Gitleaks Cloud - GitHub API Key Hunter & Secret Scanner MCP server

Gitleaks Cloud - GitHub API Key Hunter & Secret Scanner

Cloud-hosted gitleaks for hunting leaked API keys, tokens, and credentials across GitHub - 30+ services including Indian fintech.

Available as an Apify Actor. Pay-per-event. The lightweight cheaper tier; sibling betterleaks-cloud adds live vendor-API validation.

What does it do?

Scans a GitHub user, org, or repo for leaked API keys and credentials across 30+ critical services: Razorpay, Stripe, AWS, OpenAI, Anthropic, Gemini, Supabase, Firebase, GitHub PATs, Twilio, SendGrid, Slack, Discord, Telegram, plus Indian fintech APIs (Cashfree, PayU, Surepass, Decentro, Karza, Attestr, Tartan). Smart key-secret pairing detects related credentials in the same file (e.g., Razorpay's two-part keyid + keysecret).

How is it different from running gitleaks CLI locally OR GitGuardian / Snyk Code subscriptions?

Tested on real Indian fintech repos: 47 razorpay-named GitHub repos scanned, 22 had leaks, 4 had production credentials in .env files including paired keyid + keysecret.

When should I use it?

• DevSecOps - scan your own org for accidental commits of secrets
• Bug bounty - hunt for live credentials in customer-facing public repos
• Pre-acquisition security audit - check target company's open-source posture
• Indian fintech compliance - sweep for Razorpay / Cashfree / PayU keys before regulator audit
• Cheap secret-scanner alternative to GitGuardian / Snyk for low-volume use

What does it cost?

Pay-per-event:

Typical scan costs

• Single repo: $0.03
• 10-repo scan: $0.21
• 100-repo bulk scan: $2.01

Which inputs does it take?

What does the output look like?

Each dataset record:

{
  "rule_id": "razorpay-key-id",
  "match": "rzp_live_AbCdEfGhIjKlMn",
  "secret": "rzp_live_AbCdEfGhIjKlMn",
  "paired_secret": "9p8q7r6s5t4u3v2w1x0y",
  "file": "config/.env",
  "line": 12,
  "commit": "abcd1234",
  "url": "https://github.com/owner/repo/blob/abcd1234/config/.env#L12"
}

Common questions

Q: Need live validation that the leaked key still works? Use sibling betterleaks-cloud instead - it probes vendor APIs to confirm key status.

Q: Service detector missing? DM LinkedIn for 1-2 hour custom detector addition. Specific Indian fintech APIs are a specialty.

Q: Can I scan a private repo? Yes, provide a GitHub PAT with repo scope as github_token input.

About the maintainer (priority response within 1-2 hours)

Built and maintained by Anshuman Atrey (@AnshumanAtrey).

Shortened. The full README is on GitHub.