mcpField
S
Secrets Leak Audit

Secrets Leak Audit

Remote
github.com/tylerscomic-labSecurity0Updated 4w ago
Repository

About Secrets Leak Audit

Secrets Leak Audit is an MCP server for developers and coding agents that scans text and git diffs for exposed credentials. It recognizes vendor-specific formats, uses entropy as a lower-confidence fallback, and redacts matches in results.

Key features

  1. 01Detection of vendor-formatted credentials
  2. 02Entropy checks for secret-like variable values
  3. 03Redaction of matched secret values
  4. 04Scanning of text and added diff lines

Use cases

  1. 01Check configuration text for exposed credentials
  2. 02Review added lines in a git diff before committing
  3. 03Find likely secrets in code written by an AI coding agent

MCP support

Exposes text and diff scanning as tools for MCP clients, returning redacted matches.

Configuration

Remote servers need no local install. Pick your client, then copy the config or install in one click.

Endpointhttps://secrets-leak-audit-mcp.mcpize.run/mcp
Copy install command
Claude CodeTerminal
Cursor.cursor/mcp.json
VS Code.vscode/mcp.json
Claude Desktopclaude_desktop_config.json
Windsurf~/.codeium/windsurf/mcp_config.json

Run commands in a terminal; paste JSON into the client’s MCP config and restart. Servers that need sign-in will prompt on first connect.

Tools

Details

From the project README

secrets-leak-audit-mcp

License: MIT Live on MCPize

An MCP server that scans text and diffs for accidentally-committed credentials — the single most common "oops" in software, and an easy thing for an AI coding agent to introduce without noticing (pasting a working example that includes a real key, or writing a test fixture with a plausible-looking but real value).

What it catches

High-precision vendor key matches. Real, current (2026) structural formats for AWS access keys, GitHub PATs (classic and fine-grained), Stripe live keys, Slack tokens, Google API keys, OpenAI and Anthropic keys, npm tokens, SendGrid, Twilio, PEM private key blocks, JWTs, and database connection strings with embedded credentials. These are precise format matches, not guesses — an AWS key is AKIA/ASIA + 16 specific characters, not "looks like it might be a key."

Entropy-based fallback. For secret-shaped variable names (API_KEY, PASSWORD, *_TOKEN) with no recognized vendor prefix, checks the assigned value's character-randomness (Shannon entropy). A real generated credential and "password123" both match a suspicious name, but only one has the entropy of an actual secret — flagged separately and at lower confidence than the vendor-format matches, since this one really is a heuristic.

Every match is redacted before it's returned — the tool never echoes a full secret value back, even to confirm a hit.

Tools

scan_for_secrets

Scans any text (a file's contents, a config snippet) for both categories above.

scan_diff

Scans a unified git diff and only checks lines the diff actually adds — won't flag a secret that was already being removed in the same diff, or one that only appears in unchanged context lines.

Use it

Hosted (recommended): MCPize — free tier, $7/mo Pro.

Self-host:

npm install
node server.js

Part of a small suite

github-actions-audit-mcp, dockerfile-audit-mcp, regex-safety-audit-mcp, mcp-trust-audit-mcp.

License

MIT

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.