Skip to main content
Glama
duriantaco

mcp-skylos

by duriantaco
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python

Find hard-coded secrets

secrets_scan
Read-only

Detect hard-coded secrets and credentials like API keys, tokens, private keys, and passwords in source and config files, returning redacted findings with file and line details.

Instructions

Find hard-coded secrets and credentials (API keys, tokens, private keys, passwords) in source and config files.

Returns JSON with findings (provider, file, line) and _run_id. Secret values are redacted in the output. Read-only and local.

Defect and Review records remain complete. Advice is grouped by default; expand_advice=True includes every Advice record. Read _result_uri for the complete saved result without rescanning.

Requires SKYLOS_API_KEY: this tool returns an authentication error unless the MCP server is started with SKYLOS_API_KEY set. Without a key only analyze works (5 calls/day). The local CLI needs no key: skylos verify <file> and skylos agent install-hooks.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
pathYesDirectory or file to scan. A relative path resolves against the MCP server's working directory.
confidenceNoMinimum confidence (0-100) for dead-code findings. Higher values report fewer, surer candidates; 60 is the CLI default.
expand_adviceNoInclude every Advice record instead of rule-group counts; complete results are always available through _result_uri.
exclude_foldersNoFolder names to skip, e.g. ["migrations", "scripts"]. When given, this list replaces the default excludes (node_modules, .venv, build, dist and similar); omit it to keep the defaults.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
resultYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed4 schema fields changedv4.49.0
    • addedInput schema / properties / confidence / description
      Added value: +"Minimum confidence (0-100) for dead-code findings. Higher values report fewer, surer candidates; 60 is the CLI default."
    • addedInput schema / properties / exclude_folders / description
      Added value: +"Folder names to skip, e.g. [\"migrations\", \"scripts\"]. When given, this list replaces the default excludes (node_modules, .venv, build, dist and similar); omit it to keep the defaults."
    • addedInput schema / properties / expand_advice
      Added value: +{
+  "default": false,
+  "description": "Include every Advice record instead of rule-group counts; complete results are always available through _result_uri.",
+  "title": "Expand Advice",
+  "type": "boolean"
+}
    • addedInput schema / properties / path / description
      Added value: +"Directory or file to scan. A relative path resolves against the MCP server's working directory."
  2. Addedv4.10.0

TDQS

A3.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/non-destructive/non-open-world, and the description still adds substantial behavior: secret values are redacted in output, Advice is rule-grouped unless expand_advice=True, _result_uri holds the full saved result without rescanning, and the tool hard-fails without SKYLOS_API_KEY at a 5-call/day cap. That is well beyond what the annotations cover.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded in the first sentence, followed in a sensible order by output shape, flags, and the auth constraint. The middle sentences about 'Defect and Review records' and default Advice grouping feel like carried-over boilerplate for a secrets tool and cost it a perfect score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present the description need not explain returns, yet it still names the key fields and the _result_uri escape hatch, and it covers the auth prerequisite that would otherwise cause silent tool failures. The main gap is that the confidence parameter's reference to dead-code findings is unexplained for a secrets scanner.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so all four parameters are already documented at the schema level, and the description adds little syntax or format detail on top. The one notable line it does add — Advice grouping — is only loosely tied to the expand_advice parameter and the confidence mention of 'dead-code findings' reads as leakage from another tool rather than clarification.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — find hard-coded secrets and credentials — and enumerates what counts (API keys, tokens, private keys, passwords) plus the scan targets (source and config files). It does not explicitly distinguish itself from the sibling security_scan or provenance_scan, so an agent must infer the boundary from the name alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides real admission guidance — SKYLOS_API_KEY is required, otherwise only `analyze` works at 5 calls/day, and the local CLI needs no key (`skylos verify`, `skylos agent install-hooks`). However, it never states when to pick this over security_scan or provenance_scan, which is the more common selection decision, so usage is implied rather than specified.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools