Netallion MCP Lite

io.github.netallion由 GitHub 账号 netallion 发布v0.1.1更新于 Oct 24, 2026

Local secret & credential checks for AI-assisted dev — runs on your machine, results redacted.

已验证STDIO仅桌面开发者工具安全与监控

概览

AI 生成的概览

一个本地 MCP 服务器，扫描文本和文件中的常见密钥与凭据，返回已脱敏的结果，让助手能安全地检查代码。

可以做什么
扫描字符串中的常见密钥和凭据，返回已脱敏的发现，包括规则、严重级别、位置和修复建议。在配置的工作区根目录内扫描文件，并拒绝 .env、密钥等敏感文件。列出支持的常见检查项，且不暴露任何密钥。提供关于工具隐私立场以及免费 Lite 版与商业平台差异的说明。
适用场景
当 AI 编程助手处理可能含有 API 密钥、令牌、私钥或数据库 URI 的代码、配置或粘贴文本时，可在提交或分享前做一次快速本地检查。它只是轻量入门工具，并非完整的密钥扫描或治理平台。
运行要求
以 Python 包形式通过 stdio 在本地运行，需要 Python 3.10 或更高版本；可用 pip 安装，或用 uvx 免安装运行。无需账号或 API 密钥。可选设置环境变量 NETALLION_MCP_LITE_WORKSPACE_ROOT，将文件扫描限制在某个目录内。
安装前请注意
检测仅覆盖约 27 种常见、高置信度的模式，无法发现混淆、编码或组织特有的密钥；也未对检出率或误报率作出任何声明。结果虽已脱敏，但工具会读取本机文件内容，应尽量缩小工作区根目录。它是免费工具，无遥测，不向厂商发送数据。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Netallion MCP Lite，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

Netallion MCP Lite

[PyPI] [Python] [CI] [License: MIT]

Free, local, IP-safe AI-development security — an MCP server from Netallion.

Netallion MCP Lite is a small Model Context Protocol server that helps you and your AI coding assistants avoid the most common mistake in AI-assisted development: leaking a credential. It flags a curated set of commodity, high-confidence secrets and credentials (AWS, GitHub, Stripe, OpenAI, private keys, database URIs, and more) in text and files.

It runs entirely on your machine. No account. No data sent to Netallion. Detected secrets are redacted before results are returned, so they are safe to hand back into an AI assistant's context.

Part of Netallion's Agentic Development Governance approach — secret detection is one capability, not the whole story.

What it is (and isn't)

Netallion MCP Lite (this package)Netallion AI Assurance (the platform)
PriceFreeCommercial (free trial)
RunsLocally, no accountSaaS + IDE + CI
Detection~27 commodity, high-confidence checksAdvanced detection well beyond commodity patterns
AI/MCP governance—AI provider governance, MCP governance
Policy & visibility—Central policy management, org-wide visibility
Compliance—Compliance and audit evidence
DataNothing leaves your machineEnterprise controls

MCP Lite is deliberately limited. It is a genuinely useful local utility and an on-ramp: if you want advanced detection, AI/MCP governance, central policy, and audit evidence across your organisation, that lives in Netallion AI Assurance.

This package does not contain or depend on Netallion's proprietary detection engine.

Install & run

Requires Python 3.10+.

bash
pip install netallion-mcp-lite# or, zero-install:uvx netallion-mcp-lite

It speaks MCP over stdio. Add it to any MCP-compatible client (Claude, Cursor, Windsurf, VS Code, …):

json
{  "mcpServers": {    "netallion-mcp-lite": {      "command": "netallion-mcp-lite"    }  }}

Optionally confine scan_file to a specific directory:

json
{  "mcpServers": {    "netallion-mcp-lite": {      "command": "netallion-mcp-lite",      "env": { "NETALLION_MCP_LITE_WORKSPACE_ROOT": "/path/to/your/project" }    }  }}

Tools

ToolWhat it does
scan_textScan a string for commodity secrets; returns redacted findings (rule, severity, line/column, remediation).
scan_fileScan a file inside the workspace root; sensitive files (.env, keys) are refused; findings redacted.
list_supported_checksList the commodity checks (no secrets).
aboutAbout the tool, privacy posture, and Lite vs AI Assurance.

Run list_supported_checks to see the full set. Findings never include the full secret value.

Privacy

Local-only. No telemetry. No source, file contents, prompts, or secrets are sent anywhere. See PRIVACY.md.

Scope & limitations

  • Commodity, high-confidence formats only — it will not catch obfuscated, encoded, or org-specific secrets. That is by design; advanced detection is part of Netallion AI Assurance.
  • scan_file reads only within a single workspace root and refuses obviously-sensitive files.
  • No generic high-entropy scanning (it produces noise without advanced technique).

We make no claims about detection rates, false-positive rates, customer adoption, certifications, or regulatory compliance for this free utility.

Links

License

MIT — see LICENSE.

来源：README.md，提交 a1ed854

工具

0
SourceWeft 尚未在沙箱中启动过该软件包，因此其工具未知。

版本历史

1
  1. v0.1.1最新Sep 16, 2026

评分

已满足适用检查项的 50%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分