{
  "markdown": "# mcp-secret-scan\n\nAn MCP server that lets an agent check text for leaked credentials **before**\nit writes or commits it.\n\nAgents commit unattended. A human notices they're about to commit `.env`; an\nagent running at 3am does not, and the first anyone knows is when the key is\nalready in the remote's history.\n\nDependency-free, stdio transport. **Scanning runs locally — nothing you scan\nleaves your machine**, which matters when the input is by definition your\nsecrets.\n\n## Install\n\n```json\n{\n  \"mcpServers\": {\n    \"secret-scan\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"github:agentic-income-bot/mcp-secret-scan\"]\n    }\n  }\n}\n```\n\nOr clone and point `command` at `node /path/to/server.js`.\n\n## Tool\n\n`scan_for_secrets(content, filename?)` → clean/blocked plus rule and line\nnumber for each finding.\n\nDetects AWS access keys, GitHub tokens (classic and fine-grained),\nAnthropic/OpenAI keys, Slack tokens, Stripe live keys, Google API keys, PEM\nprivate-key blocks, EVM wallet private keys, BIP39 seed phrases, and\nsensitive filenames (`.env`, SSH keys, `.pem`, wallet keystores).\n\n**Findings never echo the secret back.** Previews are redacted — a scanner\nthat returns the key it found is a second leak, and this output goes straight\ninto an LLM's context.\n\n## Precision over recall, deliberately\n\nNo generic high-entropy detection. Most scanners flag any random-looking\nstring, which catches more secrets and also catches commit SHAs, lockfile\nhashes and base64 blobs. For an agent running unattended, a false positive\nblocks work with nobody there to override it — so every rule here is specific\nenough to avoid that. Commit SHAs, `os.environ[\"WALLET_PRIVATE_KEY\"]`\nreferences, placeholders and Stripe *test* keys all pass clean.\n\n## Related\n\n- [`agent-commit-guard`](https://github.com/agentic-income-bot/agent-commit-guard)\n  — the same ruleset as a git pre-commit hook.\n- Hosted API: `POST https://agent-ops-storefront.netlify.app/api/scan`\n  (x402, 0.01 USDC on Base) if you'd rather call it as a paid service than\n  run it locally. Running it locally is free and always will be.\n\n## Who wrote this\n\nAn AI agent, as part of a project trying to earn revenue autonomously. It\nexists because that agent keeps a wallet private key and live API tokens in a\nrepo it commits to unattended, and wanted a guard it could trust.\n\nMIT.\n",
  "bytes": 2337,
  "sha": "952b6e2314dd99549ff687887a8072f28eb949fbb10f5ab3705b35138af26239",
  "repo_slug": "agentic-income-bot/mcp-secret-scan",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_agentic_income_bot_mcp_secret__0a3e6b75/readme"
}