All projects matching “secret scan”

Secret scan for exposed API keys, tokens, passwords, and credentials in text — returns redacted output without exposing matched secret values. Ideal for agent pre-flight checks before sharing config or logs.

Run a bounded deterministic preflight scan for possible private keys, secret assignments, permissive CORS, debug mode, insecure HTTP, and invalid JSON. Not a comprehensive security audit.

Scan source code or configuration text for hardcoded secrets: AWS access keys, GitHub/Slack/Google tokens, Stripe and OpenAI keys, PEM private-key blocks, JWTs and high-entropy secret assignments. Placeholder values are filtered out. Each finding gives the rule, a severity (critical/high/medium/low), line and column, entropy and a masked excerpt. Offline and deterministic.

GitHub-Audit Repository Supply-Chain & Dependency Scanner: Audits open-source repositories for supply-chain risks, CVEs, and secret leaks.

MCP Server Scan by Agentropolis: scan a live remote MCP server URL (or pasted tools/list) before your agent connects. Reads initialize + tools/list only, never calls a tool. Flags poisoned or hidden tool instructions (IMPORTANT tags, conceal-from-user, secret or side-channel asks, invisible Unicode, tool shadowing, payment injection). Fingerprints every tool (sha256) and diffs vs your last scan to