Credential-free

You have a credential-free MCP Server that scans code for exposed secrets, detecting API keys, tokens, and credentials across 69 patterns spanning cloud, AI, payment, and auth services. Use it to catch hardcoded credentials before they cause risk or breach exposure in your projects.

How to use

Start the MCP server locally and connect your IDE or CLI to run scans. You can scan a single file, scan an entire directory, or scan arbitrary text content. The server returns findings with type, value, and a severity rating so you can prioritize remediation. When interacting through an MCP client, you’ll issue commands to scan and to retrieve the available detection patterns.

How to install

Prerequisites: Python 3.10 or newer. Ensure you have a working Python environment and access to install packages.

# Clone the project and install
git clone <repo-url>
cd credential-free
pip install -e .

# Run the server
python -m src.server

If you prefer the dependencies-based setup, install from a requirements file and then start the server.

pip install -r requirements.txt
python -m src.server

Alternative runtime setup used by IDE integrations uses a direct Python invocation to start the server.

y # no code fence, shown as a snippet
python -m src.server

Configuration and usage notes

Integrate with your IDE by adding the MCP server configuration to your IDE’s MCP config. The server is started as a stdio process that you invoke with Python and the -m src.server module.

{
  "mcpServers": {
    "credential_free": {
      "command": "/usr/bin/python3",
      "args": ["-m", "src.server"],
      "env": {}
    }
  }
}

Tools and endpoints you can use

The server provides these end-user tools to interact with the scanner: scan_file, scan_directory, scan_content, and get_patterns (info). You can run these through your MCP client or via the CLI exposed by the server.

Security and handling findings

Findings include the type of secret detected, its value (masked in output), the severity, and the category. Treat CRITICAL findings as high-priority and rotate or revoke any exposed credentials immediately.

Examples of usage patterns

MCP Server (AI Assistant) usage prompts you might use: scan this file for secrets, check my project for exposed api keys, what patterns do you detect, find any hardcoded credentials.

Troubleshooting

If the server does not start, verify Python 3.10+ is active and that dependencies installed correctly. Reinstall with pip if needed and ensure the -m src.server module runs without errors.

Available tools

scan_file

Scan a single file for secrets using the configured patterns.

scan_directory

Scan a folder recursively, with optional exclude patterns.

scan_content

Scan raw text content for secrets.

get_patterns

List the detection patterns used by the scanner.