Mmcp.market

Secrets-LE MCP server

by nolindnaidoo·io.github.nolindnaidoo/secrets-le·v2.3.0
No reviews yet

Detect hardcoded secrets in source and config. Reports masked previews, never the values.

A92/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A92/100

full report

Adoption
Growing

1 stars40 downloads/wk

Reviews

Write one

Nobody has reviewed Secrets-LE yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Secrets-LE tools (1)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • detect_secrets

    Detect hardcoded secrets \u2014 API keys, passwords, tokens and private keys \u2014 in source or configuration text. Reports each finding by type, confidence, key name and 1-based position. Values are never returned: previews are truncated and length-annotated, and the surrounding context line has the secret masked out, so a finding can be located without the credential leaving the machine it was

Public scan report

scanner v0.1.9 · 2026-09-23 · same rubric, same numbers if you re-run it

no findings
  • Code scan2 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 1 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 92/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

What the publisher says

From the Secrets-LE repository's README, as published. We do not edit it. Read it on GitHub

Secrets-LE: Zero Hassle Secret Detection Find hardcoded credentials across your workspace, then redact them in place API keys, tokens, passwords, private keys — 100% local, nothing leaves your machine

Useful? A star or rating is how other developers find it —

★ GitHub ·

★ Open VSX ·

★ Marketplace

What it does

Open a workspace, press Ctrl+Alt+S (Cmd+Alt+S on Mac), and every detected secret lands in a results document — grouped by file, with line/column positions pointing at the value itself. Run Secrets-LE: Sanitize Secrets to replace the secrets in the active file with a placeholder. Works in VS Code and in VS Code–based editors like Cursor and VSCodium (installable from Open VSX).

Detection is regex-based over the full text of each file, so it works on any text format — code, configs, .env files, YAML, JSON, logs. It is a pre-commit safety net, not a guarantee: a scanner built on patterns can miss secrets and can flag non-secrets. Review the results.

Install

Use it from an AI agent

The same engine runs as an MCP server, so an agent can call it directly instead of you running a command.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Install directly

Runs npx -y secrets-le-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add secrets-le -- npx -y secrets-le-mcp
Add to Cursor

Secrets-LE: common questions

Is Secrets-LE MCP server safe?
Yes, by our scan: it is graded A (92/100). Read the Secrets-LE safety report
How do I install Secrets-LE?
It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
Does Secrets-LE need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Secrets-LE maintained?
The last commit was in the last day (2026-09-22). The latest release is v2.3.0.

More from nolindnaidoo →