@streamblur/mcp 1.5.13 → 1.5.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +189 -42
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -1,37 +1,86 @@
|
|
|
1
|
-
|
|
1
|
+
```
|
|
2
|
+
██████╗████████╗██████╗ ███████╗ █████╗ ███╗ ███╗██████╗ ██╗ ██╗ ██╗██████╗
|
|
3
|
+
██╔════╝╚══██╔══╝██╔══██╗██╔════╝██╔══██╗████╗ ████║██╔══██╗██║ ██║ ██║██╔══██╗
|
|
4
|
+
╚█████╗ ██║ ██████╔╝█████╗ ███████║██╔████╔██║██████╔╝██║ ██║ ██║██████╔╝
|
|
5
|
+
╚═══██╗ ██║ ██╔══██╗██╔══╝ ██╔══██║██║╚██╔╝██║██╔══██╗██║ ██║ ██║██╔══██╗
|
|
6
|
+
██████╔╝ ██║ ██║ ██║███████╗██║ ██║██║ ╚═╝ ██║██████╔╝███████╗╚██████╔╝██║ ██║
|
|
7
|
+
╚═════╝ ╚═╝ ╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝╚═╝ ╚═╝╚═════╝ ╚══════╝ ╚═════╝ ╚═╝ ╚═╝
|
|
8
|
+
|
|
9
|
+
███╗ ███╗ ██████╗██████╗
|
|
10
|
+
████╗ ████║██╔════╝██╔══██╗
|
|
11
|
+
██╔████╔██║██║ ██████╔╝
|
|
12
|
+
██║╚██╔╝██║██║ ██╔═══╝
|
|
13
|
+
██║ ╚═╝ ██║╚██████╗██║
|
|
14
|
+
╚═╝ ╚═╝ ╚═════╝╚═╝
|
|
15
|
+
```
|
|
2
16
|
|
|
3
|
-
|
|
17
|
+
> **Stop leaking API keys. Protect your secrets. Ship with confidence.**
|
|
4
18
|
|
|
5
19
|
[](https://www.npmjs.com/package/@streamblur/mcp)
|
|
6
20
|
[](https://www.npmjs.com/package/@streamblur/mcp)
|
|
21
|
+
[](https://opensource.org/licenses/MIT)
|
|
22
|
+
|
|
23
|
+
---
|
|
24
|
+
|
|
25
|
+
## What is StreamBlur MCP?
|
|
26
|
+
|
|
27
|
+
StreamBlur MCP is a security layer that sits between your AI coding assistant and your files. Every time your AI reads a config file, environment variable, or any text that might contain a secret — StreamBlur catches it and replaces it with a safe placeholder **before it ever enters the AI's context window.**
|
|
28
|
+
|
|
29
|
+
Think of it as a bouncer for your secrets. Nothing sensitive gets past.
|
|
30
|
+
|
|
31
|
+
```
|
|
32
|
+
┌─────────────────────────────────────────────────────┐
|
|
33
|
+
│ │
|
|
34
|
+
│ Your .env file: │
|
|
35
|
+
│ OPENAI_API_KEY=sk-proj-abc123xyz... │
|
|
36
|
+
│ │
|
|
37
|
+
│ ▼ StreamBlur MCP ▼ │
|
|
38
|
+
│ │
|
|
39
|
+
│ What your AI sees: │
|
|
40
|
+
│ OPENAI_API_KEY=[REDACTED:openai_project_key] │
|
|
41
|
+
│ │
|
|
42
|
+
└─────────────────────────────────────────────────────┘
|
|
43
|
+
```
|
|
44
|
+
|
|
45
|
+
**77+ credential patterns detected.** 100% local. Zero data leaves your machine.
|
|
7
46
|
|
|
8
|
-
|
|
47
|
+
---
|
|
9
48
|
|
|
10
|
-
|
|
49
|
+
## Quick Start
|
|
11
50
|
|
|
12
|
-
|
|
51
|
+
### Step 1 — Install
|
|
13
52
|
|
|
14
53
|
```bash
|
|
15
54
|
npm install -g @streamblur/mcp
|
|
16
55
|
```
|
|
17
56
|
|
|
18
|
-
|
|
57
|
+
### Step 2 — Auto-Setup (Recommended)
|
|
19
58
|
|
|
20
|
-
One command
|
|
59
|
+
One command detects your tools and configures everything automatically:
|
|
21
60
|
|
|
22
61
|
```bash
|
|
23
|
-
|
|
62
|
+
npx @streamblur/mcp --setup
|
|
24
63
|
```
|
|
25
64
|
|
|
26
|
-
|
|
65
|
+
This will find Claude Desktop, Cursor, Windsurf, and Zed on your machine and add StreamBlur to each one. Done.
