Secretguard MCP server
io.github.vladimirbakalov/secretguard-mcp·v0.1.4Scans code for hardcoded secrets (AWS, Stripe, GitHub, JWTs) before an AI agent commits it.
0 stars
Reviews
Write oneNobody has reviewed Secretguard yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Secretguard tools
No tool declarations could be read from the package source. They show once the server is installed.
Public scan report
scanner v0.1.10 · 2026-11-03 · same rubric, same numbers if you re-run it
- –Code scanpackage could not be scannedn/a
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 82 days ago12/15
- Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
How Secretguard compares
Against every graded E-commerce MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 80/100
- higher than 70% of 2,174 E-commerce servers
Install Secretguard in Claude Code, Cursor or VS Code
The registry entry has no remote endpoint or installable package.
What the publisher says
From the Secretguard repository's README, as published. We do not edit it. Read it on GitHub
secretguard-mcp
An MCP (Model Context Protocol) server that scans a code string for hardcoded secrets — AWS keys, Stripe keys, GitHub tokens, Google API keys and OAuth client secrets, Slack tokens and incoming webhook URLs, Shopify access tokens, Telegram bot tokens, DigitalOcean tokens, Hugging Face tokens, Notion API tokens, Mailchimp API keys, Postman API tokens, Linear API keys, Readme API keys, Clojars API tokens, Pulumi API tokens, OpenAI keys, Anthropic keys, npm access tokens, SendGrid keys, Twilio API keys, Azure Storage account keys, database connection strings with embedded passwords, private key blocks, JWTs, and generic high-entropy credentials — so an AI coding agent (Claude Code, Cursor, Windsurf, ...) can catch a secret before it writes the file or makes the commit, instead of finding out at CI/PR-review time. It exposes exactly one tool, scanforsecrets, runs entirely locally over stdio, needs no API key, and never returns a raw secret value — every finding comes back redacted.
Why this exists
secret-scan-action already catches these secrets in CI, on every PR. That's necessary but late — by the time it runs, the secret has already been written, committed, and pushed. This project reuses that same detection engine (same rules, same entropy check, same redaction) but puts it in front of the agent as a tool call, so the check can happen at generation time, before the secret ever touches disk or history.
What it does
On a scanforsecrets call:
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Secretguard: common questions
- Is Secretguard MCP server safe?
- Mostly: it is graded B (80/100). Read the Secretguard safety report
- Does Secretguard need an API key?
- Not as far as the registry entry and our scan can tell: no credentials are declared or required.
- Is Secretguard maintained?
- The last commit was 83 days ago (2026-08-13). The latest release is v0.1.4.
- What can I use instead of Secretguard?
- Servers from other publishers that do the same job: Idea Reality MCP server, Webhook Toolkit MCP server and Stripe MCP server.
Alternatives to Secretguard
Same job from other publishers: the closest match first, then the best rated.
- Idea RealityPre-build reality check. Scans GitHub, HN, npm, PyPI, Product Hunt — returns 0-100 signal.not reviewedEstablishedB
Webhook ToolkitWebhook URLs for AI agents: receive, wait for, replay, sign and verify webhooks (Stripe, GitHub…).not reviewedGrowingA
StripeMCP server integrating with Stripe - tools for customers, products, payments, and more.not reviewedEstablishedA- Polymarket ToolkitRead-only Polymarket data tools for AI agents: profiles, PnL, market scans. No keys, no orders.not reviewedEstablishedB
- Stripe AcpStripe ACP — AI agent checkout, payment delegation, products, invoicesnot reviewedGrowingB
