scan_github
Scan GitHub repositories for leaked secrets in code, issues, and pull requests. Detects credentials and API keys without modifying any GitHub resources.
Instructions
Read GitHub repository code, issues, and pull requests to detect leaked secrets. Never modifies GitHub — no commits, comments, or PRs are created. Auth: requires a personal access token with repo (or public_repo) scope; set GITHUB_TOKEN env var or pass api_key directly. Side effects: a redacted scan report is uploaded to the n0s1 backend; set allow_secret_upload=True to also upload AES-encrypted secret values for AI validation. Returns redacted findings — raw secret values are never included in the output. Subject to GitHub API rate limits (5,000 req/hr authenticated).
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| api_key | Yes | GitHub personal access token with repo scope (or set GITHUB_TOKEN env var) | |
| owner | Yes | GitHub org or user name | |
| repo | No | Repository name (optional — omit to scan all repos for owner) | |
| branch | No | Branch to scan (optional — defaults to default branch) | |
| scope | No | Search query e.g. search:org:myorg | |
| report_format | No | Output report format | n0s1 |
| show_matched_secret_on_logs | No | Include redacted secret snippets in logs (default: false) | |
| ai_analysis | No | Queue async AI credential validation after the scan (requires n0s1 Pro) | |
| n0s1_api_key | No | n0s1 API key; overrides the N0S1_TOKEN env var | |
| allow_secret_upload | No | Upload AES-encrypted secret values to the n0s1 backend for AI validation (default: false) | |
| report_uuid | No | UUID to assign to the scan report; overrides the auto-generated one |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| report_uuid | Yes | ||
| status | Yes | ||
| summary | Yes | ||
| findings | No | ||
| next_cursor | No | ||
| usage | Yes | ||
| ai_analysis_status | No |