Skip to content
@leakferrethq

leakferret

README.md

leakferret

MCP-native secret scanner — finds hardcoded secrets, verifies which are actually live, and rewrites the leak to read from an environment variable.

leakferret.com · main repo · docs · MIT

leakferret finds a leaked secret, verifies it against the provider, and rewrites the literal to read from an env var

Why leakferret

Most scanners stop at "this looks like a secret." leakferret goes two steps further:

  • Verify — one harmless API call to the provider (AWS, GitHub, GitLab, Stripe, OpenAI, Anthropic, Slack, …) confirms which keys are still live, so you fix what's actually exploitable instead of triaging regex noise.
  • Rewrite — swaps the hardcoded literal for an os.environ / process.env / ENV.fetch lookup, adds a .env.example line, and prints seed commands for your secret manager.
  • MCP-native — exposes the whole pipeline over the Model Context Protocol, so a coding agent can self-check before it commits.

Privacy by construction: the full secret value never leaves your machine — only a redacted AKIA…4XYZ preview ever leaves the process. A dedicated test enforces it.

Install

cargo install leakferret-cli      # Rust
npm   i -g @leakferret/cli        # npm
gem   install leakferret          # Ruby

leakferret verify .               # scan, then confirm which keys are live

Where it runs
🦀  CLI / engine leakferret — one fast Rust binary
🤖  MCP server leakferret mcp — for Claude Code, Cursor, Continue, Claude Desktop
⚙️  CI leakferret-action — SARIF → GitHub Code Scanning
🧩  VS Code / Cursor leakferret-vscode — scan on save, one-click fix
💎  Ruby leakferret-ruby
📦  npm leakferret-npm
🐹  Go leakferret-go
📚  Catalog data leakferret-catalog — signed known-public examples

MIT-licensed engine, CLI, MCP server, and wrappers · fixture-catalog data CC-BY-SA-4.0 · maintained by Maria Khan

Pinned Loading

  1. leakferret-action leakferret-action Public

    GitHub Action for leakferret, the MCP-native secret scanner. uses: leakferrethq/leakferret-action@v1. Composite action that scans your repo for verified secret leaks and uploads SARIF to GitHub Cod…

  2. leakferret-npm leakferret-npm Public

    npm packages for leakferret: npm i -g @leakferret/cli for the CLI and npx @leakferret/mcp for the MCP server. Downloads the prebuilt Rust binary from Releases; honors LEAKFERRET_BIN.

    JavaScript

  3. leakferret-ruby leakferret-ruby Public

    Ruby gem for leakferret, the MCP-native secret scanner. gem install leakferret, then leakferret scan . Precompiled platform gems bundle the Rust binary (no download; audit with gem unpack); honors …

    Ruby

  4. leakferret-go leakferret-go Public

    Go installer for leakferret, the MCP-native secret scanner. go install github.com/leakferrethq/leakferret-go/cmd/leakferret@latest. Fetches the prebuilt Rust binary from GitHub Releases and execs i…

    Go

  5. leakferret leakferret Public

    MCP-native secret scanner in one fast Rust binary: engine, CLI, and MCP server. Finds API keys and secrets, skips known-public fixtures, verifies live keys with a real provider call, and applies en…

    Rust 3

Repositories

Showing 8 of 8 repositories

People

This organization has no public members. You must be a member to see who’s a part of this organization.

Top languages

Loading…

Most used topics

Loading…