Netallion MCP Lite

io.github.netallionPublished by GitHub account netallionv0.1.1Updated Oct 24, 2026

Local secret & credential checks for AI-assisted dev — runs on your machine, results redacted.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A local MCP server that scans text and files for common secrets and credentials, returning redacted findings so assistants can check code safely.

What you can do
Scan a string for commodity secrets and credentials, returning redacted findings with rule, severity, position and remediation advice. Scan a file inside a configured workspace root, with sensitive files such as .env and keys refused. List the supported commodity checks without exposing secrets. Read an about summary covering the tool's privacy posture and how the free Lite version differs from the commercial platform.
When to use it
Useful when an AI coding assistant handles code, configuration or pasted text that might contain API keys, tokens, private keys or database URIs, and you want a quick local check before committing or sharing. It is a lightweight on-ramp, not a full secret-scanning or governance platform.
Requirements
Runs locally over stdio as a Python package, requiring Python 3.10 or newer; install with pip or run without installing via uvx. No account or API key is needed. Optionally set the NETALLION_MCP_LITE_WORKSPACE_ROOT environment variable to confine file scanning to one directory.
Before you install
Detection is limited to about 27 commodity, high-confidence patterns and will miss obfuscated, encoded or organization-specific secrets; no detection or false-positive rates are claimed. Findings are redacted, but the tool reads file contents on your machine, so keep the workspace root narrow. It is a free utility with no telemetry and no data sent to the vendor.

Installation

In SourceWeft

  1. Open Netallion MCP Lite in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Netallion MCP Lite

[PyPI] [Python] [CI] [License: MIT]

Free, local, IP-safe AI-development security — an MCP server from Netallion.

Netallion MCP Lite is a small Model Context Protocol server that helps you and your AI coding assistants avoid the most common mistake in AI-assisted development: leaking a credential. It flags a curated set of commodity, high-confidence secrets and credentials (AWS, GitHub, Stripe, OpenAI, private keys, database URIs, and more) in text and files.

It runs entirely on your machine. No account. No data sent to Netallion. Detected secrets are redacted before results are returned, so they are safe to hand back into an AI assistant's context.

Part of Netallion's Agentic Development Governance approach — secret detection is one capability, not the whole story.

What it is (and isn't)

Netallion MCP Lite (this package)Netallion AI Assurance (the platform)
PriceFreeCommercial (free trial)
RunsLocally, no accountSaaS + IDE + CI
Detection~27 commodity, high-confidence checksAdvanced detection well beyond commodity patterns
AI/MCP governance—AI provider governance, MCP governance
Policy & visibility—Central policy management, org-wide visibility
Compliance—Compliance and audit evidence
DataNothing leaves your machineEnterprise controls

MCP Lite is deliberately limited. It is a genuinely useful local utility and an on-ramp: if you want advanced detection, AI/MCP governance, central policy, and audit evidence across your organisation, that lives in Netallion AI Assurance.

This package does not contain or depend on Netallion's proprietary detection engine.

Install & run

Requires Python 3.10+.

bash
pip install netallion-mcp-lite# or, zero-install:uvx netallion-mcp-lite

It speaks MCP over stdio. Add it to any MCP-compatible client (Claude, Cursor, Windsurf, VS Code, …):

json
{  "mcpServers": {    "netallion-mcp-lite": {      "command": "netallion-mcp-lite"    }  }}

Optionally confine scan_file to a specific directory:

json
{  "mcpServers": {    "netallion-mcp-lite": {      "command": "netallion-mcp-lite",      "env": { "NETALLION_MCP_LITE_WORKSPACE_ROOT": "/path/to/your/project" }    }  }}

Tools

ToolWhat it does
scan_textScan a string for commodity secrets; returns redacted findings (rule, severity, line/column, remediation).
scan_fileScan a file inside the workspace root; sensitive files (.env, keys) are refused; findings redacted.
list_supported_checksList the commodity checks (no secrets).
aboutAbout the tool, privacy posture, and Lite vs AI Assurance.

Run list_supported_checks to see the full set. Findings never include the full secret value.

Privacy

Local-only. No telemetry. No source, file contents, prompts, or secrets are sent anywhere. See PRIVACY.md.

Scope & limitations

  • Commodity, high-confidence formats only — it will not catch obfuscated, encoded, or org-specific secrets. That is by design; advanced detection is part of Netallion AI Assurance.
  • scan_file reads only within a single workspace root and refuses obviously-sensitive files.
  • No generic high-entropy scanning (it produces noise without advanced technique).

We make no claims about detection rates, false-positive rates, customer adoption, certifications, or regulatory compliance for this free utility.

Links

License

MIT — see LICENSE.

Source: README.md at commit a1ed854

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts