AgenticCode
Secret & Repo Scanner MCP Tool
CLI Tool Name: repo_scanner
Scans a directory for leaked secrets, API tokens, private keys, PII (emails, SSNs), and missing .gitignore entries. Everything stays on your machine — no data is transmitted anywhere.
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
| directory | string | yes | Absolute or relative path to the directory to scan. |
What it detects
AWS credentials
Access keys, secret keys, session tokens.
API tokens
OpenAI, GitHub, Stripe, Slack, and 40+ other services.
Private keys
RSA, EC, and PEM-format private key material.
PII
Email addresses, Social Security Numbers, phone numbers.
Database URLs
Connection strings with embedded credentials.
.gitignore gaps
Files that should be ignored but aren't listed.
Example output
json
{
"directory": "/path/to/project",
"findings": [
{
"type": "secret",
"severity": "CRITICAL",
"file": "config/settings.py",
"line": 8,
"match": "AWS_SECRET_KEY = 'AKIA...'",
"message": "Possible AWS secret key detected"
},
{
"type": "gitignore_gap",
"severity": "WARNING",
"file": ".env",
"message": ".env file is not covered by .gitignore"
}
],
"summary": {
"critical": 1,
"warnings": 1,
"files_scanned": 47
}
}[note]
CRITICAL findings mean a real secret was detected. Rotate the credential immediately, then remove it from your codebase and git history.