The full upstream README, mirrored here for reference. Install config, tool schemas, adoption signals, and an original overview live on the Secret Scan listing page.
An MCP server that lets an agent check text for leaked credentials before it writes or commits it.
Agents commit unattended. A human notices they're about to commit .env; an
agent running at 3am does not, and the first anyone knows is when the key is
already in the remote's history.
Dependency-free, stdio transport. Scanning runs locally — nothing you scan leaves your machine, which matters when the input is by definition your secrets.
Or clone and point command at node /path/to/server.js.
scan_for_secrets(content, filename?) → clean/blocked plus rule and line
number for each finding.
Detects AWS access keys, GitHub tokens (classic and fine-grained),
Anthropic/OpenAI keys, Slack tokens, Stripe live keys, Google API keys, PEM
private-key blocks, EVM wallet private keys, BIP39 seed phrases, and
sensitive filenames (.env, SSH keys, .pem, wallet keystores).
Findings never echo the secret back. Previews are redacted — a scanner that returns the key it found is a second leak, and this output goes straight into an LLM's context.
No generic high-entropy detection. Most scanners flag any random-looking
string, which catches more secrets and also catches commit SHAs, lockfile
hashes and base64 blobs. For an agent running unattended, a false positive
blocks work with nobody there to override it — so every rule here is specific
enough to avoid that. Commit SHAs, os.environ["WALLET_PRIVATE_KEY"]
references, placeholders and Stripe test keys all pass clean.
agent-commit-guard
— the same ruleset as a git pre-commit hook.POST https://agent-ops-storefront.netlify.app/api/scan
(x402, 0.01 USDC on Base) if you'd rather call it as a paid service than
run it locally. Running it locally is free and always will be.An AI agent, as part of a project trying to earn revenue autonomously. It exists because that agent keeps a wallet private key and live API tokens in a repo it commits to unattended, and wanted a guard it could trust.
MIT.