Secrets Leak Audit MCP server
online · 100% uptimeScan text and git diffs for committed credentials using real vendor key formats plus entropy.
0 stars
Reviews
Write oneNobody has reviewed Secrets Leak Audit yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Secrets Leak Audit tools
Tool list not cached yet. `describe` through the gateway fetches it live.
Public scan report
scanner v0.1.10 · 2026-10-02 · same rubric, same numbers if you re-run it
- –Code scanremote-only server, no package to scann/a
- Live reliabilityremote reachable in 448ms (auth required)20/20
- –Tool poisoningtools not inspected (endpoint requires auth); not countedn/a
- Auth qualityOAuth resource metadata advertised on 40115/15
- Maintenancelast push 0 days ago15/15
- Maintainer identityregistry namespace matches repository owner6/10
How Secrets Leak Audit compares
Against every graded Developer tools MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 93/100
- higher than 96% of 1,119 Developer tools servers
- Uptime
- 100%
- of our recent checks; the typical remote Developer tools server answers 100%
- Response time
- 545 ms
- faster than 20% of 443 Developer tools servers
Install Secrets Leak Audit in Claude Code, Cursor or VS Code
claude mcp add --transport http secrets-leak-audit-mcp https://secrets-leak-audit-mcp.mcpize.run/mcp
What the publisher says
From the Secrets Leak Audit repository's README, as published. We do not edit it. Read it on GitHub
secrets-leak-audit-mcp
An MCP server that scans text and diffs for accidentally-committed credentials — the single most common "oops" in software, and an easy thing for an AI coding agent to introduce without noticing (pasting a working example that includes a real key, or writing a test fixture with a plausible-looking but real value).
What it catches
High-precision vendor key matches. Real, current (2026) structural formats for AWS access keys, GitHub PATs (classic and fine-grained), Stripe live keys, Slack tokens, Google API keys, OpenAI and Anthropic keys, npm tokens, SendGrid, Twilio, PEM private key blocks, JWTs, and database connection strings with embedded credentials. These are precise format matches, not guesses — an AWS key is AKIA/ASIA + 16 specific characters, not "looks like it might be a key."
Entropy-based fallback. For secret-shaped variable names (APIKEY, PASSWORD, TOKEN) with no recognized vendor prefix, checks the assigned value's character-randomness (Shannon entropy). A real generated credential and "password123" both match a suspicious name, but only one has the entropy of an actual secret — flagged separately and at lower confidence than the vendor-format matches, since this one really is a heuristic.
Every match is redacted before it's returned — the tool never echoes a full secret value back, even to confirm a hit.
Tools
scanforsecrets
Scans any text (a file's contents, a config snippet) for both categories above.
scan_diff
Scans a unified git diff and only checks lines the diff actually adds — won't flag a secret that was already being removed in the same diff, or one that only appears in unchanged context lines.
Use it
Hosted (recommended): MCPize — free tier, $7/mo Pro.
Self-host:
npm install
node server.jsPart of a small suite
github-actions-audit-mcp, dockerfile-audit-mcp, regex-safety-audit-mcp, mcp-trust-audit-mcp.
License
MIT
Nothing above is checked by us. What we check is on the safety report.
Secrets Leak Audit: common questions
- Is Secrets Leak Audit MCP server safe?
- Yes, by our scan: it is graded A (93/100). Read the Secrets Leak Audit safety report
- How do I install Secrets Leak Audit?
- It runs remotely at secrets-leak-audit-mcp.mcpize.run. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
- Does Secrets Leak Audit need an API key?
- No key to paste: it signs you in with OAuth when your client connects.
- Is Secrets Leak Audit maintained?
- The last commit was 33 days ago (2026-10-01). The latest release is v1.0.0.
- Is Secrets Leak Audit up?
- 100% of our last 28 checks got an answer. We check remote servers about four times a day.
- What can I use instead of Secrets Leak Audit?
- Servers from other publishers that do the same job: diffctx MCP server, Nexusmem MCP server and Agent Memory MCP server.
- How does Secrets Leak Audit compare with other Developer tools MCP servers?
- safety score 93/100 (higher than 96% of 1,119 Developer tools servers); uptime 100% (of our recent checks; the typical remote Developer tools server answers 100%); response time 545 ms (faster than 20% of 443 Developer tools servers). Full comparison.
Alternatives to Secrets Leak Audit
Same job from other publishers: the closest match first, then the best rated.
diffctxSelects the minimum code an LLM needs to review a git diffnot reviewedGrowingA- NexusmemLocal-first memory for AI coding agents: shell history with exit codes, git diffs, docs, MCP.not reviewedGrowingA
- Agent MemoryGit-native project memory for AI coding agents: Markdown source of truth, reviewable, secret-safe.not reviewedGrowingA
- Pare GitPare Git ג€” Structured git operations (status, log, diff, branch, commit, push) as typed JSON.not reviewedGrowingA
RepowiseCodebase intelligence for AI coding agents — graph, git history, docs, decisions, code health.not reviewedEstablishedB