|
|
66
|
+
|
|
67
|
+
---
|
|
68
|
+
|
|
69
|
+
## Manual Setup
|
|
70
|
+
|
|
71
|
+
Prefer to configure manually? Pick your tool below.
|
|
72
|
+
|
|
73
|
+
### Claude Code CLI
|
|
74
|
+
|
|
75
|
+
Adds StreamBlur globally across all your projects with a single command:
|
|
27
76
|
|
|
28
77
|
```bash
|
|
29
|
-
npx @streamblur/mcp
|
|
78
|
+
claude mcp add --transport stdio --scope user streamblur -- npx -y @streamblur/mcp
|
|
30
79
|
```
|
|
31
80
|
|
|
32
|
-
|
|
81
|
+
### Claude Desktop
|
|
33
82
|
|
|
34
|
-
|
|
83
|
+
Open your `claude_desktop_config.json` and add:
|
|
35
84
|
|
|
36
85
|
```json
|
|
37
86
|
{
|
|
@@ -40,14 +89,18 @@ Add to your `claude_desktop_config.json`:
|
|
|
40
89
|
"command": "npx",
|
|
41
90
|
"args": ["-y", "@streamblur/mcp"],
|
|
42
91
|
"env": {
|
|
43
|
-
"STREAMBLUR_LICENSE_KEY": "your-
|
|
92
|
+
"STREAMBLUR_LICENSE_KEY": "your-email-or-license-key"
|
|
44
93
|
}
|
|
45
94
|
}
|
|
46
95
|
}
|
|
47
96
|
}
|
|
48
97
|
```
|
|
49
98
|
|
|
50
|
-
|
|
99
|
+
**Where is that file?**
|
|
100
|
+
- macOS: `~/Library/Application Support/Claude/claude_desktop_config.json`
|
|
101
|
+
- Windows: `%APPDATA%\Claude\claude_desktop_config.json`
|
|
102
|
+
|
|
103
|
+
### Cursor / Windsurf / other MCP clients
|
|
51
104
|
|
|
52
105
|
```json
|
|
53
106
|
{
|
|
@@ -55,15 +108,15 @@ Add to your `claude_desktop_config.json`:
|
|
|
55
108
|
"command": "npx",
|
|
56
109
|
"args": ["-y", "@streamblur/mcp"],
|
|
57
110
|
"env": {
|
|
58
|
-
"STREAMBLUR_LICENSE_KEY": "your-
|
|
111
|
+
"STREAMBLUR_LICENSE_KEY": "your-email-or-license-key"
|
|
59
112
|
}
|
|
60
113
|
}
|
|
61
114
|
}
|
|
62
115
|
```
|
|
63
116
|
|
|
64
|
-
|
|
117
|
+
### Zed Editor
|
|
65
118
|
|
|
66
|
-
|
|
119
|
+
Open your Zed `settings.json` and add:
|
|
67
120
|
|
|
68
121
|
```json
|
|
69
122
|
{
|
|
@@ -72,56 +125,150 @@ Add to your Zed `settings.json` (macOS: `~/Library/Application Support/Zed/setti
|
|
|
72
125
|
"command": "npx",
|
|
73
126
|
"args": ["-y", "@streamblur/mcp"],
|
|
74
127
|
"env": {
|
|
75
|
-
"STREAMBLUR_LICENSE_KEY": "your-
|
|
128
|
+
"STREAMBLUR_LICENSE_KEY": "your-email-or-license-key"
|
|
76
129
|
}
|
|
77
130
|
}
|
|
78
131
|
}
|
|
79
132
|
}
|
|
80
133
|
```
|
|
81
134
|
|
|
135
|
+
**Where is that file?**
|
|
136
|
+
- macOS: `~/Library/Application Support/Zed/settings.json`
|
|
137
|
+
- Linux: `~/.config/zed/settings.json`
|
|
138
|
+
|
|
139
|
+
---
|
|
140
|
+
|
|
82
141
|
## Tools
|
|
83
142
|
|
|
84
|
-
|
|
143
|
+
StreamBlur gives your AI assistant 9 security tools. 2 are free forever. 7 require Pro.
