@guardbee/mcp-secret-scanner 0.2.0 → 0.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +44 -42
- package/TR.md +159 -0
- package/package.json +4 -3
package/README.md
CHANGED
|
@@ -1,33 +1,35 @@
|
|
|
1
1
|
# @guardbee/mcp-secret-scanner
|
|
2
2
|
|
|
3
|
+
**🇬🇧 English** | [🇹🇷 Türkçe](TR.md)
|
|
4
|
+
|
|
3
5
|
[](https://www.npmjs.com/package/@guardbee/mcp-secret-scanner)
|
|
4
6
|
[](https://www.npmjs.com/package/@guardbee/mcp-secret-scanner)
|
|
5
7
|
[](LICENSE)
|
|
6
8
|
|
|
7
|
-
|
|
9
|
+
An MCP server that scans your source files, directories, and environment configs for exposed API keys, passwords, tokens, and other secrets. Ask Claude directly whether your project is leaking secrets.
|
|
8
10
|
|
|
9
|
-
>
|
|
11
|
+
> This package sends usage telemetry by default (tool name + short parameters like a file path — the scanned file content is never included, see [`@guardbee/mcp-telemetry`](../telemetry/README.md)). Disable with `GUARDBEE_TELEMETRY=0`.
|
|
10
12
|
|
|
11
13
|
---
|
|
12
14
|
|
|
13
|
-
##
|
|
15
|
+
## Features
|
|
14
16
|
|
|
15
|
-
- **40+ Secret
|
|
16
|
-
- **
|
|
17
|
-
- **
|
|
18
|
-
- **
|
|
19
|
-
- **Allowlist
|
|
20
|
-
- **16 Unit
|
|
17
|
+
- **40+ Secret Patterns** — AWS, GitHub, GitLab, Stripe, OpenAI, Anthropic, HuggingFace, Slack, Twilio, SendGrid, and more
|
|
18
|
+
- **File & Directory Scanning** — a single file or an entire project tree
|
|
19
|
+
- **Smart Skipping** — directories like `node_modules`, `.git`, `dist`, `build`, `.next` are skipped automatically
|
|
20
|
+
- **Safe Redaction** — matches are shown as first 4 + stars + last 4 characters
|
|
21
|
+
- **Allowlist Support** — allowlist known test/fake values
|
|
22
|
+
- **16 Unit Tests** — 100% passing test suite
|
|
21
23
|
|
|
22
24
|
---
|
|
23
25
|
|
|
24
|
-
##
|
|
26
|
+
## Quick Start
|
|
25
27
|
|
|
26
28
|
```bash
|
|
27
29
|
npm install -g @guardbee/mcp-secret-scanner
|
|
28
30
|
```
|
|
29
31
|
|
|
30
|
-
`claude_desktop_config.json
|
|
32
|
+
Add to `claude_desktop_config.json`:
|
|
31
33
|
|
|
32
34
|
```json
|
|
33
35
|
{
|
|
@@ -44,67 +46,67 @@ npm install -g @guardbee/mcp-secret-scanner
|
|
|
44
46
|
|
|
45
47
|
## MCP Tools
|
|
46
48
|
|
|
47
|
-
| Tool |
|
|
49
|
+
| Tool | Description |
|
|
48
50
|
|------|----------|
|
|
49
|
-
| `scan_text` |
|
|
50
|
-
| `scan_file` |
|
|
51
|
-
| `scan_directory` |
|
|
52
|
-
| `list_patterns` |
|
|
51
|
+
| `scan_text` | Scans the given text for secrets |
|
|
52
|
+
| `scan_file` | Scans a single file |
|
|
53
|
+
| `scan_directory` | Recursively scans a directory and its subdirectories |
|
|
54
|
+
| `list_patterns` | Lists all active secret patterns |
|
|
53
55
|
|
|
54
|
-
###
|
|
56
|
+
### Example Usage
|
|
55
57
|
|
|
56
|
-
|
|
58
|
+
You can ask Claude:
|
|
57
59
|
|
|
58
|
-
> "
|
|
60
|
+
> "Scan my project for secrets: `/Users/me/my-app`"
|
|
59
61
|
|
|
60
|
-
> "
|
|
62
|
+
> "Are there any secrets in this `.env` file?"
