Secret Sentinel

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/alebrito124356-mcp-secret-sentinel

About

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools

8 read · 1 write · 0 delete

Secrets

None asked for

Install scripts

None found

Runs as

Python package

Tools (9)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• list_patterns

  List the active secret detectors and allowlist rules. Returns: {"count": int, "patterns": [{"name", "severity", "advice"}], "entropy_detector": {...threshold and advice...}, "allowlist_rules": [{"name", "description"}]} Raw regexes are intentionally not exposed.

• redact_text

  Return the text with every detected secret replaced by [REDACTED:<detector>]. Use it before quoting logs, stack traces, configs, command output or diffs that may contain credentials, in the conversation, an issue, a commit message or a document. Everything that is not a secret is kept exactly as it was. Args: text: The text to clean. Returns: {"text": the redacted text, "redactions": how many secrets were replaced, "by_pattern": {detector name: count}}

• scan_agent_configs

  Audit AI agent and MCP client configuration files for hardcoded secrets. Checks the project's .mcp.json, .claude/settings*.json, .cursor/mcp.json, .vscode/mcp.json, .gemini/, .codex/ and other client configs, plus agent instruction files (CLAUDE.md, AGENTS.md, GEMINI.md, .cursorrules...), and the user-level configs of Claude Code, Claude Desktop, Cursor, VS Code, Cline, Windsurf, Gemini CLI, Codex, Kiro, Continue, Zed and others. Project files report whether git tracks them: a key in a tracked .mcp.json ships with the repository. Args: project_path: Absolute path to the project to audit …

• scan_directory

  Recursively scan a directory tree for exposed secrets. Inside a git repository the file list comes from git (tracked files plus untracked files no .gitignore excludes), so every ignore rule is honoured. Always skips .git, node_modules, virtualenvs, caches, dist, build, minified bundles, lockfiles, binaries, files over 5 MB and the paths the project's .secret-sentinel.toml excludes. Args: path: Absolute path to the directory to scan. max_files: Stop after scanning this many files (default 500). max_findings: List at most this many findings, most severe first (default 200, …

• scan_file

  Scan a single file for exposed secrets. UTF-8, UTF-16 and UTF-32 text is decoded by byte-order mark. Binary files (null-byte heuristic) and files larger than 5 MB are skipped and reported as such in the summary. The project's .secret-sentinel.toml and baseline apply. Args: path: Absolute path to the file to scan. max_findings: List at most this many findings, most severe first (default 200, 0 = no limit). Returns: The standard redacted findings report (see scan_text). Returns an error result if the file does not exist.

• scan_git_history

  Scan the lines added by the most recent commits (git log -p). Each finding is tagged with the short hash of the commit that introduced it. A secret that was later deleted is still reported — history retains it, so the credential must be rotated regardless. Args: repo_path: Absolute path to a git repository (or any path inside one). max_commits: How many commits back to inspect (default 50). all_branches: Walk every branch, tag and the stash instead of only the history of HEAD (default false). max_findings: List at most this many findings, most severe first (de…

• scan_git_range

  Scan the commits in base..head: by default, what `git push` would send. Run this before pushing. With the defaults it scans every commit on the current branch that its upstream does not have yet. If the branch has no upstream, the error says so: pass the branch you will push to as base (for example "origin/main"). Args: repo_path: Absolute path to a git repository (or any path inside one). base: Commits reachable from here are excluded (default "@{upstream}"). head: Last commit to include (default "HEAD"). max_commits: Scan at most this many of the newest commits in the range…

• scan_git_staged

  Scan ONLY the lines currently staged for commit (git diff --cached). This is the pre-commit checkpoint: it inspects exactly the content the next commit would publish, and reports the file and post-commit line number of every added secret. Local diff settings (external diff tools, textconv filters, prefixes, path quoting) are overridden, and git runs no configured programs. Args: repo_path: Absolute path to a git repository (or any path inside one). max_findings: List at most this many findings, most severe first (default 200, 0 = no limit). Returns: The standard redacted…

• scan_text

  Scan a snippet of text or code for exposed secrets. 64 detectors: GitHub/GitLab/npm/PyPI tokens; OpenAI, Anthropic, xAI, DeepSeek, Perplexity, OpenRouter, Groq, NVIDIA, Hugging Face, Replicate, Together, Cerebras, LangSmith, Langfuse, Pinecone, Firecrawl and Tavily keys; AWS (incl. Bedrock), Azure, Google, DigitalOcean, Cloudflare, Vercel, Supabase, Neon, PlanetScale, Fly.io, Databricks, Vault and Doppler credentials; Stripe, Square, Shopify, SendGrid, Resend, Mailchimp, Twilio, Slack, Discord, Telegram, Linear, Notion, Atlassian, Postman, Sentry, Grafana and PostHog tokens; JWTs, private and…

Signals

Stars

3

Forks

0

Open issues

0

Weekly downloads

147

Last commit

Oct 19, 2026 (13 days ago)

Last release

Oct 19, 2026 (13 days ago)

Last package publish

Oct 19, 2026 (13 days ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name

io.github.AleBrito124356/mcp-secret-sentinel

Version

0.3.0

Auth

No auth

Packages

pypi mcp-secret-sentinel

License

MIT

Repository

github.com/AleBrito124356/mcp-secret-sentinel

First seen

Oct 24, 2026

Last checked

Nov 1, 2026

Source

Official MCP Registrygithub-graphql