Skip to main content
Glama
Kiara1616

secretscanner

by Kiara1616
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

SecretScanner

CI PyPI Python License: MIT

SecretScanner es una herramienta de código abierto para detectar secretos y credenciales hardcodeadas en código fuente. Incluye una CLI para Python, integración con pre-commit, un servidor MCP y una extensión para Visual Studio Code.

Características

  • Analiza archivos individuales o directorios completos.

  • Detecta tokens de GitHub y Slack, claves de AWS, JWT, contraseñas, API keys, claves RSA y URL con credenciales.

  • Clasifica los hallazgos por severidad y omite directorios y formatos irrelevantes.

  • Exporta resultados en JSON o CSV.

  • Devuelve un código de salida distinto de cero cuando encuentra secretos, útil para CI.

  • Se integra con agentes compatibles con MCP y con hooks de pre-commit.

IMPORTANT

Los resultados pueden incluir falsos positivos. Revisa cada hallazgo y revoca inmediatamente cualquier credencial real expuesta.

Related MCP server: mcp-security-toolkit

Instalación

Requiere Python 3.10 o superior.

pip install secret-scanner-cl

También puedes instalarlo en un entorno aislado:

pipx install secret-scanner-cl

Uso de la CLI

# Analizar el directorio actual
secret-scanner --path .

# Analizar una ruta y exportar un reporte JSON
secret-scanner --path ./mi-proyecto --output json

# Exportar CSV y mostrar cada archivo procesado
secret-scanner --path ./mi-proyecto --output csv --verbose

Opción

Descripción

--path PATH

Archivo o directorio que se analizará. Es obligatorio.

--output json

Guarda los hallazgos en output/report.json.

--output csv

Guarda los hallazgos en output/report.csv.

--verbose

Muestra los archivos mientras se procesan.

El comando termina con código 1 cuando detecta al menos un posible secreto y con código 0 cuando no encuentra ninguno.

Patrones detectados

Tipo

Severidad

GitHub Token

Alta

AWS Access Key

Alta

API Key genérica

Media

Contraseña hardcodeada

Alta

JWT

Alta

Slack Token

Alta

Clave privada RSA

Alta

URL con credenciales

Media

SecretScanner ignora automáticamente directorios como .git, node_modules, .venv, dist, build y output, además de formatos binarios comunes.

Integración con pre-commit

Añade esta configuración a .pre-commit-config.yaml:

repos:
  - repo: https://github.com/Kiara1616/secretscanner
    rev: v1.0.2
    hooks:
      - id: secret-scanner

Después instala el hook:

pre-commit install

Servidor MCP

El paquete instala el comando secret-scanner-mcp, que expone la herramienta mediante entrada y salida estándar (stdio).

{
  "mcpServers": {
    "secret-scanner": {
      "command": "secret-scanner-mcp",
      "args": []
    }
  }
}

Extensión de Visual Studio Code

La carpeta vscode-extension/ contiene una extensión que analiza el archivo activo y señala posibles secretos en el editor. Para usarla:

  1. Instala primero la CLI con pip install secret-scanner-cl.

  2. Descarga el archivo .vsix más reciente desde la sección Assets del último release.

  3. En Visual Studio Code abre Extensions → ··· → Install from VSIX....

  4. Ejecuta SecretScanner: Scan Current File desde la paleta de comandos.

Desarrollo

git clone https://github.com/Kiara1616/secretscanner.git
cd secretscanner
python -m venv .venv

# Windows
.venv\Scripts\activate

# Linux o macOS
source .venv/bin/activate

pip install -r requirements.txt
pip install -e .
pytest

Las pruebas exigen al menos 80 % de cobertura sobre el módulo del escáner.

Publicación

Las versiones estables se publican en PyPI y se generan automáticamente cuando se publica un release en GitHub. El número de versión de pyproject.toml debe coincidir con el tag del release.

Licencia

Distribuido bajo la licencia MIT. Consulta LICENSE.

Available Tools

1 tool
scan_secretsA

Escanea un directorio o archivo en busca de contraseñas, tokens y claves API hardcodeadas.

Args: target_path: Ruta absoluta o relativa al archivo o carpeta que se desea analizar.

Returns: Un resumen en texto plano de los secretos encontrados.

ParametersJSON Schema
NameRequiredDescriptionDefault
target_pathYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description bears full burden for behavioral context. It does not disclose whether the scan is read-only, requires special permissions, or any side effects. The return type is mentioned but not the depth or scope of scanning.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured with clear Args and Returns sections. Every sentence serves a purpose with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has an output schema (not shown) and one parameter, the description is adequate but lacks details on recursion, file types scanned, or performance implications. It provides a minimal viable explanation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter 'target_path' is described as an absolute or relative path to a file or folder to analyze, adding meaningful context beyond the schema's bare title. Schema description coverage is 0%, so the description compensates well.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool scans a directory or file for hardcoded passwords, tokens, and API keys. It uses a specific verb and resource, and distinguishes itself from any potential siblings (none listed).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives, nor any prerequisites or contextual cues. The description only states what it does without any usage direction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool updatev1.0.1
    • First observedscan_secrets
Deploy Server
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A3.7/5.0

Scored across 1 tool

Disambiguation5/5

With only one tool, there is no ambiguity. The tool has a distinct purpose of scanning for secrets.

Naming Consistency5/5

The single tool name 'scan_secrets' follows a clear verb_noun pattern, consistent within itself.

Tool Count4/5

A single tool is appropriate for a focused secret scanning server, though it feels minimal.

Completeness3/5

The tool covers the core scanning functionality but lacks features like result filtering or detailed reports, leaving some gaps.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • agent-keys

    Gonzih
    A
    license
    A
    quality
    D
    maintenance
    An MCP server that lets AI agents autonomously acquire, store, verify, and manage API keys for various services.
    7
    0
    MIT

  • mcp-secret-sentinel

    AleBrito124356
    A
    license
    Not graded
    quality
    C
    maintenance
    An MCP server that scans code for exposed secrets (API keys, tokens, private keys, high-entropy strings) with placeholder-aware allowlisting and fully redacted reports, enabling agents to detect leaks before committing.
    2
    MIT