|
|
61
63
|
|
|
62
|
-
> "
|
|
64
|
+
> "Is this text safe: `export API_KEY=sk-abc123...`"
|
|
63
65
|
|
|
64
66
|
---
|
|
65
67
|
|
|
66
|
-
##
|
|
68
|
+
## Detected Secret Types
|
|
67
69
|
|
|
68
|
-
|
|
|
70
|
+
| Category | Examples |
|
|
69
71
|
|----------|---------|
|
|
70
72
|
| Cloud | AWS Access Key, AWS Secret, GCP API Key |
|
|
71
73
|
| Source Control | GitHub PAT, GitLab Token |
|
|
72
|
-
|
|
|
74
|
+
| Payments | Stripe Secret/Publishable Key |
|
|
73
75
|
| AI | OpenAI API Key, Anthropic API Key, HuggingFace Token |
|
|
74
|
-
|
|
|
75
|
-
|
|
|
76
|
-
|
|
|
76
|
+
| Communication | Slack Bot Token, Twilio Auth Token, SendGrid Key |
|
|
77
|
+
| Database | PostgreSQL URL, MySQL URL, MongoDB URI, Redis URL |
|
|
78
|
+
| Cryptography | RSA Private Key, EC Private Key, OpenSSH Key, PGP Key |
|
|
77
79
|
| Web | JWT Token, Bearer Token |
|
|
78
|
-
|
|
|
79
|
-
|
|
|
80
|
+
| Package/Platform | npm Token, Docker Hub Token, Vercel Token |
|
|
81
|
+
| Generic | `SECRET=`, `PASSWORD=`, `API_KEY=` patterns |
|
|
80
82
|
|
|
81
83
|
---
|
|
82
84
|
|
|
83
|
-
##
|
|
85
|
+
## Security Note
|
|
84
86
|
|
|
85
|
-
|
|
87
|
+
This tool **partially redacts** matched values in scan results (e.g. `sk_live_abc1...xyz9`). Full values are never logged or exported.
|
|
86
88
|
|
|
87
89
|
---
|
|
88
90
|
|
|
89
|
-
## CLI — CI/CD
|
|
91
|
+
## CLI — CI/CD Integration
|
|
90
92
|
|
|
91
|
-
MCP server
|
|
93
|
+
In addition to MCP server mode, this can also be used directly as a CLI:
|
|
92
94
|
|
|
93
95
|
```bash
|
|
94
|
-
#
|
|
96
|
+
# Scan a project directory
|
|
95
97
|
npx @guardbee/mcp-secret-scanner scan ./my-project
|
|
96
98
|
|
|
97
|
-
#
|
|
99
|
+
# Scan a single file
|
|
98
100
|
npx @guardbee/mcp-secret-scanner scan .env
|
|
99
101
|
|
|
100
|
-
#
|
|
102
|
+
# Fail only on critical/high
|
|
101
103
|
npx @guardbee/mcp-secret-scanner scan . --fail-on=high
|
|
102
104
|
|
|
103
|
-
# JSON
|
|
105
|
+
# JSON output (for CI reporting)
|
|
104
106
|
npx @guardbee/mcp-secret-scanner scan . --format=json
|
|
105
107
|
```
|
|
106
108
|
|
|
107
|
-
**Exit
|
|
109
|
+
**Exit codes:** `0` = no secrets found · `1` = secrets found · `2` = error
|
|
108
110
|
|
|
109
111
|
### GitHub Actions
|
|
110
112
|
|
|
@@ -142,16 +144,16 @@ npx @guardbee/mcp-secret-scanner scan . --fail-on=critical || exit 1
|
|
|
142
144
|
|
|
143
145
|
---
|
|
144
146
|
|
|
145
|
-
##
|
|
147
|
+
## Development
|
|
146
148
|
|
|
147
149
|
```bash
|
|
148
150
|
npm install
|
|
149
|
-
npm test # 16 unit
|
|
150
|
-
npm run build # TypeScript
|
|
151
|
+
npm test # 16 unit tests
|
|
152
|
+
npm run build # TypeScript compile
|
|
151
153
|
```
|
|
152
154
|
|
|
153
155
|
---
|
|
154
156
|
|
|
155
|
-
##
|
|
157
|
+
## License
|
|
156
158
|
|
|
157
159
|
MIT — [GuardBee](https://guardbee.ai)
|
package/TR.md
ADDED
|
@@ -0,0 +1,159 @@
|
|
|
1
|
+
# @guardbee/mcp-secret-scanner
|
|
2
|
+
|
|
3
|
+
[🇬🇧 English](README.md) | **🇹🇷 Türkçe**
|
|
4
|
+
|
|
5
|
+
[](https://www.npmjs.com/package/@guardbee/mcp-secret-scanner)
|
|
6
|
+
[](https://www.npmjs.com/package/@guardbee/mcp-secret-scanner)
|
|
7
|
+
[](LICENSE)
|
|
8
|
+
|
|
9
|
+
Kaynak dosyalarınızı, dizinleri ve ortam konfigürasyonlarını açık API key, parola, token ve diğer gizli bilgiler açısından tarayan MCP sunucusu. Claude'a doğrudan projenizden secret sızdırıp sızdırmadığınızı sorabilirsiniz.
