tzero-mcp

verify_zero_leak_security

Scan files, code snippets, or repositories for hardcoded API keys, private keys, JWTs, and cloud secrets before commit or release to prevent leaks.

Instructions

100% Zero-Leak security scanner. Analyzes a file, code snippet, or repository workspace for hardcoded API keys (OpenAI, Anthropic, NVIDIA, Gemini, HuggingFace, GitHub), private keys, JWT tokens, and cloud secrets (100% private, 0 external network calls, $0 cost).

Behavior:

Read-only: Pattern matching and entropy analysis; does NOT modify, expose, or upload credentials.
Idempotent: Deterministic security findings for identical content.
100% Offline & Private: Never transmits inspected text to any remote server; all secret detections are masked.

Usage Guidelines:

When to use: Run before git commit, push, or public release to guarantee zero secret leaks.
Sibling Routing: For broad code quality audits including complexity, docstrings, and layer rules, use 'audit_codebase_quality'.

Returns: Security pass/fail report with masked secret snippets, affected file paths, and line numbers.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`target_file`	No	Optional single file path to inspect instead of the full workspace.
`code_snippet`	No	Optional in-memory code string to inspect instead of files on disk.
`project_root`	No	Workspace root directory to scan for secret leaks (default: current directory).	.

Output Schema

TableJSON Schema

Name	Required	Description	Default
`result`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed3 schema fields changedv0.1.1Oct 16, 2026

addedInput schema / properties / code_snippet / description

Added value: +"Optional in-memory code string to inspect instead of files on disk."

addedInput schema / properties / project_root / description

Added value: +"Workspace root directory to scan for secret leaks (default: current directory)."

addedInput schema / properties / target_file / description

Added value: +"Optional single file path to inspect instead of the full workspace."

First observedv0.1.0Oct 15, 2026

TDQS

A4.8/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden and does so well: it declares read-only behavior, idempotency/determinism, fully offline operation with zero network calls, and that detections are masked rather than exposed. It also describes the return shape (pass/fail, masked snippets, paths, line numbers), which is exactly the disclosure a mutation-free scanner needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core claim and organized under labeled Behavior/Usage/Returns sections, so scanning is fast. Minor redundancy in restating '100%' privacy and zero-cost claims across the opening line and the Offline bullet keeps it just short of optimal.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists so return values need no elaboration, and the description still covers scope, safety profile, determinism, and offline guarantees. Nothing an agent needs to invoke this correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3; the description adds marginal but real value by framing the three modes (single file, in-memory snippet, whole workspace) in the opening sentence. It does not, however, clarify precedence when multiple targets are supplied simultaneously.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource (scans file/snippet/workspace for hardcoded secrets) and enumerates the exact secret classes targeted. It explicitly separates itself from the sibling 'audit_codebase_quality', so an agent can route without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a concrete trigger ('run before git commit, push, or public release') and explicit sibling routing to 'audit_codebase_quality' for broader quality audits. Both when-to-use and when-to-use-something-else are covered.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.