Klarion MCP server

Install · Use it · Results · How it works · Reference

Klarion finds secrets in your code: API keys, passwords and tokens.

It works in two steps:

1. Find. Fast local checks flag anything that looks like a secret.
2. Check. An AI model reads each one with the code around it and decides if it is real.

Pattern scanners stop at step 1, so they also flag test values, IDs and hashes. Klarion shows you the real leaks.

It runs where the leak happens

A Claude Code hook that blocks the write before the file exists. The agent cannot route around it, not through the file tools and not through Bash.

$ klarion scan .

services/billing/client.py
  [critical] stripe-secret-key  39:18  sk_l****4bQx
    verdict: secret (confidence 0.96)
    | stripe.api_key = "sk_l****4bQx"

Summary: 1 finding(s) across 1 file(s), 198 suppressed [1204 files scanned in 612ms]

Install

macOS:

brew install 0x1Adi/tap/klarion

Anywhere else, with Go 1.25 or newer:

go install github.com/0x1Adi/Klarion/cmd/klarion@latest

Or download a binary from the releases page.

Klarion needs an AI model. Pick one:

Settings go in .klarion.toml under [ai]. All options are in the reference.

Use it

# .github/workflows/secrets.yml
name: secret-scan
on: [push, pull_request]

jobs:
  klarion:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - uses: 0x1Adi/Klarion@v0.4.3
        with:
          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}

On a pull request it scans only what the PR adds. It caches the AI answers, so unchanged code costs nothing. Findings show in the job log. On a private repo without GitHub Code Security, add upload-sarif: "false" to skip the Security tab upload. GitLab CI and every option are in the reference.

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/0x1Adi/Klarion
    rev: v0.4.3
    hooks:
      - id: klarion
        stages: [pre-commit]

Shortened. The full README is on GitHub.