|
|
85
144
|
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
145
|
+
```
|
|
146
|
+
┌──────────────────────────┬────────┬──────────────────────────────────────────────────────┐
|
|
147
|
+
│ Tool │ Tier │ What it does │
|
|
148
|
+
├──────────────────────────┼────────┼──────────────────────────────────────────────────────┤
|
|
149
|
+
│ redact_text │ FREE │ Redacts secrets from any string of text. │
|
|
150
|
+
│ │ │ Returns text with [REDACTED:type] placeholders. │
|
|
151
|
+
├──────────────────────────┼────────┼──────────────────────────────────────────────────────┤
|
|
152
|
+
│ scan_text │ FREE │ Scans text and reports every secret found — │
|
|
153
|
+
│ │ │ type, position, and character offset. │
|
|
154
|
+
├──────────────────────────┼────────┼──────────────────────────────────────────────────────┤
|
|
155
|
+
│ redact_file │ PRO │ Reads any file and returns redacted content. │
|
|
156
|
+
│ │ │ Supports .env, configs, source code. Never modifies │
|
|
157
|
+
│ │ │ the original file. │
|
|
158
|
+
├──────────────────────────┼────────┼──────────────────────────────────────────────────────┤
|
|
159
|
+
│ scan_directory │ PRO │ Recursively scans a folder for leaked secrets. │
|
|
160
|
+
│ │ │ Returns file paths, secret types, and line numbers. │
|
|
161
|
+
│ │ │ Skips node_modules, .git, dist, and build folders. │
|
|
162
|
+
├──────────────────────────┼────────┼──────────────────────────────────────────────────────┤
|
|
163
|
+
│ scan_repo │ PRO │ Full repository audit — scans every relevant file │
|
|
164
|
+
│ │ │ in your project and produces a security report. │
|
|
165
|
+
├──────────────────────────┼────────┼──────────────────────────────────────────────────────┤
|
|
166
|
+
│ audit_env_file │ PRO │ Deep audit of a .env file: detected secrets, │
|
|
167
|
+
│ │ │ placeholder values, formatting issues, and rotation │
|
|
168
|
+
│ │ │ recommendations. File is never modified. │
|
|
169
|
+
├──────────────────────────┼────────┼──────────────────────────────────────────────────────┤
|
|
170
|
+
│ check_gitignore │ PRO │ Verifies your .gitignore actually covers .env files, │
|
|
171
|
+
│ │ │ key files, and secret directories. Returns a gap │
|
|
172
|
+
│ │ │ report so nothing slips through to GitHub. │
|
|
173
|
+
├──────────────────────────┼────────┼──────────────────────────────────────────────────────┤
|
|
174
|
+
│ explain_detection │ PRO │ Given a detected secret type (e.g. stripe_secret_ │
|
|
175
|
+
│ │ │ live), explains what it is, the blast radius if │
|
|
176
|
+
│ │ │ leaked, and exactly where to go to revoke it now. │
|
|
177
|
+
├──────────────────────────┼────────┼──────────────────────────────────────────────────────┤
|
|
178
|
+
│ generate_env_template │ PRO │ Generates a safe .env.example template with │
|
|
179
|
+
│ │ │ placeholder values and security comments for common │
|
|
180
|
+
│ │ │ project types. Safe to commit to GitHub. │
|
|
181
|
+
└──────────────────────────┴────────┴──────────────────────────────────────────────────────┘
|
|
182
|
+
```
|
|
90
183
|
|
|
91
|
-
|
|
184
|
+
---
|
|
92
185
|
|
|
93
|
-
|
|
94
|
-
|------|-------------|
|
|
95
|
-
| `redact_file` | Read a file and return redacted content. Supports `.env`, configs, source code. File is never modified. |
|
|
96
|
-
| `scan_directory` | Recursively scan a directory for leaked secrets. Returns file paths, secret types, and line numbers. Skips `node_modules`, `.git`, `dist`, and build folders. |
|
|
186
|
+
## What Gets Detected
|
|
97
187
|
|
|
98
|
-
|
|
188
|
+
77+ credential patterns across every major platform and service:
|
|
99
189
|
|
|
100
|
-
|
|
190
|
+
```
|
|
191
|
+
┌─────────────────────────────────────────────────────────────────────────────┐
|
|
192
|
+
│ AI & ML OpenAI · Anthropic · Groq · Together AI · Hugging Face │
|
|
193
|
+
│ Replicate · Cohere · ElevenLabs │
|
|
194
|
+
│ │
|
|
195
|
+
│ Cloud AWS Access Keys · AWS Secret Keys · Azure Storage Keys │
|
|
196
|
+
│ GCP Service Accounts · Firebase Web API Keys │
|
