GitGuardian

(Internal sources only) List candidate secret occurrences with file paths and match locations. Pass source_id to select a repository. Defaults to its remote DEFAULT_BRANCH, not the checked-out branch, with known-noise exclusions and most-recent-first ordering. Returns a flat page of occurrences, occurrences_count (this response only), applied_filters, cursor, and has_more. Follow cursor with the same filters while has_more is true, including with get_all=True. Pass mine=True for incidents assigned to the current member, or incident_id to filter one incident. Filters still apply; use list_repo_occurrences with exclusions cleared to enumerate all locations. Returns data only; get incident metadata with get_incident and plan remediation using the triage-incidents skill and get_remediation_workflow.

Scan multiple content items for secrets and policy breaks.

(Internal sources only — for public GitHub/gists/Docker Hub use list_public_incidents) List secret incidents detected in sources the workspace has integrated (private/org Git repos, Slack, Jira, container registries, etc.) with advanced filtering including detector type, secret category, source criticality, and public exposure. Filter by repository (via source_ids), detector type, severity, status (TRIGGERED, ASSIGNED, RESOLVED, IGNORED), secret category, source criticality, public exposure, and more. With mine=True, this tool only shows incidents assigned to the current user. Uses page-based pagination.

(Internal sources only — for public GitHub/gists/Docker Hub there is no equivalent count tool) Count internal secret incidents matching the given filters without fetching the full list. Accepts the same filters as list_incidents (status, severity, detector type, source, tags, etc.) but returns only the total count. Useful for getting an overview of incident volume or checking filter results before paginating.

(Internal sources only — for public GitHub/gists/Docker Hub use list_public_occurrences) List secret occurrences for an internal repository (source_id) or incident (incident_id) with exact match locations. Returns detailed occurrence data including file paths, line numbers, and character indices where secrets were detected. Follow cursor with the same filters until has_more is false. To enumerate every known occurrence of one incident, pass incident_id, omit source_id, and set tags, exclude_tags, status, severity, and validity to []. Use get_incident for incident metadata and get_remediation_workflow for remediation instructions.

(Public Monitoring only — for internal sources use list_incidents) List public secret incidents detected by GitGuardian Public Monitoring on the worldwide public perimeter (public GitHub repositories, public GitHub gists, Docker Hub, etc.). Use this when investigating secrets leaked outside the organization perimeter. Incident IDs here are NOT interchangeable with internal incident IDs. Uses cursor-based pagination.

(Public Monitoring only — for internal sources use get_incident) Retrieve a single public secret incident by id, with detector, status, severity, validity, risk_score, tags, timestamps, assignee, and share_url. Incident IDs here are NOT interchangeable with internal incident IDs.

(Public Monitoring only — for internal sources use list_repo_occurrences) List occurrences of a specific public secret incident detected by GitGuardian Public Monitoring on public sources, including filepath, commit sha, source repository, actor, and attachment reasons. Use this after list_public_incidents to drill into a specific public incident.

(Internal sources only) Find the GitGuardian source_id for the current repository in the workspace's internal perimeter, searching among the sources the workspace monitors. Useful when you need to reference the repository in other internal-incident API calls. This server runs remotely and cannot access your local repository: run git config --get remote.origin.url yourself and pass the result as the remote_url argument. If you call it without remote_url, it returns a suggestion telling you to do exactly that. Does not apply to public GitHub / Public Monitoring.

Generate an AWS GitGuardian honeytoken and get injection recommendations. Honeytoken names must be unique among the workspace's active honeytokens.

List honeytokens from the GitGuardian dashboard with filtering options

List users on the workspace/account

List secret detectors available in the GitGuardian detection engine. Returns information about detectors including name, category, type

(Internal perimeter only) List sources (repositories, integrations) the workspace monitors — private/org Git repos, Slack, Jira, container registries, etc. Filter by type, health, visibility, criticality, and scan status. The worldwide public perimeter scanned by Public Monitoring is not represented here.

