Scan Text for Leaked Secrets
scan_for_secretsScan any text—git diff, file, or pasted snippet—for leaked cloud keys, tokens, private keys, and JWTs before committing or sharing. Returns redacted findings to prevent secret exposure.
Instructions
Scan text (a git diff, a file's contents, a pasted snippet) for accidentally-committed secrets: cloud provider keys (AWS, Google), platform tokens (GitHub, Slack, npm), payment keys (Stripe), private key blocks, JWTs, and a generic entropy-gated check for anything assigned to a secret-sounding variable name. Use this before committing, opening a PR, or pasting logs/config anywhere -- a committed secret is one of the most common real-world causes of account and infrastructure compromise, and is easy to miss in a large diff.
Findings are always redacted (first/last few characters only) -- this tool never returns a full secret value, so its own output is safe to log or display.
Args:
text (string, 1-200000 chars): the text to scan.
Returns: For JSON format: { "found": boolean, "riskLevel": "none" | "medium" | "high" | "critical", "findings": [ { "detector": string, "category": string, "severity": "low"|"medium"|"high"|"critical", "line": number, "column": number, "redacted": string } ] }
Examples:
Use when: about to run "git commit" or "git push" -- scan the staged diff first
Use when: about to paste a config file, log excerpt, or error message into a chat or issue tracker
Don't use when: you need certainty nothing sensitive is present -- this is a fixed-pattern + heuristic scan, not exhaustive; a clean result means "no known pattern matched," not "definitely safe"
Error Handling:
Returns an error if text is empty or exceeds 200000 characters.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | The text to scan -- a git diff, a file's contents, or any pasted snippet. |