{
  "markdown": "# GhostHunt\n\nFind every leaked secret on your machine.\n\nGhostHunt is an MCP server that scans your development machine for API keys, tokens, and credentials hiding in places you forgot to check: `.env` files scattered across projects, shell history, AWS/SSH/Docker configs, and more.\n\n**Everything runs locally. No data leaves your machine.**\n\n## What It Scans\n\n- **Environment files** — recursively finds every `.env`, `.env.local`, `.env.production`, etc. under your home directory\n- **AWS credentials** — `~/.aws/credentials` and session tokens\n- **SSH keys** — unprotected private keys in `~/.ssh/`\n- **Docker config** — registry auth tokens in `~/.docker/config.json`\n- **npm/PyPI tokens** — `~/.npmrc`, `~/.pypirc` auth tokens\n- **GitHub CLI** — OAuth tokens in `~/.config/gh/hosts.yml`\n- **Shell history** — API keys pasted into `bash`, `zsh`, or `fish` commands\n- **Kubernetes** — `~/.kube/config` credentials\n- **Netrc** — `~/.netrc` passwords\n- **35+ secret patterns** — AWS, Stripe, GitHub, OpenAI, Anthropic, Google, Slack, Twilio, SendGrid, database connection strings, private keys, and more\n\n## Install\n\n### Claude Desktop\n\nAdd to your Claude Desktop config (`~/Library/Application Support/Claude/claude_desktop_config.json` on macOS):\n\n```json\n{\n  \"mcpServers\": {\n    \"ghosthunt\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"ghosthunt\"]\n    }\n  }\n}\n```\n\nRestart Claude Desktop. Then ask Claude: **\"Scan my machine for leaked secrets\"**\n\n### Direct Usage\n\n```bash\nnpx ghosthunt\n```\n\n## Tools\n\n### `scan_secrets`\n\nFull detailed scan. Returns every finding with file paths, line numbers, severity ratings, and remediation steps.\n\n**Example prompt:** \"Run a full GhostHunt scan and show me everything\"\n\n### `scan_summary`\n\nQuick health check. Returns your health score (0-100) and a count by severity. Run this first to see if you have a problem.\n\n**Example prompt:** \"Give me a quick GhostHunt health check\"\n\n## Example Output\n\n```\n# GhostHunt Scan Report\n\n**Health Score: 37/100** (Critical)\n\n- Secrets found: **12**\n- Critical: 3 | High: 5 | Medium: 2 | Low: 2\n- Locations scanned: 47\n- Scan time: 142ms\n\n## Environment Files (.env)\n\n- **[CRITICAL]** Stripe Live Secret Key\n  - File: `/Users/you/project-a/.env:4`\n  - Context: `STRIPE_SECRET_KEY`\n  - Value: `sk_l****_8xQ`\n\n- **[CRITICAL]** OpenAI API Key\n  - File: `/Users/you/side-project/.env.local:12`\n  - Context: `OPENAI_API_KEY`\n  - Value: `sk-p****kFJ9`\n\n## Shell History\n\n- **[HIGH]** Bearer Token in Header\n  - File: `/Users/you/.zsh_history:8847`\n  - Context: `curl -H \"Authorization: Bearer sk_live_...`\n  - Value: `sk_l****_m3K`\n\n## Recommendations\n\n1. **Rotate critical secrets immediately.** Any API key marked CRITICAL\n   should be revoked and regenerated from the provider's dashboard.\n2. **Clear your shell history** of sensitive commands.\n3. **Audit your .env files.** Ensure they are in .gitignore.\n```\n\n## Health Score\n\nYour score starts at 100 and drops based on what GhostHunt finds:\n\n| Finding | Penalty |\n|---------|---------|\n| Critical secret | -15 |\n| High severity | -8 |\n| Medium severity | -3 |\n| Low severity | -1 |\n\nA score below 50 means you have secrets that need immediate attention.\n\n## Privacy\n\nGhostHunt runs entirely on your local machine. It does not:\n\n- Send any data to any server\n- Phone home or track usage\n- Store scan results anywhere\n- Access the internet\n\nYour secrets stay on your machine. The scan results stay in your Claude conversation.\n\n## License\n\nMIT\n",
  "bytes": 3477,
  "sha": "022a07db8ac2a5d90086c877a5eff3e2592dc66a66626b399432efe538218b75",
  "repo_slug": "78degrees/ghosthunt",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_78degrees_ghosthunt_dcf2d7b3/readme"
}