(Internal sources only - for public GitHub/gists/Docker Hub incidents use get_public_incident)Retrieve a specific internal secret incident by its ID with detailed information including occurrences, detector info, assignee details, and custom tags.

Retrieve a specific member by their ID with information including name, email, role, access level, and activity status.

Retrieve the workspace remediation workflow — the ordered, step-by-step guidance shown for secret incidents. Returns the configured custom workflow if one exists, otherwise the default workflow. Use this to remediate an incident following the same instructions a human sees in the dashboard.

(Internal sources only)List members with access to a secret incident. Filter by access level, search by name/email, and filter on direct or indirect accesses.

(Internal sources only)List teams with access to a secret incident. Search by team name/description and filter on direct or indirect accesses.

(Internal sources only — for public GitHub/gists/Docker Hub use list_public_incident_comments) List the comments (notes) left on an internal secret incident. Use this to read the discussion on an incident and to find the comment_id of a comment you want to edit with manage_incident_comment.

(Public Monitoring only — for internal sources use list_incident_comments) List the comments (notes) left on a public secret incident detected by GitGuardian Public Monitoring. Use this to read the discussion and to find the comment_id to edit with manage_public_incident_comment. Public incident IDs are NOT interchangeable with internal incident IDs.

(Internal sources only — for public GitHub/gists/Docker Hub use list_public_incident_activity_logs) List the full activity log of an internal secret incident: both user notes (comments) and system actions (status changes, assignments, severity edits, new locations detected, etc.) in one timeline. Broader than list_incident_comments, which returns notes only. Filter by content_key (action type) or member_id.

(Public Monitoring only — for internal sources use list_incident_activity_logs) List the full activity log of a public secret incident detected by GitGuardian Public Monitoring: both user notes (comments) and system actions in one timeline. Broader than list_public_incident_comments, which returns notes only. Public incident IDs are NOT interchangeable with internal incident IDs.

Get information about the current API token

(Internal sources only) Update or create custom tags for an internal secret incident. Does not work on public-monitoring incident IDs.

(Internal sources only) Set the severity of an internal secret incident. Does not work on public-monitoring incident IDs.

Read custom tags from the GitGuardian dashboard.

Create or delete custom tags in the GitGuardian dashboard.

(Internal sources only) Manage an internal secret incident (assign, unassign, resolve, ignore, reopen). Does not work on public-monitoring incident IDs.

Revoke a secret by its ID through the GitGuardian API. Operates on a secret_id regardless of whether the incident surfaced on an internal source or via Public Monitoring.

(Internal sources only) Assign an internal secret incident to a specific member or to the current user. Does not work on public-monitoring incident IDs.

(Public Monitoring only — for internal sources use assign_incident) Assign a public secret incident detected by GitGuardian Public Monitoring to a specific member or to the current user. Public incident IDs are NOT interchangeable with internal incident IDs.

(Public Monitoring only — for internal sources use manage_private_incident) Update the status of a public secret incident (resolve, ignore, reopen) detected by GitGuardian Public Monitoring. Public incident IDs are NOT interchangeable with internal incident IDs.

(Internal sources only) Create code fix requests for multiple internal secret incidents with their locations. This will generate pull requests to automatically remediate detected secrets in the repositories the workspace monitors. Does not apply to public-monitoring incidents.

(Internal sources only — for public GitHub/gists/Docker Hub use manage_public_incident_comment) Add a comment (note) to an internal secret incident, or edit an existing one. Use action='add' to create a new comment, or action='edit' with a comment_id (from list_incident_comments) to replace a comment's body. Does not work on public-monitoring incident IDs.

(Public Monitoring only — for internal sources use manage_incident_comment) Add a comment (note) to a public secret incident detected by GitGuardian Public Monitoring, or edit an existing one. Use action='add' to create a new comment, or action='edit' with a comment_id (from list_public_incident_comments) to replace a comment's body. Public incident IDs are NOT interchangeable with internal incident IDs.