check_secrets_in_configs
Scan configuration files to detect hardcoded secrets like API keys, passwords, and tokens, then map findings to PCI DSS 8.6.2 compliance requirements.
Instructions
Scan configuration files (.env, .yaml, .json, .toml) for hardcoded secrets: API keys, passwords, tokens, and connection strings with embedded credentials. Default: returns response_shape "summary" with by_severity counts, a capped by_rule histogram (top 10 + more_rules), and top 3 per severity findings - plus a pagination.next_cursor for drill-down. Prefer this for mixed queries; min_severity / rule_filter drop to response_shape "flat" but still carry summary.by_severity + summary.by_rule for full-scan context. Follow the cursor for the full paginated list. Use include_tests / exclude_patterns / min_severity / rule_filter for a filtered flat response. Maps findings to PCI DSS 8.6.2.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | required,Path to the project directory to scan for hardcoded secrets in config files (.env .yaml .json .toml) | |
| exclude_patterns | No | Optional glob patterns to exclude. Supports directory patterns (vendor/) and file globs (*.env). Default: vendor/ generated/ *.pb.go testdata/ mocks/ | |
| include_tests | No | Include _test.go files in scan results. Default false excludes test files per industry SAST consensus | |
| include_untracked | No | Scan all files including .gitignored. Default false scans only git-tracked files | |
| cursor | No | Opaque cursor token from a prior check_secrets_in_configs response. When set resumes pagination from the stored session cache (10-minute TTL). Leave empty for a fresh scan. | |
| limit | No | Maximum number of findings to return per call. Default 0 (summary-first response with next_cursor). To fetch more findings than fit in one response, follow next_cursor; do NOT raise this value to fetch all at once (server caps at the per-tool page size and rejects with LIMIT_EXCEEDS_PAGE_SIZE). | |
| min_severity | No | Filter by minimum severity (CRITICAL/HIGH/MEDIUM/LOW/INFO). Setting this forces the flat response shape. | |
| rule_filter | No | Filter by rule ID, comma list or /regex/. Setting this forces the flat response shape. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||