Secret Hygiene scans bounded local files for common secret-like patterns and returns category counts only. It is designed as a pre-commit review signal, not a credential detector with perfect coverage.

Quick start

npm install
npm test
npm start

Use scan_secret_hygiene inside SECRET_HYGIENE_ROOT.

Privacy and limits

Values, keys, matches, filenames, paths, and source text are never returned. Pattern matching is conservative and can produce false positives or miss unusual formats. Rotate exposed credentials separately.

Premium tools

These tools need a license key:

entropy_profile

Buy a key at https://mcp-marketplace.io/server/io-github-mrfentmen-secret-hygiene-mcp and set it in your MCP client config:

"env": { "MCP_LICENSE_KEY": "mcp_live_..." }

The key is checked against MCP Marketplace, cached for 24 hours, and keeps working offline once one check has succeeded. Every other tool on this server stays free.