# credential-free

MCP server that scans code for exposed secrets. Detects API keys, tokens, and credentials in 69 patterns across cloud, AI, payment, and auth services.

## Quick Setup ( 2 minutes )

### Install System-wide

⚠️ **Requires Python 3.10+**

```bash
# Clone and install
git clone <repo-url>
cd credential-free
pip install -e .

# Run server
python -m src.server
```

### Alternative: Requirements File

```bash
pip install -r requirements.txt
python -m src.server
```

## Add to Your IDE

### Windsurf / Kiro

Edit `mcp_config.json`:
```json
{
  "mcpServers": {
    "credential-free": {
      "command": "/usr/bin/python3",
      "args": ["-m", "src.server"],
      "env": {}
    }
  }
}
```

Find your Python path:
```bash
# Mac/Linux
which python3

# Windows
where python
```

### Claude Desktop

Edit `claude_desktop_config.json`:
```json
{
  "mcpServers": {
    "credential-free": {
      "command": "/usr/bin/python3",
      "args": ["-m", "src.server"],
      "env": {}
    }
  }
}
```

## Test It

### MCP Server Test
```bash
# Test the server
python -c "from src.server import get_patterns; print('Server works!')"
```

### CLI Test
```bash
# Test CLI info
python -m src info

# Test CLI scan
python -m src scan file README.md

# Test CLI with exclude patterns
python -m src scan directory . --exclude-patterns '.*\.txt$'
```

## Usage Examples

### MCP Server (AI Assistant)
Ask your AI:
- "scan this file for secrets"
- "check my project for exposed api keys"
- "what patterns do you detect?"
- "find any hardcoded credentials"
- "scan my project but exclude .txt files"

### CLI (Standalone)
```bash
# Scan single file
python -m src scan file config.py

# Scan directory with exclusions
python -m src scan directory . --exclude-patterns '.*\.txt$' '.*\.md$'

# Scan text content
python -m src scan content "AKIAIOSFODNN7EXAMPLE"

# Show scanner info
python -m src info
```

## tools

| MCP Tool | CLI Command | description |
|----------|-------------|-------------|
| `scan_file` | `python -m src scan file` | scan a file for secrets |
| `scan_directory` | `python -m src scan directory` | scan a folder recursively (supports exclude_patterns) |
| `scan_content` | `python -m src scan content` | scan text directly |
| `get_patterns` | `python -m src info` | list detection patterns |

## what it detects

69 patterns across:
- **cloud**: aws, gcp, azure, vercel, heroku
- **ai**: openai, anthropic, huggingface, groq
- **payment**: stripe, square
- **auth**: github, gitlab, slack, discord
- **database**: postgresql, mongodb, redis

## example output

```json
{
  "success": true,
  "count": 2,
  "findings": [
    {
      "type": "AWS Access Key",
      "value": "AKIA****MPLE",
      "severity": "CRITICAL",
      "category": "cloud"
    }
  ]
}
```

## docker

```bash
docker build -t credential-free .
docker run credential-free
```

---

built for aws global vibe hackathon 2025