Env Secret Exposure Analyzer MCP

What env-secret-exposure-analyzer-mcp MCP server does

The env-secret-exposure-analyzer-mcp MCP server checks a project for common ways credentials can enter an AI agent's context or a source repository. It examines source files, configuration files, and environment files for recognizable secret patterns, reviews whether sensitive files are excluded by .gitignore, and identifies logging statements that may print credentials at runtime.

Findings include a file path, line number where applicable, severity, and a masked preview. The scanner does not return the complete detected value in its results. This makes it useful for reviewing a project without exposing the credential through the tool response itself.

How it works

The server exposes three tools:

• scan_for_secrets searches for more than 20 types of credential and secret patterns. Supported examples include AWS keys, GitHub tokens, Stripe keys and webhook secrets, Anthropic and OpenAI keys, SendGrid and Twilio credentials, Google API and OAuth secrets, Slack tokens, private keys, database URLs with embedded credentials, JWT and session secrets, encryption keys, Sentry DSNs, Datadog keys, and generic hardcoded secrets.
• check_gitignore_coverage checks sensitive paths such as .env, .env.local, secrets.json, private keys, and certificates against the project's .gitignore. It reports files that are not covered and suggests entries to add.
• scan_for_log_leaks searches source code for console.log and logger calls that print process.env values or objects with names associated with secrets. It is intended to catch debug output that could reveal credentials during execution.

A typical review can run all three tools in sequence: identify values in files, verify repository exclusions, and inspect runtime logging. Severity labels in the results include levels such as critical, high, and medium.

Setup and configuration

The env-secret-exposure-analyzer-mcp MCP server can be launched with npx and does not document any required environment variables. Add it to an MCP client configuration using a stdio entry such as:

{
  "mcpServers": {
    "secret-scanner": {
      "command": "npx",
      "args": ["-y", "env-secret-exposure-analyzer-mcp"]
    }
  }
}

The documented setup uses the package from npm through npx.

Tools and capabilities

Use scan_for_secrets when you need a broad search for credentials in code, configuration, or .env files. Use check_gitignore_coverage to validate that sensitive files are less likely to be committed accidentally. Use scan_for_log_leaks when reviewing debugging code or configuration-loading paths.

The output is designed for triage: it identifies where a risk appears and provides a redacted preview, while leaving the actual secret hidden. Results can therefore guide remediation without reproducing the complete credential in an agent response.

Limitations and notes

The server detects patterns and code forms described by its tools; it is not presented as a general secrets-management system or a replacement for credential rotation. Log analysis focuses on console.log and logger calls involving environment variables or secret-sounding object fields.

The server is MIT licensed.