Mcp Secret Scrub

io.github.sudo-ai-gitPublished by GitHub account sudo-ai-gitv1.0.0Updated Oct 24, 2026

Deterministic no-LLM MCP server that scrubs secrets before they reach an agent. Never leaks values.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A local MCP server that deterministically detects and redacts secrets in text before it reaches an agent's context.

What you can do
It scans text, logs, and transcripts for secret patterns such as AI provider keys, cloud and GitHub tokens, JWTs, PEM private keys, bearer and basic auth headers, key-value assignments, and connection strings. Tools include scrub_text to redact, mask, or hash matches, scan_text to report which secret types are present without changing anything, report_full to scan and redact in one call, and secret_profiles to list supported detection profiles. Detection is pure pattern matching with no LLM and no network access, and results are deterministic for the same input.
When to use it
Worth adding when you routinely paste logs, config files, or transcripts into an agent and want a check that strips credentials first. It suits workflows where you need a repeatable, offline redaction step rather than a model-based guess, and where you want to know which secret types appear without exposing their values.
Requirements
Runs as a local process over stdio, installed from PyPI as mcp-secret-scrub (pip, pipx, or uv). No accounts, API keys, environment variables, or network access are declared. An optional HTTP mode can be started manually with a port argument.
Before you install
It processes whatever text you send it, so treat the input as sensitive even though the server reports only secret type, count, and position. The mask mode reveals the first four and last two characters of a match, and hash mode emits a deterministic unsalted SHA-256 prefix, which is reproducible and could be compared against known values. Redaction is pattern-based and may miss secrets that do not match a known profile.

Installation

In SourceWeft

  1. Open Mcp Secret Scrub in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

mcp-secret-scrub

mcp-name: io.github.sudo-ai-git/mcp-secret-scrub

Deterministic, no-LLM MCP server that scrubs secrets from text, logs, and transcripts before they enter agent context — and never leaks the value.

No LLM. No network. Pure structural detection. MIT. Crown-jewel-free.

The problem it solves

Before you hand raw text to an agent (or store it, or pass it to a tool), you often don't know whether it contains a live secret. Platform scrubbers miss patterns all the time — a private key, an nvapi- token, a github_pat_ token, an api_key= assignment mid-log. If that text reaches an LLM context or a persisted transcript, the secret is effectively exfiltrated.

This server answers, deterministically:

Which secrets are in this text, and can you redact them safely before it goes anywhere?

Detection coverage (deterministic profiles)

familyexamples
AI provider keyssk-proj-…, sk-ant-api…, sk-or-v1-…, sk-…, nvapi-…
Cloud / GitHubAKIA…, aws_secret_access_key=, ghp_…, gho_…, ghu_…, ghs_…, ghr_…, github_pat_…
Identity / authJWTs (eyJ…), PEM private keys, Bearer …, Basic …, OAuth client secrets
Assignmentsapi_key=, token=, secret=, password=, client_secret=, webhook_secret=
Endpoints / DSNsDiscord webhooks, Slack xox…, SQL/Redis/Mongo/AMQP connection strings

The scan never returns the secret value — only its type, count, and position. That is a hard safety contract, enforced by test.

Tools (MCP)

toolpurpose
scrub_text(text, mode, keep_label)redact / mask / hash secrets; returns scrubbed text (never the value)
scan_text(text)detect which secret types are present (no mutation)
report_full(text)scan + redact in one call, scrubbed preview + findings
secret_profiles()list all supported detection profiles

Modes:

  • redact (default) → [REDACTED:TYPE]
  • mask → shows first 4 + last 2 chars
  • hash → deterministic SHA-256 prefix (reproducible across calls)

Quick start (stdio)

bash
pip install mcp-secret-scrubmcp-secret-scrub          # stdio (default)

Or via uv/pipx for an installable console entry:

bash
pipx install mcp-secret-scrub

MCP client config:

json
{ "mcpServers": {    "secret-scrub": { "command": "mcp-secret-scrub" }}}

Streamable HTTP (remote / Smithery-publishable)

bash
python3 mcp_server.py --http --port 8138   # serves on http://<host>:8138/mcp/

Determinism & safety guarantees

  • Deterministic: same input → identical output in every mode, every call.
  • Never leaks: scan_text and scrub_text never emit the original token; _deterministic_hash is SHA-256 (no salt) so output is reproducible.
  • No LLM, no network: pure regex + reachable structure detection.
  • Input-safe: non-string input returns a clean error, not a traceback.

Verification

  • python3 test_detector.py — 14/14 core checks (detection, redaction, determinism, no-leak contract, benign/unicode/empty input, bad-mode)
  • python3 test_e2e.py — drives the real MCP stdio transport and asserts the secret does NOT cross the wire

License & provenance

MIT. Part of the sudo-ai-git deterministic no-LLM agent-trust MCP family (mcp-skill-sec · mcp-verify-claim · mcp-benchmark-hygiene · mcp-secret-scrub).

Source: README.md at commit c5b3a04

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts