check_gitignore_coverage
Check whether sensitive files (.env, .env.local, secrets.json, etc.) are properly covered by .gitignore rules. Flags files that contain secrets but could be accidentally committed.
LABSCO SUMMARY
The exposure check happens before the agent gets there, not after.
It looks at the four places a secret actually escapes from — the source, the ignore rules, the log calls and the commit history — and reports each hit as a masked preview with a line number, so the finding can be acted on without the value being read back.
What it is
A scanner for the ways a project leaks its own secrets: values hardcoded in source, .env files that git is not ignoring, log calls that print environment variables at runtime, CI files, and the commit history. The running server answers with five tools.
What you get
- A directory scan against more than twenty patterns — AWS keys, GitHub and Slack tokens, Stripe secrets and webhook secrets, OpenAI and Anthropic keys, private key blocks, database URLs with the password inline
- Findings reported as file, line and severity with a masked preview, never the full value
- A check of whether .env, .env.local, secrets.json and their siblings are actually covered by your .gitignore rules
- A pass over source files for console.log and logger calls that would print secrets at runtime
- Two capabilities the README's tool list does not mention: a scan of CI workflow files across GitHub Actions, CircleCI and GitLab CI, and a scan of git history for secrets that were committed and later deleted
Requirements
Node, through the published npm package. It reads the project directory you point it at and the git history inside it, so there is no account or key anywhere in the path.
Setup effort
One command — npx -y env-secret-exposure-analyzer-mcp
USE CASES
01
Checking a repository before you point an agent at it
Scan the project for hardcoded credentials and confirm the sensitive files are genuinely ignored, so a debugging session does not pull a database password into context.
02
Finding out whether a key was ever committed
Deleting a secret from the working tree does not remove it from history. The history scan looks for values that were committed at any point, even if the file no longer contains them.
03
Stopping credentials from reaching your logs
Look for the log and logger calls that would print environment variables or config objects when the code runs — the leak that only shows up in production output.
04
Auditing the build pipeline
CI files are a common place for a token to be pasted inline. GitHub Actions, CircleCI and GitLab CI configs are scanned in the same pass as the source.
05
Producing a triage list rather than a wall of hits
Every finding carries a severity and a masked preview alongside the file and line, so the critical ones can be dealt with first and the rest scheduled.
5 tools
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
scan_ci_workflows
Scans GitHub Actions (.github/workflows/*.yml), CircleCI (.circleci/config.yml), and GitLab CI (.gitlab-ci.yml) workflow files for dangerous secret interpolation patterns. Detects ${{ secrets.* }} and ${{ github.token }} used directly in run: steps (log_leak risk — GitHub Actions logs the expanded plaintext) and ${{ github.event.pull_request.* }} / issue / commit content interpolated in shell commands (injection risk — attacker-controlled input). Returns file, job, step, pattern_found, risk, and recommendation.
scan_for_log_leaks
Scan source files for console.log / logger calls that may print environment variables or secrets at runtime. Catches patterns like console.log(process.env.SECRET) or logger.info({ apiKey }) before they reach production logs.
scan_for_secrets
Scan a project directory for hardcoded secrets, API keys, tokens, and passwords. Detects patterns like AWS keys, GitHub tokens, Stripe keys, private keys, and generic high-entropy strings. Returns file path, line number, severity, and a masked preview.
scan_git_history
Scan the git commit history of a repository for secrets that were ever committed, even if later deleted. Detects hardcoded API keys, tokens, passwords, and other credentials added in diff hunks across recent commits. Returns each finding with its commit hash, file, line, severity, a masked preview, entropy score, whether the secret is still present in the working tree, and whether rotation is required. Respects .gitleaksignore.
BEFORE YOU INSTALL
What to know first
Tools you get
5 tools when we connected. scan_git_history and scan_ci_workflows are undocumented; they search past commits and CI pipelines. Findings show only masked previews, never the full secret.
Requires
npx on PATH
Where it runs
The documented client runs the server on your machine.
CONTEXT COST
Light Standing cost
Rated by the size of the 5 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Connect your client
Server setup
TERMINAL
npx -y env-secret-exposure-analyzer-mcpMCP Clients
Any MCP client
ANY MCP CLIENT · JSON
{
"mcpServers": {
"secret-scanner": {
"command": "npx",
"args": [
"-y",
"env-secret-exposure-analyzer-mcp"
]
}
}
}
