{
  "markdown": "# 🔐 env-secret-exposure-analyzer-mcp\n\n[![npm](https://img.shields.io/npm/v/env-secret-exposure-analyzer-mcp)](https://www.npmjs.com/package/env-secret-exposure-analyzer-mcp)\n[![CI](https://github.com/vola-trebla/env-secret-exposure-analyzer-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/vola-trebla/env-secret-exposure-analyzer-mcp/actions)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)\n\n**Your AI agent is one debug session away from leaking your secrets.**\n\nMCP server that scans your project for secret exposure risks — hardcoded API keys, unprotected `.env` files, and `console.log` calls that print credentials at runtime. Before your agent accidentally reads them out loud.\n\n---\n\n## 🤔 The problem\n\nYou ask your AI agent to debug a config issue. It reads `src/config.ts`. Inside:\n\n```typescript\nconsole.log('Config loaded:', JSON.stringify(config));\nconsole.log(process.env.DATABASE_PASSWORD);\n```\n\nThe agent now has your database password in its context. It might log it, include it in a summary, or pass it to another tool. And your `.env` isn't in `.gitignore`, so the next `git push` will do the rest.\n\nNone of this requires the agent to be malicious. It just needs to be helpful.\n\n`env-secret-exposure-analyzer-mcp` catches this before it happens. 🔐\n\n---\n\n## 🛠️ Tools\n\n### `scan_for_secrets`\n\nScans source files, config files, and `.env` files for 20+ secret patterns. Returns file path, line number, severity, and a masked preview — never the full value.\n\n**Detects:**\n\n- AWS access keys + secret keys\n- GitHub tokens (`ghp_`, `gho_`, `ghs_`)\n- Stripe secret/publishable keys + webhook secrets (`whsec_`)\n- Anthropic, OpenAI API keys\n- SendGrid (`SG.xxx`), Twilio auth token + account SID\n- Google API keys + OAuth client secrets (`GOCSPX-`)\n- Slack tokens (`xox*`)\n- Private keys (`-----BEGIN ... PRIVATE KEY-----`)\n- Database URLs with embedded credentials (`postgres://user:pass@host`)\n- JWT secrets, session secrets, encryption keys\n- Sentry DSN, Datadog API key\n- Generic hardcoded passwords, secrets, tokens\n\n```\nSecret Scan Results\n  Project:       /project\n  Files scanned: 24\n  Findings:      5\n\n  [CRITICAL] .env:3 — AWS Access Key\n    Preview: AKIA****MPLE\n  [CRITICAL] .env:7 — Database URL with password\n    Preview: post****sswd\n  [CRITICAL] src/auth.ts:12 — Hardcoded JWT secret\n    Preview: my-s****ecret\n  [HIGH] .env:14 — Hardcoded session secret\n    Preview: sess****key!\n  [MEDIUM] .env:28 — Sentry DSN\n    Preview: http****7890\n```\n\n### `check_gitignore_coverage`\n\nChecks whether sensitive files (`.env`, `.env.local`, `secrets.json`, private keys, certificates) are covered by `.gitignore`. Flags files that could be accidentally committed.\n\n```\nGitignore Coverage Check\n  Project: /project\n\n  ✗ .env → Add to .gitignore: .env\n  ✗ .env.local → Add to .gitignore: .env.local\n  ✓ secrets.json\n```\n\n### `scan_for_log_leaks`\n\nScans source files for `console.log` / `logger` calls that print `process.env` variables or objects with secret-sounding names at runtime. Catches the most common \"it's just a debug line\" mistakes.\n\n```\nLog Leak Scan\n  Project:       /project\n  Files scanned: 18\n  Findings:      3\n\n  [CRITICAL] src/config.ts:8\n    console.log(\"Config loaded:\", JSON.stringify(config));\n  [HIGH] src/server.ts:42\n    console.log(process.env.AWS_SECRET_ACCESS_KEY);\n  [HIGH] src/db.ts:15\n    logger.info({ password: dbConfig.password });\n```\n\n---\n\n## 🧪 What it looks like in practice\n\nA realistic `.env` with 20 secrets — database URLs, AWS, Stripe, Twilio, SendGrid, Google OAuth, Sentry, JWT secrets, encryption keys. Before this MCP: an AI agent reads the file, has no idea what's sensitive, and proceeds to use those values in generated code or responses.\n\nAfter one `scan_for_secrets` call: **16 findings**, all categorized by severity, all previews masked. The agent knows exactly what's dangerous before it touches anything.\n\n---\n\n## ⚡ Setup\n\n```json\n{\n  \"mcpServers\": {\n    \"secret-scanner\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"env-secret-exposure-analyzer-mcp\"]\n    }\n  }\n}\n```\n\n---\n\n## 🚀 Usage\n\n> \"Scan this project for any secrets or API keys that might be exposed. Check if .env files are in .gitignore, and look for any console.log calls that might be leaking credentials.\"\n\nThe agent runs all three tools in sequence and reports a full picture: what's hardcoded, what's not protected, what's being logged.\n\nWorks great alongside:\n\n- [tsconfig-inheritance-flattener-mcp](https://www.npmjs.com/package/tsconfig-inheritance-flattener-mcp) — for TypeScript config analysis\n- [release-readiness-triage-mcp](https://www.npmjs.com/package/release-readiness-triage-mcp) — for CI triage before release\n- [ast-impact-mapper-mcp](https://www.npmjs.com/package/ast-impact-mapper-mcp) — for code→test correlation\n\n---\n\n## 📦 Links\n\n- **npm:** [npmjs.com/package/env-secret-exposure-analyzer-mcp](https://www.npmjs.com/package/env-secret-exposure-analyzer-mcp)\n- **GitHub:** [github.com/vola-trebla/env-secret-exposure-analyzer-mcp](https://github.com/vola-trebla/env-secret-exposure-analyzer-mcp)\n\n## License\n\nMIT\n",
  "bytes": 5119,
  "sha": "0a57eba040fba09903438adbda125f26a8aa59ef090e1ff6425f07e93fdf66d2",
  "repo_slug": "vola-trebla/env-secret-exposure-analyzer-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_vola_trebla_env_secret_exposur_e0cd6cb0/readme"
}