Summary
The exposure check happens before the agent gets there, not after.
It looks at the four places a secret actually escapes from — the source, the ignore rules, the log calls and the commit history — and reports each hit as a masked preview with a line number, so the finding can be acted on without the value being read back.
What it is
A scanner for the ways a project leaks its own secrets: values hardcoded in source, .env files that git is not ignoring, log calls that print environment variables at runtime, CI files, and the commit history. The running server answers with five tools.
What you get
- A directory scan against more than twenty patterns — AWS keys, GitHub and Slack tokens, Stripe secrets and webhook secrets, OpenAI and Anthropic keys, private key blocks, database URLs with the password inline
- Findings reported as file, line and severity with a masked preview, never the full value
- A check of whether .env, .env.local, secrets.json and their siblings are actually covered by your .gitignore rules
- A pass over source files for console.log and logger calls that would print secrets at runtime
- Two capabilities the README's tool list does not mention: a scan of CI workflow files across GitHub Actions, CircleCI and GitLab CI, and a scan of git history for secrets that were committed and later deleted
Requirements
Node, through the published npm package. It reads the project directory you point it at and the git history inside it, so there is no account or key anywhere in the path.
Setup effort
One command — npx -y env-secret-exposure-analyzer-mcp