. 02Check transcripts for exposed credentials
  3. 03Redact secrets before storing or passing text to a tool

MCP support

It exposes secret scanning and scrubbing tools to MCP clients over stdio or Streamable HTTP; results omit original secret values.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "sudo-ai-git-mcp-secret-scrub": {
      "command": "uvx",
      "args": [
        "mcp-secret-scrub"
      ]
    }
  }
}
Run commanduvx mcp-secret-scrub

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
pypimcp-secret-scrub1.0.0

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

mcp-secret-scrub

mcp-name: io.github.sudo-ai-git/mcp-secret-scrub

Deterministic, no-LLM MCP server that scrubs secrets from text, logs, and transcripts before they enter agent context — and never leaks the value.

No LLM. No network. Pure structural detection. MIT. Crown-jewel-free.

The problem it solves

Before you hand raw text to an agent (or store it, or pass it to a tool), you often don't know whether it contains a live secret. Platform scrubbers miss patterns all the time — a private key, an nvapi- token, a github_pat_ token, an api_key= assignment mid-log. If that text reaches an LLM context or a persisted transcript, the secret is effectively exfiltrated.

This server answers, deterministically:

Which secrets are in this text, and can you redact them safely before it goes anywhere?

Detection coverage (deterministic profiles)

familyexamples
AI provider keyssk-proj-…, sk-ant-api…, sk-or-v1-…, sk-…, nvapi-…
Cloud / GitHubAKIA…, aws_secret_access_key=, ghp_…, gho_…, ghu_…, ghs_…, ghr_…, github_pat_…
Identity / authJWTs (eyJ…), PEM private keys, Bearer …, Basic …, OAuth client secrets
Assignmentsapi_key=, token=, secret=, password=, client_secret=, webhook_secret=
Endpoints / DSNsDiscord webhooks, Slack xox…, SQL/Redis/Mongo/AMQP connection strings

The scan never returns the secret value — only its type, count, and position. That is a hard safety contract, enforced by test.

Tools (MCP)

toolpurpose
scrub_text(text, mode, keep_label)redact / mask / hash secrets; returns scrubbed text (never the value)
scan_text(text)detect which secret types are present (no mutation)
report_full(text)scan + redact in one call, scrubbed preview + findings
secret_profiles()list all supported detection profiles

Modes:

  • redact (default) → [REDACTED:TYPE]
  • mask → shows first 4 + last 2 chars
  • hash → deterministic SHA-256 prefix (reproducible across calls)

Quick start (stdio)

pip install mcp-secret-scrub
mcp-secret-scrub          # stdio (default)

Or via uv/pipx for an installable console entry:

pipx install mcp-secret-scrub

MCP client config:

{ "mcpServers": {
    "secret-scrub": { "command": "mcp-secret-scrub" }
}}

Streamable HTTP (remote / Smithery-publishable)

python3 mcp_server.py --http --port 8138   # serves on http://<host>:8138/mcp/

Determinism & safety guarantees

  • Deterministic: same input → identical output in every mode, every call.
  • Never leaks: scan_text and scrub_text never emit the original token; _deterministic_hash is SHA-256 (no salt) so output is reproducible.
  • No LLM, no network: pure regex + reachable structure detection.
  • Input-safe: non-string input returns a clean error, not a traceback.

Verification

  • python3 test_detector.py — 14/14 core checks (detection, redaction, determinism, no-leak contract, benign/unicode/empty input, bad-mode)
  • python3 test_e2e.py — drives the real MCP stdio transport and asserts the secret does NOT cross the wire

License & provenance

MIT. Part of the sudo-ai-git deterministic no-LLM agent-trust MCP family (mcp-skill-sec · mcp-verify-claim · mcp-benchmark-hygiene · mcp-secret-scrub).

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.