secret sentinel

Credentials pushed to a repository or pasted into a prompt are compromised instantly, even if you delete them in the next commit. Secret Sentinel prevents these leaks before they happen and provides a systematic remediation path when exposures occur. It integrates directly into your agentic workflow to ensure API keys, tokens, and private keys never leave your local environment or enter your logs.

What it does

• Proactive scanning checks staged git changes, full directories, or specific files for over 64 types of credentials.
• Automated redaction cleans logs, stack traces, and command outputs by replacing secrets with redacted placeholders before you share them.
• Configuration auditing scans MCP client configs, .mcp.json, and agent instructions to ensure no credentials are hardcoded in repo-tracked files.
• Remediation playbooks provide step-by-step guidance for rotating compromised keys and cleaning git history.
• Pre-commit enforcement installs local hooks to block any commit that contains a detected secret.

How it works

1. Use scan_git_staged or scan_git_range before every commit or push to verify your changes are clean.
2. Run redact_text on any terminal output or log file before quoting it in a prompt or sharing it with the agent.
3. Replace hardcoded literals with environment variable lookups like os.getenv or process.env based on the detected finding.
4. Apply the install-hook command to automate local guardrails for the entire project.

Frameworks & tools

Built for Python 3.10+ and available as both an MCP server and a CLI. It supports major agent environments including Claude Code and Cursor, with a dedicated GitHub Action for CI/CD integration.

Why this beats prompting it yourself

Generic prompts often miss base64-encoded secrets or high-entropy strings that don't look like standard keys. This skill uses a specialized engine with 64 specific detectors and base64-aware scanning, ensuring that "security through obscurity" doesn't lead to a breach.

Use cases

• Pre-flight checks to scan all staged files before running git commit.
• Log sanitization to strip sensitive tokens from a crash report before sending it to an AI for debugging.
• Agent config hardening to ensure your MCP server settings aren't leaking keys into your repository.
• Incident response to walk through a structured rotation and history cleanup after an accidental push.

Known limitations

Scanning requires the secret-sentinel MCP server or CLI to be installed locally. The scanner may truncate output in extremely large repositories, showing only the most severe findings.