GhostHunt

Find every leaked secret on your machine.

GhostHunt is an MCP server that scans your development machine for API keys, tokens, and credentials hiding in places you forgot to check:.envfiles scattered across projects, shell history, AWS/SSH/Docker configs, and more.

Everything runs locally. No data leaves your machine.

- Environment files— recursively finds every.env,.env.local,.env.production, etc. under your home directory
- AWS credentials—~/.aws/credentialsand session tokens
- SSH keys— unprotected private keys in~/.ssh/
- Docker config— registry auth tokens in~/.docker/config.json
- npm/PyPI tokens—~/.npmrc,~/.pypircauth tokens
- GitHub CLI— OAuth tokens in~/.config/gh/hosts.yml
- Shell history— API keys pasted intobash,zsh, orfishcommands
- Kubernetes—~/.kube/configcredentials
- Netrc—~/.netrcpasswords
- 35+ secret patterns— AWS, Stripe, GitHub, OpenAI, Anthropic, Google, Slack, Twilio, SendGrid, database connection strings, private keys, and more

Add to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.jsonon macOS):

{ "mcpServers": { "ghosthunt": { "command": "npx", "args": ["-y", "ghosthunt"] } } }

Restart Claude Desktop. Then ask Claude:"Scan my machine for leaked secrets"

Full detailed scan. Returns every finding with file paths, line numbers, severity ratings, and remediation steps.

Example prompt:"Run a full GhostHunt scan and show me everything"

Quick health check. Returns your health score (0-100) and a count by severity. Run this first to see if you have a problem.

Example prompt:"Give me a quick GhostHunt health check"

# GhostHunt Scan Report Health Score: 37/100 (Critical) - Secrets found: 12 - Critical: 3 | High: 5 | Medium: 2 | Low: 2 - Locations scanned: 47 - Scan time: 142ms ## Environment Files (.env) - [CRITICAL] Stripe Live Secret Key - File: /Users/you/project-a/.env:4 - Context: STRIPE_SECRET_KEY - Value: sk_l*_8xQ - [CRITICAL] OpenAI API Key - File: /Users/you/side-project/.env.local:12 - Context: OPENAI_API_KEY - Value: sk-pkFJ9 ## Shell History - [HIGH] Bearer Token in Header - File: /Users/you/.zsh_history:8847 - Context: curl -H "Authorization: Bearer sk_live_... - Value: sk_l_m3K ## Recommendations 1. Rotate critical secrets immediately. Any API key marked CRITICAL should be revoked and regenerated from the provider's dashboard. 2. Clear your shell history of sensitive commands. 3. Audit your .env files.* Ensure they are in .gitignore.

Your score starts at 100 and drops based on what GhostHunt finds:

A score below 50 means you have secrets that need immediate attention.

GhostHunt runs entirely on your local machine. It does not:

- Send any data to any server
- Phone home or track usage
- Store scan results anywhere
- Access the internet

Your secrets stay on your machine. The scan results stay in your Claude conversation.

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning with Cycode.

Enable AI agents to secure code with Semgrep.

An engineering governance and safety control plane for AI coding agents to enforce strict SDLC discipline, quality gates, and security branch protections.

AI-powered security scanning. Scans code, files, and git diffs for vulnerabilities in real-time using the Armis scanning API.

MCP server that vets LLM-emitted shell commands BEFORE execution. 30 detection rules across destructive file ops, package managers, system, database, git, network, exfiltration, privilege escalation. Sub-second, local, free.

Give your coding agent the dependency graph it is about to change: scan a source tree, SBOM, Git ref, or container image; explain why a package is present; diff two graphs; check findings against policy.

BoostSecurity MCP acts as a safeguard preventing agents from adding vulnerable packages into projects. It analyzes every package an AI agent introduces, flags unsafe dependencies, and recommends secure, maintained alternatives to keep projects protected.

A secure MCP server for executing controlled command-line operations with comprehensive security features.

Access the Codacy API to analyze code quality, coverage, and security for your repositories.

Execute pre-approved shell commands securely on a server.