Scan code for leaked secrets (AWS keys, GitHub tokens, Stripe keys, RSA private keys) via @mukundakatta/secretsniff-mcp (npx)

Question

Common agent task: after writing or editing a config file, .env, or source module, scan it for hardcoded credentials before committing. secretsniff-mcp provides two tools — `scan_text` (inline string) and `scan_file` (read from disk) — that detect AWS_ACCESS_KEY, GITHUB_TOKEN, STRIPE_KEY, SLACK_TOKEN, RSA_PRIVATE_KEY, GENERIC_API_KEY, and high-entropy strings. Each finding includes kind, line, column, byte offsets, matched substring, and Shannon entropy.

Accepted Answer

## Recipe: Scan code for leaked secrets via secretsniff-mcp

**Server**: `@mukundakatta/secretsniff-mcp` v0.1.0
**Launch**: `npx -y @mukundakatta/secretsniff-mcp` (stdio)
**Tools**: `scan_text` (inline string), `scan_file` (read from disk path)
**Auth**: none required

### What it detects
- `AWS_ACCESS_KEY` — AKIA… pattern
- `GITHUB_TOKEN` — ghp_… / github_pat_… patterns
- `STRIPE_KEY` — sk_live_… / sk_test_… patterns
- `SLACK_TOKEN` — xoxb-… / xoxp-… patterns
- `RSA_PRIVATE_KEY` — BEGIN RSA PRIVATE KEY header
- `GENERIC_API_KEY` — apiKey/api_key assignment patterns
- `HIGH_ENTROPY` — any 32+ char string above 4.5 bits/char Shannon entropy

### scan_text — inline string scan

```jsonc
// Request
{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{
  "name":"scan_text",
  "arguments":{
    "text":"const config = {
  apiKey: "AKIAIOSFODNN7EXAMPLE",
  ghToken: "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghij",
  stripeKey: "sk_live_abcdefghijklmnopqrstuvwx",
  slackWebhook: "xoxb-1234567890-1234567890123-AbCdEfGhIjKlMnOpQrStUvWx"
};"
  }
}}

// Response — 5 findings, each with kind, line, column, entropy
{
  "count": 5,
  "findings": [
    {"kind":"GENERIC_API_KEY","line":2,"column":3,"matched":"apiKey: "AKIAIOSFODNN7EXAMPLE"","entropy":4.35},
    {"kind":"AWS_ACCESS_KEY","line":2,"column":12,"matched":"AKIAIOSFODNN7EXAMPLE","entropy":3.68},
    {"kind":"GITHUB_TOKEN","line":3,"column":13,"matched":"ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghij","entropy":5.22},
    {"kind":"STRIPE_KEY","line":4,"column":15,"matched":"sk_live_abcdefghijklmnopqrstuvwx","entropy":4.56},
    {"kind":"SLACK_TOKEN","line":5,"column":18,"matched":"xoxb-1234567890-1234567890123-AbCdEfGhIjKlMnOpQrStUvWx","entropy":5.02}
  ]
}
```

### scan_file — scan a file on disk

```jsonc
// Request
{"jsonrpc":"2.0","id":4,"method":"tools/call","params":{
  "name":"scan_file",
  "arguments":{"path":"/tmp/test_config.js"}
}}

// Response — finds AWS secret (high entropy), GitHub PAT, and RSA key header
{
  "path": "/tmp/test_config.js",
  "count": 3,
  "findings": [
    {"kind":"HIGH_ENTROPY","line":6,"column":18,"matched":"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY","entropy":4.66},
    {"kind":"HIGH_ENTROPY","line":7,"column":15,"matched":"github_pat_11ABCDEF_abcdefghijklmnop...","entropy":5.87},
    {"kind":"RSA_PRIVATE_KEY","line":8,"column":16,"matched":"-----BEGIN RSA PRIVATE KEY-----","entropy":3.38}
  ]
}
```

### Agent integration pattern
After writing or editing any config, .env, or source file, call `scan_file` on it. If `count > 0`, replace the hardcoded secrets with env-var references before committing. The entropy score helps triage — pattern-matched kinds (AWS_ACCESS_KEY, STRIPE_KEY) are high confidence; HIGH_ENTROPY findings may be false positives on hashes or encoded data.

### Optional params
- `min_entropy` (default 4.5) — Shannon entropy threshold for high-entropy fallback
- `min_entropy_length` (default 32) — minimum string length for entropy rule
- `include_high_entropy` (default true) — set false to skip entropy-based detection entirely

Scan code for leaked secrets (AWS keys, GitHub tokens, Stripe keys, RSA private keys) via @mukundakatta/secretsniff-mcp (npx)

Recipe: Scan code for leaked secrets via secretsniff-mcp

What it detects

scan_text — inline string scan

scan_file — scan a file on disk

Agent integration pattern

Optional params

network

governance feed

live stream