# env-secret-exposure-analyzer-mcp [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/vola-trebla/env-secret-exposure-analyzer-mcp  
**GitHub Stars:** 0  
**npm Downloads (last month):** 185  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/env-secret-exposure-analyzer-mcp

## Description
Scans projects for secret exposure: leaked API keys, unprotected .env files, and secrets in logs.

## Tools
Capabilities this server exposes over MCP:

- **scan_for_secrets** — Scan a project directory for hardcoded secrets, API keys, tokens, and passwords. Detects patterns like AWS keys, GitHub tokens, Stripe keys, private keys, and generic high-entropy strings. Returns file path, line number, severity, and a masked preview.
- **check_gitignore_coverage** — Check whether sensitive files (.env, .env.local, secrets.json, etc.) are properly covered by .gitignore rules. Flags files that contain secrets but could be accidentally committed.
- **scan_for_log_leaks** — Scan source files for console.log / logger calls that may print environment variables or secrets at runtime. Catches patterns like console.log(process.env.SECRET) or logger.info({ apiKey }) before they reach production logs.
- **scan_ci_workflows** — Scans GitHub Actions (.github/workflows/*.yml), CircleCI (.circleci/config.yml), and GitLab CI (.gitlab-ci.yml) workflow files for dangerous secret interpolation patterns. Detects ${{ secrets.* }} and ${{ github.token }} used directly in run: steps (log_leak risk — GitHub Actions logs the expanded plaintext) and ${{ github.event.pull_request.* }} / issue / commit content interpolated in shell commands (injection risk — attacker-controlled input). Returns file, job, step, pattern_found, risk, and recommendation.
- **scan_git_history** — Scan the git commit history of a repository for secrets that were ever committed, even if later deleted. Detects hardcoded API keys, tokens, passwords, and other credentials added in diff hunks across recent commits. Returns each finding with its commit hash, file, line, severity, a masked preview, entropy score, whether the secret is still present in the working tree, and whether rotation is required. Respects .gitleaksignore.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "env-secret-exposure-analyzer-mcp": {
    "command": "npx",
    "args": ["-y","env-secret-exposure-analyzer-mcp"]
  }
}
```

## Documentation

## What env-secret-exposure-analyzer-mcp MCP server does

The env-secret-exposure-analyzer-mcp MCP server checks a project for common ways credentials can enter an AI agent's context or a source repository. It examines source files, configuration files, and environment files for recognizable secret patterns, reviews whether sensitive files are excluded by `.gitignore`, and identifies logging statements that may print credentials at runtime.

Findings include a file path, line number where applicable, severity, and a masked preview. The scanner does not return the complete detected value in its results. This makes it useful for reviewing a project without exposing the credential through the tool response itself.

## How it works

The server exposes three tools:

- `scan_for_secrets` searches for more than 20 types of credential and secret patterns. Supported examples include AWS keys, GitHub tokens, Stripe keys and webhook secrets, Anthropic and OpenAI keys, SendGrid and Twilio credentials, Google API and OAuth secrets, Slack tokens, private keys, database URLs with embedded credentials, JWT and session secrets, encryption keys, Sentry DSNs, Datadog keys, and generic hardcoded secrets.
- `check_gitignore_coverage` checks sensitive paths such as `.env`, `.env.local`, `secrets.json`, private keys, and certificates against the project's `.gitignore`. It reports files that are not covered and suggests entries to add.
- `scan_for_log_leaks` searches source code for `console.log` and logger calls that print `process.env` values or objects with names associated with secrets. It is intended to catch debug output that could reveal credentials during execution.

A typical review can run all three tools in sequence: identify values in files, verify repository exclusions, and inspect runtime logging. Severity labels in the results include levels such as critical, high, and medium.

## Setup and configuration

The env-secret-exposure-analyzer-mcp MCP server can be launched with `npx` and does not document any required environment variables. Add it to an MCP client configuration using a stdio entry such as:

```json
{
  "mcpServers": {
    "secret-scanner": {
      "command": "npx",
      "args": ["-y", "env-secret-exposure-analyzer-mcp"]
    }
  }
}
```

The documented setup uses the package from npm through `npx`.

## Tools and capabilities

Use `scan_for_secrets` when you need a broad search for credentials in code, configuration, or `.env` files. Use `check_gitignore_coverage` to validate that sensitive files are less likely to be committed accidentally. Use `scan_for_log_leaks` when reviewing debugging code or configuration-loading paths.

The output is designed for triage: it identifies where a risk appears and provides a redacted preview, while leaving the actual secret hidden. Results can therefore guide remediation without reproducing the complete credential in an agent response.

## Limitations and notes

The server detects patterns and code forms described by its tools; it is not presented as a general secrets-management system or a replacement for credential rotation. Log analysis focuses on `console.log` and logger calls involving environment variables or secret-sounding object fields.

The server is MIT licensed.

_Full upstream README: https://allmcps.com/mcp/env-secret-exposure-analyzer-mcp/readme_