credential-free
Verified Safeby skutry
Overview
A local MCP server and CLI tool for static analysis to detect hardcoded API keys, tokens, and credentials in source code and files.
Installation
python -m src.serverSecurity Notes
The codebase demonstrates good security practices for a tool processing arbitrary user files. It actively prevents path traversal, limits file and archive member sizes to mitigate resource exhaustion and regex DoS attacks on long lines, and does not use dangerous functions like 'eval'. No hardcoded secrets for its own operation were found. The tool's scanning logic is local, minimizing external attack surface.
Similar Servers
mcp-watch
A comprehensive security scanner for Model Context Protocol (MCP) servers, detecting various vulnerabilities in their implementations.
copilot-security-instructions
This MCP server provides a toolkit to guide GitHub Copilot toward secure coding practices by offering customizable security-focused prompts and agents for integration into development workflows.
ggmcp
A focused MCP server for developers, providing remediation tools for secrets detected in code and honeytoken management capabilities.
treesitter-mcp
Provides a Model Context Protocol (MCP) server and CLI for static code analysis using Tree-sitter.