leak-secure-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| NODE_ENV | No | Environment mode (development, production, test). | production |
| LOG_LEVEL | No | Logging level (DEBUG, INFO, WARN, ERROR). | INFO |
| MAX_RETRIES | No | Maximum retry attempts for failed requests. | 3 |
| GITHUB_TOKEN | No | GitHub Personal Access Token for accessing repositories. Recommended for private repositories and higher rate limits. | |
| SCAN_TIMEOUT | No | Timeout for entire repository scans in milliseconds (default: 5 minutes). | 300000 |
| MAX_FILE_SIZE | No | Maximum file size to process in bytes (default: 10MB). | 10485760 |
| RETRY_DELAY_MAX | No | Maximum delay between retries in milliseconds. | 30000 |
| RETRY_DELAY_BASE | No | Base delay for exponential backoff in milliseconds. | 1000 |
| MAX_FILES_PER_SCAN | No | Maximum files to scan per repository. | 10000 |
| GITHUB_REQUEST_TIMEOUT | No | Timeout for individual GitHub API requests in milliseconds. | 30000 |
| CIRCUIT_BREAKER_TIMEOUT | No | Time before attempting recovery in milliseconds. | 60000 |
| GITHUB_RATE_LIMIT_BURST | No | Burst capacity for rate limiter. | 100 |
| CIRCUIT_BREAKER_THRESHOLD | No | Failure threshold before opening circuit. | 5 |
| GITHUB_RATE_LIMIT_PER_HOUR | No | Maximum API calls per hour. | 5000 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
| resources | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| scan_repositoryA | Scan a GitHub repository for secrets and sensitive information. Detects 35+ types of secrets including API keys, passwords, tokens, and credentials. Enterprise-grade with rate limiting, retry logic, and comprehensive error handling. |
| scan_codeA | Scan a code snippet or file content for secrets and sensitive information. Supports up to 10MB of code content with enhanced validation. |
| analyze_securityC | Perform comprehensive security analysis on a repository, including secret detection, vulnerability assessment, risk scoring, and compliance status. |
| get_secret_typesB | Get list of all supported secret types that can be detected (35+ types). |
| validate_secretB | Validate if a detected secret is still active or has been revoked. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| Supported Secret Types | List of all 35+ secret types that can be detected |
| Detection Patterns | Regular expressions and patterns used for secret detection |
TDQS
Scored across 5 tools
Most tools have distinct purposes, but there is some overlap between scan_code and scan_repository, as both involve scanning for secrets, which could cause confusion. However, the descriptions clarify that scan_code is for snippets/files while scan_repository is for entire GitHub repositories, helping to differentiate them.
All tool names follow a consistent verb_noun pattern (e.g., analyze_security, get_secret_types, scan_code, scan_repository, validate_secret), with clear and predictable naming conventions throughout the set.
With 5 tools, the server is well-scoped for security analysis and secret detection, covering key operations like analysis, scanning, validation, and information retrieval without being overly sparse or bloated.
The tool set covers core security analysis workflows, including scanning, validation, and information retrieval, but lacks explicit tools for remediation actions (e.g., revoking or fixing secrets) or reporting, which could be minor gaps in a comprehensive security workflow.