LabscoMCP early access ↗
78degreesMCP SERVER

GhostHunt Secret Scanner

Scans your own machine for leaked credentials — env files, shell history, cloud configs — entirely locally.

by 78degrees ↗Identity, Access, Secrets & EncryptionCommunity

LABSCO SUMMARY

Scanning shell history is the part that finds what everything else misses.

Repository scanners catch the key you committed. They cannot see the key you exported on the command line while debugging, which is now sitting in plain text in your history file and will be there for years. Same for the cloud session token you forgot. Covering the whole home directory rather than one repo is the right scope for a machine that has been in use a while — and the local-only promise is not decoration, since anything else would mean uploading exactly what you are looking for.

What it is

A scanner for the credentials that accumulate on a development machine, covering the places they actually end up rather than just the repository.

What you get

  • scan_secrets — environment files found recursively, cloud credential files and session tokens, unprotected SSH private keys, container registry auth, package registry tokens, command-line tool OAuth tokens, cluster config credentials and stored passwords
  • Shell history — keys pasted into a command, which no repository scanner sees
  • fix_secrets, scan_summary and ghosthunt_status alongside

Requirements

Npx. Their documentation states everything runs locally and no data leaves the machine.

Setup effort

One command — npx ghosthunt

See installation options