|
|
10
|
+
|
|
11
|
+
> Bu paket varsayılan olarak kullanım telemetrisi gönderir (tool adı + dosya yolu gibi kısa parametreler — taranan dosya içeriği hiçbir zaman dahil değil, bkz. [`@guardbee/mcp-telemetry`](../telemetry/TR.md)). Kapatmak için `GUARDBEE_TELEMETRY=0`.
|
|
12
|
+
|
|
13
|
+
---
|
|
14
|
+
|
|
15
|
+
## Özellikler
|
|
16
|
+
|
|
17
|
+
- **40+ Secret Deseni** — AWS, GitHub, GitLab, Stripe, OpenAI, Anthropic, HuggingFace, Slack, Twilio, SendGrid ve daha fazlası
|
|
18
|
+
- **Dosya & Dizin Tarama** — Tek dosya veya tüm proje ağacı
|
|
19
|
+
- **Akıllı Atlama** — `node_modules`, `.git`, `dist`, `build`, `.next` gibi dizinler otomatik atlanır
|
|
20
|
+
- **Güvenli Redaksyon** — Eşleşmeler ilk 4 + yıldız + son 4 karakter olarak gösterilir
|
|
21
|
+
- **Allowlist Desteği** — Bilinen test/sahte değerleri beyaz listeye alın
|
|
22
|
+
- **16 Unit Test** — %100 geçen test paketi
|
|
23
|
+
|
|
24
|
+
---
|
|
25
|
+
|
|
26
|
+
## Hızlı Başlangıç
|
|
27
|
+
|
|
28
|
+
```bash
|
|
29
|
+
npm install -g @guardbee/mcp-secret-scanner
|
|
30
|
+
```
|
|
31
|
+
|
|
32
|
+
`claude_desktop_config.json` dosyasına ekleyin:
|
|
33
|
+
|
|
34
|
+
```json
|
|
35
|
+
{
|
|
36
|
+
"mcpServers": {
|
|
37
|
+
"guardbee-secret-scanner": {
|
|
38
|
+
"command": "npx",
|
|
39
|
+
"args": ["-y", "@guardbee/mcp-secret-scanner"]
|
|
40
|
+
}
|
|
41
|
+
}
|
|
42
|
+
}
|
|
43
|
+
```
|
|
44
|
+
|
|
45
|
+
---
|
|
46
|
+
|
|
47
|
+
## MCP Tools
|
|
48
|
+
|
|
49
|
+
| Tool | Açıklama |
|
|
50
|
+
|------|----------|
|
|
51
|
+
| `scan_text` | Verilen metin içinde secret tarar |
|
|
52
|
+
| `scan_file` | Tek bir dosyayı tarar |
|
|
53
|
+
| `scan_directory` | Bir dizini ve alt dizinlerini yinelemeli olarak tarar |
|
|
54
|
+
| `list_patterns` | Tüm aktif secret desenlerini listeler |
|
|
55
|
+
|
|
56
|
+
### Örnek Kullanım
|
|
57
|
+
|
|
58
|
+
Claude'a şunu sorabilirsiniz:
|
|
59
|
+
|
|
60
|
+
> "Projemdeki gizli bilgileri tara: `/Users/me/my-app`"
|
|
61
|
+
|
|
62
|
+
> "Bu `.env` dosyasında secret var mı?"
|
|
63
|
+
|
|
64
|
+
> "Şu metin güvenli mi: `export API_KEY=sk-abc123...`"
|
|
65
|
+
|
|
66
|
+
---
|
|
67
|
+
|
|
68
|
+
## Tespit Edilen Secret Türleri
|
|
69
|
+
|
|
70
|
+
| Kategori | Örnekler |
|
|
71
|
+
|----------|---------|
|
|
72
|
+
| Cloud | AWS Access Key, AWS Secret, GCP API Key |
|
|
73
|
+
| Source Control | GitHub PAT, GitLab Token |
|
|
74
|
+
| Ödeme | Stripe Secret/Publishable Key |
|
|
75
|
+
| AI | OpenAI API Key, Anthropic API Key, HuggingFace Token |
|
|
76
|
+
| İletişim | Slack Bot Token, Twilio Auth Token, SendGrid Key |
|
|
77
|
+
| Veritabanı | PostgreSQL URL, MySQL URL, MongoDB URI, Redis URL |
|
|
78
|
+
| Kriptografi | RSA Private Key, EC Private Key, OpenSSH Key, PGP Key |
|
|
79
|
+
| Web | JWT Token, Bearer Token |
|
|
80
|
+
| Paket / Platform | npm Token, Docker Hub Token, Vercel Token |
|
|
81
|
+
| Genel | `SECRET=`, `PASSWORD=`, `API_KEY=` kalıpları |
|
|
82
|
+
|
|
83
|
+
---
|
|
84
|
+
|
|
85
|
+
## Güvenlik Notu
|
|
86
|
+
|
|
87
|
+
Bu araç tarama sonuçlarında eşleşen değerleri **kısmen redakte eder** (`sk_live_abc1...xyz9` gibi). Tam değerler asla log'a yazılmaz veya dışarı aktarılmaz.
