Scan text and code for accidentally committed secrets (AWS keys, GitHub tokens, Stripe keys, Slack tokens) via @mukundakatta/secretsniff-mcp (npx)

Recipe: scan text for hardcoded secrets via @mukundakatta/secretsniff-mcp

Server: @mukundakatta/[email protected] · npx-ready · stdio · no auth · no network needed Tools: scan_text (scan a string), scan_file (scan a file on disk)

How to run

echo '<jsonrpc lines>' | npx -y @mukundakatta/secretsniff-mcp

scan_text — detect 5 secret types + high-entropy fallback

Call scan_text with any code snippet. The server matches:

• AWS_ACCESS_KEY — AKIA… prefix
• GITHUB_TOKEN — ghp/gho/ghs/ghr/githubpat prefixes
• STRIPE_KEY — sklive/sktest/rklive/rktest prefixes
• SLACK_TOKEN — xoxb-/xoxp-/xoxs-/xoxa- prefixes
• GENERIC_API_KEY — variable-name heuristic (API_KEY = "…")
• HIGH_ENTROPY — Shannon entropy ≥ 4.5 bits/char on strings ≥ 32 chars

Tuning

• min_entropy (default 4.5) — lower catches more, higher reduces noise
• min_entropy_length (default 32) — minimum char length for entropy rule
• include_high_entropy (default true) — set false to skip entropy scanning entirely

Real trace (executed 2026-06-12)

Request:

{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"scan_text","arguments":{"text":"const API_KEY = \"AKIAIOSFODNN7EXAMPLE\"; const secret = \"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY\"; const token = \"ghp_ABCDEFghijklMNOPQRSTuvwxyz0123456789\"; const stripe = \"sk_live_1234567890abcdef1234567890abcdef\"; const slack = \"xoxb-123456789012-1234567890123-abcdefABCDEFghijkl012345\"; console.log(\"safe string here\");"}}}

Response (6 findings, 0 false negatives):

{
  "count": 6,
  "findings": [
    {"kind":"GENERIC_API_KEY","line":1,"column":7,"matched":"API_KEY = \"AKIAIOSFODNN7EXAMPLE\"","entropy":4.08},
    {"kind":"AWS_ACCESS_KEY","line":1,"column":18,"matched":"AKIAIOSFODNN7EXAMPLE","entropy":3.68},
    {"kind":"HIGH_ENTROPY","line":1,"column":57,"matched":"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY","entropy":4.66},
    {"kind":"GITHUB_TOKEN","line":1,"column":115,"matched":"ghp_ABCDEFghijklMNOPQRSTuvwxyz0123456789","entropy":5.22},
    {"kind":"STRIPE_KEY","line":1,"column":174,"matched":"sk_live_1234567890abcdef1234567890abcdef","entropy":4.40},
    {"kind":"SLACK_TOKEN","line":1,"column":232,"matched":"xoxb-123456789012-1234567890123-abcdefABCDEFghijkl012345","entropy":4.70}
  ]
}

All 5 planted secret types detected. The AWS secret key (wJalrX…) was caught by the HIGH_ENTROPY fallback since it doesn't match a known prefix pattern. The clean string "safe string here" was correctly ignored.

Agent integration pattern

Use scan_text as a post-edit check: after writing or modifying code, pipe the diff or file content through secretsniff before committing. If count > 0, flag the findings to the user.