scan_codebase_for_secrets
Scan a directory for hardcoded secrets using regex and entropy analysis. Audit code before commit to prevent secret leaks.
Instructions
[scan] Walk a directory tree and flag plausible hardcoded secrets using regex heuristics plus Shannon-entropy scoring on string literals. Use as a one-shot 'is anything leaking in this repo?' audit before commit/release; prefer lint_files when you already know the specific files to check (and want optional auto-fix). Read-only — never modifies source files. Honors .gitignore. Returns JSON array of { file, line, key, value, kind } findings, or 'No hardcoded secrets found in the specified directory.' when clean. False positives are possible — review before treating as ground truth.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| dirPath | Yes | Directory to scan, absolute or relative to the server cwd. The scan recurses into subdirectories. |