Keyspoor MCP server

Keyspoor

Offline secret scanning for AI coding workflows. Keyspoor scans files, staged Git changes, local Git history and ZIP/tar/gzip archives, with redacted JSON, JSONL and SARIF results. Use it as a native CLI, a reusable Rust library or a read-only MCP server. Connect agents through MCP; use a staged hook or a required CI check to block commits or merges.

Website · Rust API · crates.io · npm · Releases · 简体中文

Try it in 60 seconds

With Node.js 20+, paste this into a macOS/Linux terminal. The value below is made up for this demo and is not a credential:

printf 'password=KspDemo_7zQ2mX9pL4vN6sR8\n' | npx -y keyspoor@0.1.4 scan - --format json
echo "exit=$?"

Expected: exit=1 and one finding. The relevant report fields are:

{"complete":true,"findings":[{"rule_id":"generic-credential-unquoted","path":"stdin","line":1,"column":9,"redacted":"[REDACTED]"}],"errors":[]}

This is an excerpt; the actual report also includes ranges, fingerprints, statistics and scan context. It contains neither the value nor a source snippet. On Windows PowerShell, pipe the same synthetic string to npx.cmd -y keyspoor@0.1.4 scan - --format json, then check $LASTEXITCODE.

Watch a commit get blocked, then repaired

With Git and an installed keyspoor CLI, run the complete demo from a checkout:

sh examples/first-scan.sh

It creates and deletes its own temporary repository. The recording comes from an actual 0.1.3 run with invented input: finding exit 1, blocked commit, repair exit 0, accepted commit. No agent is involved in this hook demo. MCP setup gives agents tools; it does not guarantee they call them before each commit. CI and hooks provide enforcement.

Install

# Rust toolchain (1.96 or newer)
cargo install keyspoor --version 0.1.4 --locked

# Or Node.js 20+: the npm package runs the native Rust CLI
npm install -g keyspoor@0.1.4

# Or Homebrew (macOS / Linux)
brew install majiayu000/tap/keyspoor

keyspoor scan . --format jsonl

Current release: 0.1.4. The Rust API is pre-1.0 and may change. The npm package bundles native binaries for macOS (Apple Silicon/Intel), Linux GNU (ARM64/x64) and Windows x64; it is a CLI launcher, not a JavaScript scanning SDK. There are no install hooks or runtime binary downloads. First-time npm/npx installation requires registry access; scanning itself is offline. Standalone binaries are also available. To build from source, run cargo build --release --locked and use target/release/keyspoor.

Why Keyspoor

Shortened. The full README is on GitHub.