Secrets Audit Mcp
Scan repos and snippets from your agent for leaked API keys and cloud credentials before commit, deploy, or sharing logs.
Overview
Secrets Audit MCP is a MCP server for the Ship phase that scans code and text for leaked secrets using 32+ provider rules with zero extra dependencies.
What is this MCP server?
- Detects leaked secrets and API keys in text and project trees
- 32+ provider-specific detection rules (AWS, GitHub, Stripe, OpenAI, and more)
- Zero-dependency MCP server for fast local stdio wiring
- OCI image ghcr.io/eltociear/secrets-audit-mcp:1.0.1 for containerized agents
- Fits pre-commit and pre-deploy agent workflows without a separate SaaS scanner
- 32+ provider-specific detection rules cited in server description
- Server version 1.0.1
- Zero advertised runtime dependencies
What problem does it solve?
AI-assisted coding makes it easy to embed real AWS, GitHub, Stripe, or OpenAI keys in generated files that never get caught until the repo is public or deployed.
Who is it for?
Solo builders who paste env vars into chats, generate config from agents, or ship frequently from small repos without a dedicated AppSec team.
Skip if: Organizations that already enforce centralized vault injection only, or teams that need runtime secret rotation and HSM governance from one tool.
What do I get? / Deliverables
Your agent can flag provider-matched secrets during edits or reviews so you rotate keys and strip leaks before ship.
- Provider-tagged secret findings across 32+ rule families
- Agent-ready audit passes on repos or pasted content
- Shorter incident response loops before public release
Recommended MCP Servers
Journey fit
Secret leaks blow up at Ship when code merges and CI runs, but the same scanner helps during Build when agents paste env examples and during Operate when debugging artifacts. Security subphase is the canonical home for credential-leak detection ahead of release and alongside review gates.
How it compares
Agent-side leak scanner MCP, not a hosted vault or enterprise ASM platform.
Common Questions / FAQ
Who is Secrets Audit MCP for?
Indie developers and agent-first teams who need quick, local secret detection across common cloud and SaaS providers without standing up another security product.
When should I use Secrets Audit MCP?
Run it before commits, before opening a PR, after a long agent session that touched config, or right before deploy when you cannot afford a leaked key in production.
How do I add Secrets Audit MCP to my agent?
Add the stdio MCP entry pointing at ghcr.io/eltociear/secrets-audit-mcp:1.0.1 (or your client’s equivalent OCI MCP setup), then call audit tools from the agent on paths or content you want scanned.