|
197
|
+
│ Firebase Service Accounts │
|
|
198
|
+
│ │
|
|
199
|
+
│ Dev Tools GitHub PATs · GitLab Tokens · npm Tokens │
|
|
200
|
+
│ Netlify Tokens · Vercel Tokens · Railway Tokens │
|
|
201
|
+
│ Doppler Tokens · Pulumi Access Tokens │
|
|
202
|
+
│ │
|
|
203
|
+
│ Payments Stripe Live Secret · Stripe Test Secret │
|
|
204
|
+
│ Stripe Publishable · Stripe Restricted │
|
|
205
|
+
│ │
|
|
206
|
+
│ Databases PostgreSQL URLs · MySQL URLs · MongoDB URLs │
|
|
207
|
+
│ Redis URLs · Supabase Service Role Keys │
|
|
208
|
+
│ PlanetScale Tokens │
|
|
209
|
+
│ │
|
|
210
|
+
│ Messaging Slack Bot/User/Session Tokens · Twilio SIDs │
|
|
211
|
+
│ Twilio Auth Tokens · Discord Bot Tokens │
|
|
212
|
+
│ SendGrid Keys · Mailgun Keys │
|
|
213
|
+
│ │
|
|
214
|
+
│ Other JWT Tokens · OAuth Refresh Tokens · Bearer Tokens │
|
|
215
|
+
│ RSA/DSA/EC/OpenSSH Private Keys · Notion API Keys │
|
|
216
|
+
│ Linear API Keys · Airtable Keys · Shopify Tokens │
|
|
217
|
+
│ HTTP Basic Auth URLs · Generic token assignments │
|
|
218
|
+
│ .env variable assignments (PASSWORD, SECRET_KEY, etc.) │
|
|
219
|
+
└─────────────────────────────────────────────────────────────────────────────┘
|
|
220
|
+
```
|
|
101
221
|
|
|
102
|
-
|
|
222
|
+
---
|
|
103
223
|
|
|
104
|
-
|
|
224
|
+
## Pricing
|
|
105
225
|
|
|
106
|
-
|
|
226
|
+
```
|
|
227
|
+
┌──────────────────────────┬──────────────────────────────────────┐
|
|
228
|
+
│ FREE │ PRO │
|
|
229
|
+
│ Forever │ $2.99 one-time │
|
|
230
|
+
│ │ (launch special, was $9) │
|
|
231
|
+
├──────────────────────────┼──────────────────────────────────────┤
|
|
232
|
+
│ redact_text ✓ │ Everything in Free ✓ │
|
|
233
|
+
│ scan_text ✓ │ redact_file ✓ │
|
|
234
|
+
│ │ scan_directory ✓ │
|
|
235
|
+
│ │ scan_repo ✓ │
|
|
236
|
+
│ │ audit_env_file ✓ │
|
|
237
|
+
│ │ check_gitignore ✓ │
|
|
238
|
+
│ │ explain_detection ✓ │
|
|
239
|
+
│ │ generate_env_template ✓ │
|
|
240
|
+
│ │ │
|
|
241
|
+
│ │ No subscription. No renewal. │
|
|
242
|
+
│ │ Pay once. Own it forever. │
|
|
243
|
+
└──────────────────────────┴──────────────────────────────────────┘
|
|
244
|
+
```
|
|
107
245
|
|
|
108
|
-
|
|
246
|
+
[Get Pro at streamblur.com/pricing](https://streamblur.com/pricing)
|
|
109
247
|
|
|
110
|
-
|
|
248
|
+
Once you have Pro, add your email or license key to your MCP config:
|
|
111
249
|
|
|
112
|
-
```
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
250
|
+
```json
|
|
251
|
+
"env": {
|
|
252
|
+
"STREAMBLUR_LICENSE_KEY": "you@example.com"
|
|
253
|
+
}
|
|
116
254
|
```
|
|
117
255
|
|
|
256
|
+
---
|
|
257
|
+
|
|
118
258
|
## Privacy
|
|
119
259
|
|
|
120
|
-
|
|
260
|
+
- **100% local** — all pattern matching runs on your machine
|
|
261
|
+
- **No data uploads** — your files and text are never sent anywhere
|
|
262
|
+
- **No telemetry** — we don't track what you scan
|
|
263
|
+
- **One network call** — Pro license validation on startup only (to streamblur.com)
|
|
264
|
+
- **File-safe** — `redact_file` reads your file and returns redacted output; the original is never modified
|
|
265
|
+
|
|
266
|
+
---
|
|
121
267
|
|
|
122
268
|
## Links
|
|
123
269
|
|
|
124
270
|
- [streamblur.com](https://streamblur.com)
|
|
125
|
-
- [Chrome Extension](https://chromewebstore.google.com/detail/streamblur/ikbeaahlgjhcpmnmoephpcoabconahim)
|
|
126
271
|
- [Pricing](https://streamblur.com/pricing)
|
|
127
|
-
- [
|
|
272
|
+
- [Chrome Extension](https://chromewebstore.google.com/detail/streamblur/ikbeaahlgjhcpmnmoephpcoabconahim)
|
|
273
|
+
- [Discord Community](https://discord.gg/628jYn5TwC)
|
|
274
|
+
- [Changelog](https://streamblur.com/changelog.html)
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@streamblur/mcp",
|
|
3
|
-
"version": "1.5.
|
|
3
|
+
"version": "1.5.14",
|
|
4
4
|
"description": "StreamBlur MCP server - 9 tools, 77+ patterns. Auto-setup for Claude, Cursor, Windsurf. TUI welcome screen. Run npx @streamblur/mcp --setup to get started.",
|
|
5
5
|
"main": "dist/src/index.js",
|
|
6
6
|
"bin": {
|