MCP guide · Secret Scanner
@guardbee/mcp-secret-scanner hunts for exposed API keys, tokens, passwords, and private keys in source trees and .env files. Ask Claude if a project is leaking secrets — no Guardbee API key required.
What does it do?
A fast local leak check before commit or review. Covers AWS, GitHub, Stripe, OpenAI, Slack, and many more patterns.
Who is it for?
- Developers preventing secret leaks in Node/Python apps
- Teams doing a local pre-PR hygiene check
- Anyone building a security assistant in Claude/Cursor
What it is not
- Replacing centralized secret management in CI
- Breaking into encrypted vaults
Features
| Feature | Description |
|---|---|
| 40+ patterns | Cloud, SCM, payments, AI, messaging, DB URLs, JWTs, private keys |
| File & directory | Single file or recursive scan |
| Smart skips | node_modules, .git, dist, .next, etc. |
| Redaction | Matches are partially masked |
| Allowlist | Ignore known test values |
MCP tools
| Tool | Description |
|---|---|
scan_text | Scan arbitrary text |
scan_file | Single file |
scan_directory | Recursive directory |
list_patterns | Active pattern list |
Install with npm
Global install (handy for Claude Desktop / Cursor):
npm install -g @guardbee/mcp-secret-scanneror via npx (recommended with -y in config):
npx -y @guardbee/mcp-secret-scannerIt only accesses the local filesystem — pass an explicit path to Claude.
Claude Desktop configuration
Config file paths:
- macOS
~/Library/Application Support/Claude/claude_desktop_config.json - Windows
%APPDATA%\Claude\claude_desktop_config.json - Linux
~/.config/Claude/claude_desktop_config.json
Merge this block, then restart Claude Desktop:
{
"mcpServers": {
"guardbee-secret-scanner": {
"command": "npx",
"args": [
"-y",
"@guardbee/mcp-secret-scanner"
]
}
}
}Cursor and other MCP clients
In Cursor, add the same command / args / env under Settings → MCP. stdio MCP servers use the same contract as Claude Desktop.
Example prompts in Claude
- “Scan my project for secrets: /Users/me/my-app”
- “Does this .env contain secrets?”
- “Is this text safe: export API_KEY=sk-…”
Related links
See surface risk with Guardbee
MCP servers speed up security work in chat. Start a 14-day free trial for brand scans and BeeAI.
Frequently asked questions
False positives?
Possible — use allowlists and rotate anything truly sensitive.
Does it scan git history?
Default directory scans skip .git and focus on the working tree.
API key needed?
No — fully local.