Netallion MCP Lite

io.github.netallion由 GitHub 帳號 netallion 發布v0.1.1更新於 Oct 24, 2026

Local secret & credential checks for AI-assisted dev — runs on your machine, results redacted.

已驗證STDIO僅桌面開發者工具安全與監控

概覽

AI 產生的概覽

一個本機 MCP 伺服器，掃描文字與檔案中的常見密鑰和憑證，回傳已去識別化的結果，讓助理能安全檢查程式碼。

可以做什麼
掃描字串中的常見密鑰與憑證，回傳已去識別化的發現，包含規則、嚴重程度、位置與修復建議。在設定的工作區根目錄內掃描檔案，並拒絕 .env、金鑰等敏感檔案。列出支援的常見檢查項目，且不揭露任何密鑰。提供關於工具隱私立場，以及免費 Lite 版與商業平台差異的說明。
適用情境
當 AI 程式助理處理可能含有 API 金鑰、權杖、私鑰或資料庫 URI 的程式碼、設定或貼上文字時，可在提交或分享前做一次快速本機檢查。它只是輕量入門工具，並非完整的密鑰掃描或治理平台。
執行需求
以 Python 套件形式透過 stdio 在本機執行，需要 Python 3.10 或更新版本；可用 pip 安裝，或以 uvx 免安裝執行。不需帳號或 API 金鑰。可選擇設定環境變數 NETALLION_MCP_LITE_WORKSPACE_ROOT，將檔案掃描限制在特定目錄內。
安裝前請注意
偵測僅涵蓋約 27 種常見、高信賴度的樣式，無法找出混淆、編碼或組織特有的密鑰；也未對偵測率或誤報率作出任何聲明。結果雖已去識別化，但工具會讀取本機檔案內容，應盡量縮小工作區根目錄。它是免費工具，無遙測，不向廠商傳送資料。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Netallion MCP Lite，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

Netallion MCP Lite

[PyPI] [Python] [CI] [License: MIT]

Free, local, IP-safe AI-development security — an MCP server from Netallion.

Netallion MCP Lite is a small Model Context Protocol server that helps you and your AI coding assistants avoid the most common mistake in AI-assisted development: leaking a credential. It flags a curated set of commodity, high-confidence secrets and credentials (AWS, GitHub, Stripe, OpenAI, private keys, database URIs, and more) in text and files.

It runs entirely on your machine. No account. No data sent to Netallion. Detected secrets are redacted before results are returned, so they are safe to hand back into an AI assistant's context.

Part of Netallion's Agentic Development Governance approach — secret detection is one capability, not the whole story.

What it is (and isn't)

Netallion MCP Lite (this package)Netallion AI Assurance (the platform)
PriceFreeCommercial (free trial)
RunsLocally, no accountSaaS + IDE + CI
Detection~27 commodity, high-confidence checksAdvanced detection well beyond commodity patterns
AI/MCP governance—AI provider governance, MCP governance
Policy & visibility—Central policy management, org-wide visibility
Compliance—Compliance and audit evidence
DataNothing leaves your machineEnterprise controls

MCP Lite is deliberately limited. It is a genuinely useful local utility and an on-ramp: if you want advanced detection, AI/MCP governance, central policy, and audit evidence across your organisation, that lives in Netallion AI Assurance.

This package does not contain or depend on Netallion's proprietary detection engine.

Install & run

Requires Python 3.10+.

bash
pip install netallion-mcp-lite# or, zero-install:uvx netallion-mcp-lite

It speaks MCP over stdio. Add it to any MCP-compatible client (Claude, Cursor, Windsurf, VS Code, …):

json
{  "mcpServers": {    "netallion-mcp-lite": {      "command": "netallion-mcp-lite"    }  }}

Optionally confine scan_file to a specific directory:

json
{  "mcpServers": {    "netallion-mcp-lite": {      "command": "netallion-mcp-lite",      "env": { "NETALLION_MCP_LITE_WORKSPACE_ROOT": "/path/to/your/project" }    }  }}

Tools

ToolWhat it does
scan_textScan a string for commodity secrets; returns redacted findings (rule, severity, line/column, remediation).
scan_fileScan a file inside the workspace root; sensitive files (.env, keys) are refused; findings redacted.
list_supported_checksList the commodity checks (no secrets).
aboutAbout the tool, privacy posture, and Lite vs AI Assurance.

Run list_supported_checks to see the full set. Findings never include the full secret value.

Privacy

Local-only. No telemetry. No source, file contents, prompts, or secrets are sent anywhere. See PRIVACY.md.

Scope & limitations

  • Commodity, high-confidence formats only — it will not catch obfuscated, encoded, or org-specific secrets. That is by design; advanced detection is part of Netallion AI Assurance.
  • scan_file reads only within a single workspace root and refuses obviously-sensitive files.
  • No generic high-entropy scanning (it produces noise without advanced technique).

We make no claims about detection rates, false-positive rates, customer adoption, certifications, or regulatory compliance for this free utility.

Links

License

MIT — see LICENSE.

來源：README.md，提交 a1ed854

工具

0
SourceWeft 尚未在沙箱中啟動過該軟體包，因此其工具未知。

版本歷史

1
  1. v0.1.1最新Sep 16, 2026

評分

已滿足適用檢查項的 50%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分