Ghosthunt

io.github.78degreesPublished by GitHub account 78degreesv1.0.0Updated Oct 24, 2026

Find every leaked secret on your machine — API keys in .env files, shell history, and configs.

VerifiedSTDIODesktop onlyFiles & StorageSecurity & Monitoring

Overview

AI-generated overview

Scans the local machine for leaked API keys, tokens, and credentials in .env files, shell history, and developer configs.

What you can do
GhostHunt is a local MCP server that searches a development machine for exposed secrets. Its scan_secrets tool returns detailed findings with file paths, line numbers, severity ratings, and remediation steps, while scan_summary returns a 0-100 health score with counts by severity. It checks environment files, AWS credentials, SSH keys, Docker config, npm and PyPI tokens, GitHub CLI tokens, shell history, Kubernetes config, netrc, and more than 35 secret patterns.
When to use it
Use it when you want an assistant to audit your own machine for forgotten credentials before rotating keys, cleaning shell history, or checking that .env files are not exposed. A quick summary scan is useful as a periodic hygiene check.
Requirements
Runs locally over stdio, typically via npx ghosthunt or a Claude Desktop config entry. The manifest declares a required secret environment variable named YOUR_API_KEY, although the README describes the scan as fully local and offline. Desktop only; no web execution.
Before you install
The scan reads sensitive local files, including private SSH keys, cloud credentials, and shell history, and findings are returned into the assistant conversation, so results may contain secret values or fragments. The manifest requires an environment variable named YOUR_API_KEY, which conflicts with the README's claim that no data leaves the machine; clarify what that key is used for before installing. Findings are read-only and no data is written or deleted.

Installation

In SourceWeft

  1. Open Ghosthunt in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

GhostHunt

Find every leaked secret on your machine.

GhostHunt is an MCP server that scans your development machine for API keys, tokens, and credentials hiding in places you forgot to check: .env files scattered across projects, shell history, AWS/SSH/Docker configs, and more.

Everything runs locally. No data leaves your machine.

What It Scans

  • Environment files — recursively finds every .env, .env.local, .env.production, etc. under your home directory
  • AWS credentials — ~/.aws/credentials and session tokens
  • SSH keys — unprotected private keys in ~/.ssh/
  • Docker config — registry auth tokens in ~/.docker/config.json
  • npm/PyPI tokens — ~/.npmrc, ~/.pypirc auth tokens
  • GitHub CLI — OAuth tokens in ~/.config/gh/hosts.yml
  • Shell history — API keys pasted into bash, zsh, or fish commands
  • Kubernetes — ~/.kube/config credentials
  • Netrc — ~/.netrc passwords
  • 35+ secret patterns — AWS, Stripe, GitHub, OpenAI, Anthropic, Google, Slack, Twilio, SendGrid, database connection strings, private keys, and more

Install

Claude Desktop

Add to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS):

json
{  "mcpServers": {    "ghosthunt": {      "command": "npx",      "args": ["-y", "ghosthunt"]    }  }}

Restart Claude Desktop. Then ask Claude: "Scan my machine for leaked secrets"

Direct Usage

bash
npx ghosthunt

Tools

scan_secrets

Full detailed scan. Returns every finding with file paths, line numbers, severity ratings, and remediation steps.

Example prompt: "Run a full GhostHunt scan and show me everything"

scan_summary

Quick health check. Returns your health score (0-100) and a count by severity. Run this first to see if you have a problem.

Example prompt: "Give me a quick GhostHunt health check"

Example Output

# GhostHunt Scan Report
**Health Score: 37/100** (Critical)
- Secrets found: **12**- Critical: 3 | High: 5 | Medium: 2 | Low: 2- Locations scanned: 47- Scan time: 142ms
## Environment Files (.env)
- **[CRITICAL]** Stripe Live Secret Key  - File: `/Users/you/project-a/.env:4`  - Context: `STRIPE_SECRET_KEY`  - Value: `sk_l****_8xQ`
- **[CRITICAL]** OpenAI API Key  - File: `/Users/you/side-project/.env.local:12`  - Context: `OPENAI_API_KEY`  - Value: `sk-p****kFJ9`
## Shell History
- **[HIGH]** Bearer Token in Header  - File: `/Users/you/.zsh_history:8847`  - Context: `curl -H "Authorization: Bearer sk_live_...`  - Value: `sk_l****_m3K`
## Recommendations
1. **Rotate critical secrets immediately.** Any API key marked CRITICAL   should be revoked and regenerated from the provider's dashboard.2. **Clear your shell history** of sensitive commands.3. **Audit your .env files.** Ensure they are in .gitignore.

Health Score

Your score starts at 100 and drops based on what GhostHunt finds:

FindingPenalty
Critical secret-15
High severity-8
Medium severity-3
Low severity-1

A score below 50 means you have secrets that need immediate attention.

Privacy

GhostHunt runs entirely on your local machine. It does not:

  • Send any data to any server
  • Phone home or track usage
  • Store scan results anywhere
  • Access the internet

Your secrets stay on your machine. The scan results stay in your Claude conversation.

License

MIT

Source: README.md at commit fde95aa

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.