Spill

com.clawhardPublished by clawhard.comOfficial publisherv1.0.0Updated Nov 4, 2026

Find leaked API keys, tokens and passwords in pasted text, see which are live, get a clean copy.

The publisher's own server: Clawhard Studio

VerifiedStreamable HTTPWeb executableDeveloper Tools Security & Monitoring

Server details

Identifier: com.clawhard/spill
Transport: Streamable HTTP
Runtime: Web executable
Trust: Verified
Published: Nov 4, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified that this server's namespace belongs to clawhard.com, which also runs its endpoint. That identifies the publisher; it does not make the server's tools safe.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/com.clawhard%2Fspill.svg)](https://sourceweft.com/mcp/com.clawhard%2Fspill?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Spill scans pasted text for leaked API keys, tokens, private keys and passwords, flags which are live, and returns a redacted copy.

What you can do: Scan text for secrets: detect API keys, tokens, private keys and passwords from 48 services in code, .env files, diffs, logs, chats and prompts.
Assess findings: indicate which credentials are live and which are meant to be public.
Remediate: point to where each secret should be rotated and return a redacted copy of the text.
Share results: provide a link the user can open to see the same result on the website.
When to use it: Useful when a user asks whether text contains secrets, or as a check before pasting, committing, sharing, logging or sending code, .env files, diffs, logs or prompts that might contain credentials.
Requirements: A remote MCP endpoint; no account, API key or environment variables are declared. The server reports that it runs in the browser.

Before you install

Text you submit is sent to a third-party remote service for scanning, so treat anything pasted as leaving your machine. Results include a link to view the same result on the website, which may expose the scan to others who have the link. Redaction is advisory; rotate any live credential found rather than relying on the redacted copy alone.

Installation

In SourceWeft

Open Spill in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.clawhard%2Fspill/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "spill": {
      "type": "http",
      "url": "https://spill.clawhard.com/mcp"
    }
  }
}

Tools

spill_scan_secrets

Find and redact API keys, tokens, private keys and passwords in text

Use when the user asks whether some text contains secrets, or before you paste, commit, share, log or send code, a .env file, a diff, config, logs, a stack trace or a prompt that might contain credentials, for example "did I leak a key in this?", "is this safe to post?" or "redact the secrets in this log". Detects 48 services by exact key format (OpenAI, Anthropic, Gemini/Google, Groq, xAI, OpenRouter, Stripe, Supabase, AWS, GitHub, GitLab, npm, PyPI, Slack, Discord, Twilio, SendGrid, Resend, Shopify, Cloudflare and more) plus PEM private keys, database URLs with passwords, JWTs, Authorization headers and high-entropy values in variables named like secret, token, api_key or password. It verifies what it can deterministically: GitHub token CRC32 checksums, JWT and Supabase key role and expiry (service_role vs anon), documented example keys and placeholders, and NEXT_PUBLIC_/VITE_/EXPO_PUBLIC_ variables that ship to every browser. Returns findings with severity (critical, high, medium, public, info), line and column, a masked preview (never the full secret), why it matters, the fix and the provider's revoke URL, plus a redacted copy with labels like [STRIPE_SECRET_KEY_1]. Text is processed in memory to answer and is not stored. Limits: format-based, so a random secret with a neutral name can be missed; it never tests keys against providers; up to 200,000 characters. For secrets the user should not send anywhere, point them to https://spill.clawhard.com, which runs entirely in the browser.

Parameterstextrequiredredact_public_keys

Version history

v1.0.0LatestNov 4, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 daysRequired25 pts
Auth declaredRequired10 pts
Tools listedRequired15 pts
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.
LicenseNot applicable
A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.

1 toolNov 3, 2026