lint_files
Scan specified files for hardcoded secrets, optionally replacing them with environment variable references and storing extracted values in a keyring for secure migration.
Instructions
[scan] Inspect a specific list of files for hardcoded secrets and, when fix is true, replace each finding with process.env.KEY while storing the extracted value into the keyring. Use to migrate a known set of files (e.g. just-changed files in a pre-commit hook) into q-ring; prefer scan_codebase_for_secrets for a whole-tree audit and import_dotenv to ingest an existing .env. With fix: false this is read-only. With fix: true this MUTATES the listed source files in place (review with git diff!) and writes one new secret per finding to the keyring. Returns a JSON array of { file, line, key, value, kind } findings, or 'No hardcoded secrets found in the specified files.'.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| fix | No | If true, rewrite the source files to read `process.env.KEY` and store the extracted value in the keyring. If false (default), only report findings. | |
| files | Yes | Absolute or relative paths to lint. Non-existent paths surface as scan errors. | |
| orgId | No | Organization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'. | |
| scope | No | Where the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId). | |
| teamId | No | Team identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'. | |
| projectPath | No | Absolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted. |