広告掲載
MCP.so
ログイン
G

Ghosthunt MCP Server

@78degrees

リポジトリ

基本情報

カテゴリ

開発者ツール

トランスポート

stdio

作者

78degrees

投稿者

78degrees

Ghosthunt MCP Server について

Find every leaked secret on your machine. Scans .env files, shell history, and config directories for API keys, tokens, and credentials. 35+ patterns including AWS, Stripe, GitHub, OpenAI, and more. Everything runs locally. Zero network calls.

#security#secrets#mcp#api-keys#credentials#developer-tools#scanning

Ghosthunt MCP Server の設定

以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。

{
  "mcpServers": {
    "ghosthunt": {
      "command": "npx",
      "args": [
        "-y",
        "ghosthunt"
      ]
    }
  }
}

Ghosthunt MCP Server のツール

4

Scan your entire machine for leaked API keys, tokens, and credentials. Checks .env files, AWS/SSH/Docker/npm configs, shell history, and more. Returns a detailed report with risk explanations, rotation URLs, and fix guidance. Also returns structured JSON data (in a second content block) for visual rendering. If you have visualization capabilities, render the JSON as a visual dashboard with a health score gauge, color-coded finding cards, and auto-fix indicators. Everything runs locally -- no data leaves your machine.

Fix leaked secrets found on your machine. Auto-cleans shell history (backs up first), adds .env to .gitignore where missing, and provides step-by-step rotation instructions with direct links for secrets that need manual rotation. Returns structured JSON (in a second content block) with before/after health scores for visual rendering. If you have visualization capabilities, render the JSON as a fix report dashboard with before/after health score comparison and auto-fixed item list. Run scan_secrets first to see what will be fixed.

Quick health check -- counts how many secrets are on your machine and gives you a health score (0-100). Faster than a full scan. Run scan_secrets for details, or fix_secrets to clean up.

Show GhostHunt version and license status. Displays whether you're on the Free or Pro tier and what Pro includes.

概要

What is Ghosthunt?

Ghosthunt is an MCP server that scans your development machine for API keys, tokens, and credentials hiding in places like .env files, shell history, AWS/SSH/Docker configs, and more. Everything runs locally with no data leaving your machine.

How to use Ghosthunt?

Add Ghosthunt to your Claude Desktop config by specifying npx -y ghosthunt as the MCP server command, then ask Claude to scan for secrets. You can also run it directly from the terminal via npx ghosthunt. Two tools are available: scan_secrets for a full detailed scan and scan_summary for a quick health check.

Key features of Ghosthunt

  • Scans 35+ secret patterns across common config files.
  • Recursively finds .env files under your home directory.
  • Checks shell history for pasted API keys.
  • Reports severity ratings and remediation steps for each finding.
  • Provides a health score (0–100) based on secret severity.
  • Fully local: no data sent to any server or internet access.

Use cases of Ghosthunt

  • Quickly assess if your machine has leaked credentials that need rotation.
  • Perform a privacy-safe audit before sharing or deploying a project.
  • Identify secrets accidentally committed or pasted into shell history.
  • Get a one-click health check via Claude before starting security work.

よくある質問

1

Does Ghosthunt send my data anywhere?

No. Ghosthunt runs entirely on your local machine. It does not send any data to any server, phone home, track usage, or access the internet. Scan results stay only in your Claude conversation.

2

What does Ghosthunt scan?

Ghosthunt scans environment files (`.env`, `.env.local`, etc.), AWS credentials, SSH keys, Docker config, npm/PyPI tokens, GitHub CLI OAuth tokens, shell history (`bash`, `zsh`, `fish`), Kubernetes config, netrc passwords, and more than 35 secret patterns including providers like AWS, Stripe, GitHub, OpenAI, Anthropic, Google, Slack, and Twilio.

3

How do I run a scan with Ghosthunt?

You can add Ghosthunt to Claude Desktop’s MCP configuration and ask Claude to “scan my machine for leaked secrets”. Alternatively, run `npx ghosthunt` directly from your terminal. Use `scan_secrets` for a full report or `scan_summary` for a quick health check.

4

What do the health scores mean?

Your score starts at 100 and is reduced based on finding severity: critical (−15), high (−8), medium (−3), and low (−1). A score below 50 indicates secrets that need immediate attention.

5

What should I do if Ghosthunt finds critical secrets?

Rotate critical secrets immediately from the provider’s dashboard. Clear your shell history of sensitive commands. Ensure your `.env` files are in `.gitignore` and audit them for any that should not be committed.

コメント

「開発者ツール」の他のコンテンツ

FARPY

mangomunchr

Verified distributed compute for humans, applications, and agents. Submit Blender, Octane, and video workloads, route them across qualified GPUs, track asynchronous execution, download finished artifacts, and verify FARP

1

Pugi

Pugi Inc.

Pugi is an AI product team that builds, checks and publishes websites and apps. Its MCP server gives agents a passive website security check graded A+ to F (headers, TLS, cookies, exposed keys in scripts), free with a no

M

MeroFoundry

MERO Consulting Inc

MeroFoundry is a remote MCP server available at https://platform.merofoundry.com/mcp.

Casefile

azimov777

One case file per task — shared by every session, agent and person that touches it. Self-hosted MCP server and live board. MIT.

3

SSH MCP Server

hypnosis

SSH MCP server for AI agents: remote commands, file transfer, log search and server audits through OpenSSH.

1
広告掲載