Netallion MCP Lite MCP server

Netallion MCP Lite

Free, local, IP-safe AI-development security — an MCP server from Netallion.

<!-- mcp-name: io.github.netallion/netallion-mcp-lite -->

Netallion MCP Lite is a small Model Context Protocol server that helps you and your AI coding assistants avoid the most common mistake in AI-assisted development: leaking a credential. It flags a curated set of commodity, high-confidence secrets and credentials (AWS, GitHub, Stripe, OpenAI, private keys, database URIs, and more) in text and files.

It runs entirely on your machine. No account. No data sent to Netallion. Detected secrets are redacted before results are returned, so they are safe to hand back into an AI assistant's context.

Part of Netallion's Agentic Development Governance approach — secret detection is one capability, not the whole story.

What it is (and isn't)

MCP Lite is deliberately limited. It is a genuinely useful local utility and an on-ramp: if you want advanced detection, AI/MCP governance, central policy, and audit evidence across your organisation, that lives in Netallion AI Assurance.

This package does not contain or depend on Netallion's proprietary detection engine.

Install & run

Requires Python 3.10+.

pip install netallion-mcp-lite
# or, zero-install:
uvx netallion-mcp-lite

It speaks MCP over stdio. Add it to any MCP-compatible client (Claude, Cursor, Windsurf, VS Code, …):

{
  "mcpServers": {
    "netallion-mcp-lite": {
      "command": "netallion-mcp-lite"
    }
  }
}

Optionally confine scan_file to a specific directory:

{
  "mcpServers": {
    "netallion-mcp-lite": {
      "command": "netallion-mcp-lite",
      "env": { "NETALLION_MCP_LITE_WORKSPACE_ROOT": "/path/to/your/project" }
    }
  }
}

Tools

Run listsupportedchecks to see the full set. Findings never include the full secret value.

Privacy

Local-only. No telemetry. No source, file contents, prompts, or secrets are sent anywhere. See PRIVACY.md.

Scope & limitations

• Commodity, high-confidence formats only — it will not catch obfuscated, encoded, or org-specific secrets. That is by design; advanced detection is part of Netallion AI Assurance.
• scan_file reads only within a single workspace root and refuses obviously-sensitive files.
• No generic high-entropy scanning (it produces noise without advanced technique).

Shortened. The full README is on GitHub.