广告合作
MCP.so
登录
G

Ghosthunt MCP Server

@78degrees

代码仓库

基本信息

分类

开发工具

传输方式

stdio

作者

78degrees

提交者

78degrees

关于 Ghosthunt MCP Server

Find every leaked secret on your machine. Scans .env files, shell history, and config directories for API keys, tokens, and credentials. 35+ patterns including AWS, Stripe, GitHub, OpenAI, and more. Everything runs locally. Zero network calls.

#security#secrets#mcp#api-keys#credentials#developer-tools#scanning

Ghosthunt MCP Server 配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "ghosthunt": {
      "command": "npx",
      "args": [
        "-y",
        "ghosthunt"
      ]
    }
  }
}

Ghosthunt MCP Server 工具

4

Scan your entire machine for leaked API keys, tokens, and credentials. Checks .env files, AWS/SSH/Docker/npm configs, shell history, and more. Returns a detailed report with risk explanations, rotation URLs, and fix guidance. Also returns structured JSON data (in a second content block) for visual rendering. If you have visualization capabilities, render the JSON as a visual dashboard with a health score gauge, color-coded finding cards, and auto-fix indicators. Everything runs locally -- no data leaves your machine.

Fix leaked secrets found on your machine. Auto-cleans shell history (backs up first), adds .env to .gitignore where missing, and provides step-by-step rotation instructions with direct links for secrets that need manual rotation. Returns structured JSON (in a second content block) with before/after health scores for visual rendering. If you have visualization capabilities, render the JSON as a fix report dashboard with before/after health score comparison and auto-fixed item list. Run scan_secrets first to see what will be fixed.

Quick health check -- counts how many secrets are on your machine and gives you a health score (0-100). Faster than a full scan. Run scan_secrets for details, or fix_secrets to clean up.

Show GhostHunt version and license status. Displays whether you're on the Free or Pro tier and what Pro includes.

概览

What is Ghosthunt?

Ghosthunt is an MCP server that scans your development machine for API keys, tokens, and credentials hiding in places like .env files, shell history, AWS/SSH/Docker configs, and more. Everything runs locally with no data leaving your machine.

How to use Ghosthunt?

Add Ghosthunt to your Claude Desktop config by specifying npx -y ghosthunt as the MCP server command, then ask Claude to scan for secrets. You can also run it directly from the terminal via npx ghosthunt. Two tools are available: scan_secrets for a full detailed scan and scan_summary for a quick health check.

Key features of Ghosthunt

  • Scans 35+ secret patterns across common config files.
  • Recursively finds .env files under your home directory.
  • Checks shell history for pasted API keys.
  • Reports severity ratings and remediation steps for each finding.
  • Provides a health score (0–100) based on secret severity.
  • Fully local: no data sent to any server or internet access.

Use cases of Ghosthunt

  • Quickly assess if your machine has leaked credentials that need rotation.
  • Perform a privacy-safe audit before sharing or deploying a project.
  • Identify secrets accidentally committed or pasted into shell history.
  • Get a one-click health check via Claude before starting security work.

常见问题

1

Does Ghosthunt send my data anywhere?

No. Ghosthunt runs entirely on your local machine. It does not send any data to any server, phone home, track usage, or access the internet. Scan results stay only in your Claude conversation.

2

What does Ghosthunt scan?

Ghosthunt scans environment files (`.env`, `.env.local`, etc.), AWS credentials, SSH keys, Docker config, npm/PyPI tokens, GitHub CLI OAuth tokens, shell history (`bash`, `zsh`, `fish`), Kubernetes config, netrc passwords, and more than 35 secret patterns including providers like AWS, Stripe, GitHub, OpenAI, Anthropic, Google, Slack, and Twilio.

3

How do I run a scan with Ghosthunt?

You can add Ghosthunt to Claude Desktop’s MCP configuration and ask Claude to “scan my machine for leaked secrets”. Alternatively, run `npx ghosthunt` directly from your terminal. Use `scan_secrets` for a full report or `scan_summary` for a quick health check.

4

What do the health scores mean?

Your score starts at 100 and is reduced based on finding severity: critical (−15), high (−8), medium (−3), and low (−1). A score below 50 indicates secrets that need immediate attention.

5

What should I do if Ghosthunt finds critical secrets?

Rotate critical secrets immediately from the provider’s dashboard. Clear your shell history of sensitive commands. Ensure your `.env` files are in `.gitignore` and audit them for any that should not be committed.

评论

开发工具 分类下的更多 MCP 服务器

Foremerge

naw103

Catch intent conflicts before code conflicts. The open-source coordination protocol for coding agents, built above Git.

50

Moxie Docs

Jackalope-Dev

Automated codebase documentation for GitHub: searchable docs, MCP context for AI agents, doc drift detection, and Friday Cleanup PRs.

1

MCP Server By TestMu AI

TestMu AI

TestMu AI MCP Server lets developers run, debug, and triage tests through natural language directly from their IDE (Cursor, Claude, GitHub Copilot, and other MCP clients). It exposes five tools — HyperExecute (test orche

Modelglass

Modelglass

Modelglass turns "which model should I use?" into a lookup instead of a guess. Seven tools give your agent live pricing across image, language, video, and audio models. Sourced and versioned, not scraped once and forgott

1

Raccha AI

Shree Mandadi

MCP-first toolbox for agents: namespaced key-value storage, a FIFO queue, auth, and a handful of stateless utility tools (JWT decode, hashing, cert inspection, CIDR math). Free while in early access. This repository is a

广告合作