Ghosthunt
Let your agent scan the dev machine for leaked API keys in .env files, shell history, and configs before you ship or share a repo.
Overview
Ghosthunt is a MCP server for the Ship phase that finds leaked secrets on your machine—API keys in .env files, shell history, and configs.
What is this MCP server?
- npm package ghosthunt version 1.0.0 with stdio MCP transport
- Surfaces leaked secrets across .env files, shell history, and configs
- Focused on API keys and similar credentials on the local machine
- Requires YOUR_API_KEY for the Ghosthunt service
- GitHub source at 78degrees/ghosthunt
- npm package version 1.0.0
- stdio transport only in registry metadata
- One required secret: YOUR_API_KEY
What problem does it solve?
Keys copied into local env files and shell history silently accumulate until you accidentally leak them in a zip, screen share, or commit.
Who is it for?
Solo developers with many local projects and API keys who want MCP-driven secret hunts before shipping or open-sourcing.
Skip if: Teams that only need centralized cloud secret scanning with no local workstation audit, or users without a Ghosthunt API key.
What do I get? / Deliverables
Your agent can invoke Ghosthunt scans and get a clearer picture of credential leaks on disk and in history so you can rotate and clean up.
- Agent-triggered local secret leak reports
- Coverage of .env, shell history, and config hotspots
- Actionable list to rotate or remove exposed credentials
Recommended MCP Servers
Journey fit
How it compares
Local secret-leak MCP scanner, not a full SAST suite or production secrets manager.
Common Questions / FAQ
Who is Ghosthunt for?
Indie builders and small teams who store lots of API keys locally and want an agent to hunt leaks in env files, shell history, and configs.
When should I use Ghosthunt?
Use it before shipping, recording demos, or publishing repos when you suspect stale keys linger outside git-aware tooling.
How do I add Ghosthunt to my agent?
Install the ghosthunt npm package, set YOUR_API_KEY, and add the stdio MCP server entry in Claude Code, Cursor, or another MCP client.