|
|
88
|
+
|
|
89
|
+
---
|
|
90
|
+
|
|
91
|
+
## CLI — CI/CD Entegrasyonu
|
|
92
|
+
|
|
93
|
+
MCP server moduna ek olarak doğrudan CLI olarak da kullanılabilir:
|
|
94
|
+
|
|
95
|
+
```bash
|
|
96
|
+
# Proje dizinini tara
|
|
97
|
+
npx @guardbee/mcp-secret-scanner scan ./my-project
|
|
98
|
+
|
|
99
|
+
# Tek dosya tara
|
|
100
|
+
npx @guardbee/mcp-secret-scanner scan .env
|
|
101
|
+
|
|
102
|
+
# Sadece critical/high'da başarısız ol
|
|
103
|
+
npx @guardbee/mcp-secret-scanner scan . --fail-on=high
|
|
104
|
+
|
|
105
|
+
# JSON çıktı (CI raporlama için)
|
|
106
|
+
npx @guardbee/mcp-secret-scanner scan . --format=json
|
|
107
|
+
```
|
|
108
|
+
|
|
109
|
+
**Exit kodları:** `0` = secret bulunamadı · `1` = secret bulundu · `2` = hata
|
|
110
|
+
|
|
111
|
+
### GitHub Actions
|
|
112
|
+
|
|
113
|
+
```yaml
|
|
114
|
+
name: Secret Scan
|
|
115
|
+
on: [push, pull_request]
|
|
116
|
+
|
|
117
|
+
jobs:
|
|
118
|
+
secret-scan:
|
|
119
|
+
runs-on: ubuntu-latest
|
|
120
|
+
steps:
|
|
121
|
+
- uses: actions/checkout@v4
|
|
122
|
+
- name: Scan for exposed secrets
|
|
123
|
+
run: npx @guardbee/mcp-secret-scanner scan . --fail-on=high
|
|
124
|
+
```
|
|
125
|
+
|
|
126
|
+
### GitLab CI
|
|
127
|
+
|
|
128
|
+
```yaml
|
|
129
|
+
secret-scan:
|
|
130
|
+
image: node:20
|
|
131
|
+
script:
|
|
132
|
+
- npx @guardbee/mcp-secret-scanner scan . --fail-on=high
|
|
133
|
+
only:
|
|
134
|
+
- merge_requests
|
|
135
|
+
- main
|
|
136
|
+
```
|
|
137
|
+
|
|
138
|
+
### Pre-commit Hook
|
|
139
|
+
|
|
140
|
+
```bash
|
|
141
|
+
# .git/hooks/pre-commit
|
|
142
|
+
npx @guardbee/mcp-secret-scanner scan . --fail-on=critical || exit 1
|
|
143
|
+
```
|
|
144
|
+
|
|
145
|
+
---
|
|
146
|
+
|
|
147
|
+
## Geliştirme
|
|
148
|
+
|
|
149
|
+
```bash
|
|
150
|
+
npm install
|
|
151
|
+
npm test # 16 unit test
|
|
152
|
+
npm run build # TypeScript derleme
|
|
153
|
+
```
|
|
154
|
+
|
|
155
|
+
---
|
|
156
|
+
|
|
157
|
+
## Lisans
|
|
158
|
+
|
|
159
|
+
MIT — [GuardBee](https://guardbee.ai)
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@guardbee/mcp-secret-scanner",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.1",
|
|
4
4
|
"description": "MCP server that scans files and directories for exposed secrets, API keys, and credentials",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|
|
@@ -16,12 +16,13 @@
|
|
|
16
16
|
},
|
|
17
17
|
"files": [
|
|
18
18
|
"dist",
|
|
19
|
-
"README.md"
|
|
19
|
+
"README.md",
|
|
20
|
+
"TR.md"
|
|
20
21
|
],
|
|
21
22
|
"dependencies": {
|
|
22
23
|
"@modelcontextprotocol/sdk": "^1.0.0",
|
|
23
24
|
"zod": "^4.5.4",
|
|
24
|
-
"@guardbee/mcp-telemetry": "^0.1.
|
|
25
|
+
"@guardbee/mcp-telemetry": "^0.1.1"
|
|
25
26
|
},
|
|
26
27
|
"keywords": [
|
|
27
28
|
"mcp",
|