Env Secret Exposure Analyzer MCP

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/vola-trebla-env-secret-exposure-analyzer-mcp

About

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools

5 read · 0 write · 0 deleteRead-only

Secrets

None asked for

Install scripts

Not scanned yet

Runs as

Node.js package

Tools (5)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• check_gitignore_coverage

  Check whether sensitive files (.env, .env.local, secrets.json, etc.) are properly covered by .gitignore rules. Flags files that contain secrets but could be accidentally committed.

• scan_ci_workflows

  Scans GitHub Actions (.github/workflows/*.yml), CircleCI (.circleci/config.yml), and GitLab CI (.gitlab-ci.yml) workflow files for dangerous secret interpolation patterns. Detects ${{ secrets.* }} and ${{ github.token }} used directly in run: steps (log_leak risk — GitHub Actions logs the expanded plaintext) and ${{ github.event.pull_request.* }} / issue / commit content interpolated in shell commands (injection risk — attacker-controlled input). Returns file, job, step, pattern_found, risk, and recommendation.

• scan_for_log_leaks

  Scan source files for console.log / logger calls that may print environment variables or secrets at runtime. Catches patterns like console.log(process.env.SECRET) or logger.info({ apiKey }) before they reach production logs.

• scan_for_secrets

  Scan a project directory for hardcoded secrets, API keys, tokens, and passwords. Detects patterns like AWS keys, GitHub tokens, Stripe keys, private keys, and generic high-entropy strings. Returns file path, line number, severity, and a masked preview.

• scan_git_history

  Scan the git commit history of a repository for secrets that were ever committed, even if later deleted. Detects hardcoded API keys, tokens, passwords, and other credentials added in diff hunks across recent commits. Returns each finding with its commit hash, file, line, severity, a masked preview, entropy score, whether the secret is still present in the working tree, and whether rotation is required. Respects .gitleaksignore.

Signals

Stars

0

Forks

0

Open issues

0

Last commit

May 20, 2026 (5 months ago)

Last release

May 20, 2026 (5 months ago)

From GitHub (fetched Oct 24, 2026).

Details

Registry name

io.github.vola-trebla/env-secret-exposure-analyzer-mcp

Version

0.2.0

Auth

No auth

Packages

npm env-secret-exposure-analyzer-mcp

License

MIT

Repository

github.com/vola-trebla/env-secret-exposure-analyzer-mcp

First seen

Oct 24, 2026

Last checked

Oct 24, 2026

Source

Official MCP Registrygithub-graphql