Advertise
MCP.so
Sign In
G

Ghosthunt MCP Server

@78degrees

Repository

Basic information

Category

Developer Tools

Transports

stdio

Author

78degrees

Submitted by

78degrees

About Ghosthunt MCP Server

Find every leaked secret on your machine. Scans .env files, shell history, and config directories for API keys, tokens, and credentials. 35+ patterns including AWS, Stripe, GitHub, OpenAI, and more. Everything runs locally. Zero network calls.

#security#secrets#mcp#api-keys#credentials#developer-tools#scanning

Ghosthunt MCP Server config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "ghosthunt": {
      "command": "npx",
      "args": [
        "-y",
        "ghosthunt"
      ]
    }
  }
}

Ghosthunt MCP Server tools

4

Scan your entire machine for leaked API keys, tokens, and credentials. Checks .env files, AWS/SSH/Docker/npm configs, shell history, and more. Returns a detailed report with risk explanations, rotation URLs, and fix guidance. Also returns structured JSON data (in a second content block) for visual rendering. If you have visualization capabilities, render the JSON as a visual dashboard with a health score gauge, color-coded finding cards, and auto-fix indicators. Everything runs locally -- no data leaves your machine.

Fix leaked secrets found on your machine. Auto-cleans shell history (backs up first), adds .env to .gitignore where missing, and provides step-by-step rotation instructions with direct links for secrets that need manual rotation. Returns structured JSON (in a second content block) with before/after health scores for visual rendering. If you have visualization capabilities, render the JSON as a fix report dashboard with before/after health score comparison and auto-fixed item list. Run scan_secrets first to see what will be fixed.

Quick health check -- counts how many secrets are on your machine and gives you a health score (0-100). Faster than a full scan. Run scan_secrets for details, or fix_secrets to clean up.

Show GhostHunt version and license status. Displays whether you're on the Free or Pro tier and what Pro includes.

Overview

What is Ghosthunt?

Ghosthunt is an MCP server that scans your development machine for API keys, tokens, and credentials hiding in places like .env files, shell history, AWS/SSH/Docker configs, and more. Everything runs locally with no data leaving your machine.

How to use Ghosthunt?

Add Ghosthunt to your Claude Desktop config by specifying npx -y ghosthunt as the MCP server command, then ask Claude to scan for secrets. You can also run it directly from the terminal via npx ghosthunt. Two tools are available: scan_secrets for a full detailed scan and scan_summary for a quick health check.

Key features of Ghosthunt

  • Scans 35+ secret patterns across common config files.
  • Recursively finds .env files under your home directory.
  • Checks shell history for pasted API keys.
  • Reports severity ratings and remediation steps for each finding.
  • Provides a health score (0–100) based on secret severity.
  • Fully local: no data sent to any server or internet access.

Use cases of Ghosthunt

  • Quickly assess if your machine has leaked credentials that need rotation.
  • Perform a privacy-safe audit before sharing or deploying a project.
  • Identify secrets accidentally committed or pasted into shell history.
  • Get a one-click health check via Claude before starting security work.

Frequently asked questions

1

Does Ghosthunt send my data anywhere?

No. Ghosthunt runs entirely on your local machine. It does not send any data to any server, phone home, track usage, or access the internet. Scan results stay only in your Claude conversation.

2

What does Ghosthunt scan?

Ghosthunt scans environment files (`.env`, `.env.local`, etc.), AWS credentials, SSH keys, Docker config, npm/PyPI tokens, GitHub CLI OAuth tokens, shell history (`bash`, `zsh`, `fish`), Kubernetes config, netrc passwords, and more than 35 secret patterns including providers like AWS, Stripe, GitHub, OpenAI, Anthropic, Google, Slack, and Twilio.

3

How do I run a scan with Ghosthunt?

You can add Ghosthunt to Claude Desktop’s MCP configuration and ask Claude to “scan my machine for leaked secrets”. Alternatively, run `npx ghosthunt` directly from your terminal. Use `scan_secrets` for a full report or `scan_summary` for a quick health check.

4

What do the health scores mean?

Your score starts at 100 and is reduced based on finding severity: critical (−15), high (−8), medium (−3), and low (−1). A score below 50 indicates secrets that need immediate attention.

5

What should I do if Ghosthunt finds critical secrets?

Rotate critical secrets immediately from the provider’s dashboard. Clear your shell history of sensitive commands. Ensure your `.env` files are in `.gitignore` and audit them for any that should not be committed.

Comments

More Developer Tools MCP servers

Raccha AI

Shree Mandadi

MCP-first toolbox for agents: namespaced key-value storage, a FIFO queue, auth, and a handful of stateless utility tools (JWT decode, hashing, cert inspection, CIDR math). Free while in early access. This repository is a

Perfex CRM

themesic

Turn Perfex CRM into an AI-ready workspace. This MCP server exposes your full REST API to Claude, ChatGPT and any AI agent, so leads, invoices and tasks are one prompt away.

1

UXMachine

UXMachine

UXMachine measures a web page in a real browser and returns verifiable observations, each with its evidence and its limits. It opens the address on desktop (1280×800) and mobile (390×844) and follows the site's own links

Capgo MCP

Cap-go

Console, Backend and CLI to manage Capgo Instant update and Native build for Capacitor apps Build and upload to app store your mobile app

CircleCI MCP Server

CircleCI

Manage CI/CD pipelines, debug failed builds, and optimize test suites directly from your AI agents - no terminal required. The CircleCI MCP Server is a remote server hosted by CircleCI that connects AI tools and agents

Advertise