env-secret-exposure-analyzer-mcp
About
Scans projects for secret exposure risks in .env files and logs
Details
- Author
- vola-trebla
- Categories
- Developer Tools, Security
Jump to
Setup
Install env-secret-exposure-analyzer-mcp in your MCP client (Claude Desktop, Cursor, Windsurf, and others).
Repository: https://github.com/vola-trebla/env-secret-exposure-analyzer-mcp
Follow the installation instructions in the repository README, then restart your MCP client.
Scans projects for secret exposure risks in .env files and logs
Your AI agent is one debug session away from leaking your secrets.
MCP server that scans your project for secret exposure risks — hardcoded API keys, unprotected.envfiles, andconsole.logcalls that print credentials at runtime. Before your agent accidentally reads them out loud.
You ask your AI agent to debug a config issue. It readssrc/config.ts. Inside:
console.log('Config loaded:', JSON.stringify(config)); console.log(process.env.DATABASE_PASSWORD);
The agent now has your database password in its context. It might log it, include it in a summary, or pass it to another tool. And your.envisn't in.gitignore, so the nextgit pushwill do the rest.
None of this requires the agent to be malicious. It just needs to be helpful.
env-secret-exposure-analyzer-mcpcatches this before it happens. 🔐
Scans source files, config files, and.envfiles for 20+ secret patterns. Returns file path, line number, severity, and a masked preview — never the full value.
- AWS access keys + secret keys
- GitHub tokens (ghp_,gho_,ghs_)
- Stripe secret/publishable keys + webhook secrets (whsec_)
- Anthropic, OpenAI API keys
- SendGrid (SG.xxx), Twilio auth token + account SID
- Google API keys + OAuth client secrets (GOCSPX-)
- Slack tokens (xox)
- Private keys (-----BEGIN ... PRIVATE KEY-----)
- Database URLs with embedded credentials (postgres://user:pass@host)
- JWT secrets, session secrets, encryption keys
- Sentry DSN, Datadog API key
- Generic hardcoded passwords, secrets, tokens
Secret Scan Results Project: /project Files scanned: 24 Findings: 5 [CRITICAL] .env:3 — AWS Access Key Preview: AKIAMPLE [CRITICAL] .env:7 — Database URL with password Preview: postsswd [CRITICAL] src/auth.ts:12 — Hardcoded JWT secret Preview: my-secret [HIGH] .env:14 — Hardcoded session secret Preview: sesskey! [MEDIUM] .env:28 — Sentry DSN Preview: http7890
Checks whether sensitive files (.env,.env.local,secrets.json, private keys, certificates) are covered by.gitignore. Flags files that could be accidentally committed.
Gitignore Coverage Check Project: /project ✗ .env → Add to .gitignore: .env ✗ .env.local → Add to .gitignore: .env.local ✓ secrets.json
Scans source files forconsole.log/loggercalls that printprocess.envvariables or objects with secret-sounding names at runtime. Catches the most common "it's just a debug line" mistakes.
Log Leak Scan Project: /project Files scanned: 18 Findings: 3 [CRITICAL] src/config.ts:8 console.log("Config loaded:", JSON.stringify(config)); [HIGH] src/server.ts:42 console.log(process.env.AWS_SECRET_ACCESS_KEY); [HIGH] src/db.ts:15 logger.info({ password: dbConfig.password });
A realistic.envwith 20 secrets — database URLs, AWS, Stripe, Twilio, SendGrid, Google OAuth, Sentry, JWT secrets, encryption keys. Before this MCP: an AI agent reads the file, has no idea what's sensitive, and proceeds to use those values in generated code or responses.
After onescan_for_secretscall:16 findings, all categorized by severity, all previews masked. The agent knows exactly what's dangerous before it touches anything.
{ "mcpServers": { "secret-scanner": { "command": "npx", "args": ["-y", "env-secret-exposure-analyzer-mcp"] } } }
"Scan this project for any secrets or API keys that might be exposed. Check if .env files are in .gitignore, and look for any console.log calls that might be leaking credentials."
The agent runs all three tools in sequence and reports a full picture: what's hardcoded, what's not protected, what's being logged.
- tsconfig-inheritance-flattener-mcp— for TypeScript config analysis
- release-readiness-triage-mcp— for CI triage before release
- ast-impact-mapper-mcp— for code→test correlation
- npm:npmjs.com/package/env-secret-exposure-analyzer-mcp
- GitHub:*github.com/vola-trebla/env-secret-exposure-analyzer-mcp
This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.
Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning with Cycode.
Enable AI agents to secure code with Semgrep.
AI-powered code quality analysis to detect best practice violations, security issues, and architectural problems in real-time.
AI-powered security scanning. Scans code, files, and git diffs for vulnerabilities in real-time using the Armis scanning API.
Access the Codacy API to analyze code quality, coverage, and security for your repositories.
MCP Server for local code security scanning - detects secrets, vulnerable dependencies, and insecure code patterns
Provides AI agents with access to development best practices, security guidelines, and coding standards.
Strict AI code reviewer powered by Groq. Finds bugs, SQL injections, hardcoded secrets and vulnerabilities. Scores code 0–100 with concrete fixes.
Official MCP server for the pyobfus Python obfuscator — pre-flight risk scan, framework-aware config init, reverse stack-trace mapping
RepoFortify is a remote MCP server for production-readiness and security scanning. Connect it to your AI coding tool — Lovable, ChatGPT, Codex, Claude Code, Cursor, and other MCP clients — and scan your repository, review risk findings, and get AI fix plans without leaving where you build. Authentication required on every request; your data stays isolated to you.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
