Skip to main content
Glama
AleBrito124356

mcp-secret-sentinel

scan_git_staged

Read-onlyIdempotent

Detect exposed secrets in the lines staged for your next git commit, reporting file and line details so leaks are caught before publishing.

Instructions

Scan ONLY the lines currently staged for commit (git diff --cached).

This is the pre-commit checkpoint: it inspects exactly the content the next commit would publish, and reports the file and post-commit line number of every added secret. Local diff settings (external diff tools, textconv filters, prefixes, path quoting) are overridden, and git runs no configured programs.

Args: repo_path: Absolute path to a git repository (or any path inside one). max_findings: List at most this many findings, most severe first (default 200, 0 = no limit). When capped, the result adds truncated, total_findings, counts_by_severity, counts_by_pattern and top_files.

Returns: The standard redacted findings report. If nothing is staged the result is clean with an explanatory summary.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
repo_pathYes
max_findingsNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.2.0

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive. The description adds meaningful behavior beyond that: local diff settings are overridden, git runs no configured programs, and reported line numbers are post-commit. It does not mention auth or rate limits, but the extra operational detail is valuable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the essential scoping sentence, then uses compact Args/Returns structure. Well-sized for a tool with two params and truncation behavior, though the Returns paragraph is slightly padding-adjacent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description still explains the return shape (standard redacted findings report, clean-with-summary when nothing is staged, truncation fields when capped) plus both parameters. An agent has everything needed to call and interpret it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must carry both params, and it does: repo_path is 'absolute path to a git repository (or any path inside one)' and max_findings documents the default 200, the 0 = no limit sentinel, and the truncation metadata emitted when capped. This fully compensates for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Scan) and resource (lines currently staged for commit / git diff --cached), with an explicit scope constraint ('ONLY the lines currently staged'). The pre-commit framing clearly distinguishes it from scan_git_history and scan_git_range.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Names the precise moment to use it ('the pre-commit checkpoint: it inspects exactly the content the next commit would publish'), giving clear context. It does not explicitly contrast against the sibling git-scanning tools (history/range), so it stops short of full when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.