credential-free

MCP server that scans code for exposed secrets. Detects API keys, tokens, and credentials in 69 patterns across cloud, AI, payment, and auth services.

Quick Setup ( 2 minutes )

Install System-wide

⚠️ Requires Python 3.10+

# Clone and install
git clone <repo-url>
cd credential-free
pip install -e .

# Run server
python -m src.server

Alternative: Requirements File

pip install -r requirements.txt
python -m src.server

Add to Your IDE

Windsurf / Kiro

Edit mcp_config.json:

{
  "mcpServers": {
    "credential-free": {
      "command": "/usr/bin/python3",
      "args": ["-m", "src.server"],
      "env": {}
    }
  }
}

Find your Python path:

# Mac/Linux
which python3

# Windows
where python

Claude Desktop

Edit claude_desktop_config.json:

{
  "mcpServers": {
    "credential-free": {
      "command": "/usr/bin/python3",
      "args": ["-m", "src.server"],
      "env": {}
    }
  }
}

Test It

MCP Server Test

# Test the server
python -c "from src.server import get_patterns; print('Server works!')"

CLI Test

# Test CLI info
python -m src info

# Test CLI scan
python -m src scan file README.md

# Test CLI with exclude patterns
python -m src scan directory . --exclude-patterns '.*\.txt$'

Usage Examples

MCP Server (AI Assistant)

Ask your AI:

• "scan this file for secrets"
• "check my project for exposed api keys"
• "what patterns do you detect?"
• "find any hardcoded credentials"
• "scan my project but exclude .txt files"

CLI (Standalone)

# Scan single file
python -m src scan file config.py

# Scan directory with exclusions
python -m src scan directory . --exclude-patterns '.*\.txt$' '.*\.md$'

# Scan text content
python -m src scan content "AKIAIOSFODNN7EXAMPLE"

# Show scanner info
python -m src info

tools

MCP Tool	CLI Command	description
scan_file	python -m src scan file	scan a file for secrets
scan_directory	python -m src scan directory	scan a folder recursively (supports exclude_patterns)
scan_content	python -m src scan content	scan text directly
get_patterns	python -m src info	list detection patterns

what it detects

69 patterns across:

• cloud: aws, gcp, azure, vercel, heroku
• ai: openai, anthropic, huggingface, groq
• payment: stripe, square
• auth: github, gitlab, slack, discord
• database: postgresql, mongodb, redis

example output

{
  "success": true,
  "count": 2,
  "findings": [
    {
      "type": "AWS Access Key",
      "value": "AKIA****MPLE",
      "severity": "CRITICAL",
      "category": "cloud"
    }
  ]
}

docker

docker build -t credential-free .
docker run credential-free

---

built for aws global vibe hackathon 2025