maskline
An MCP server that scans AI agent transcripts and build logs for leaked secrets, including shell-trace lines, and returns a redacted copy with a plain report.
Baseline review at submission: an accuracy and overt-behavior check, not a full security audit, and it does not cover later changes to the repository. Learn more about our security review process.
Tools (2)
- scan_text
Scan a text string for leaked secrets and return the findings with a redacted copy.
- scan_file
Scan a file for leaked secrets and return the findings with a redacted copy.
For AI agents: this listing as JSON or Markdown. It is one of 140 listings in the full index.
maskline is an MCP server for one step in the agent workflow: check text before you share it. It scans AI agent transcripts and build logs for leaked secrets, including shell-trace lines, and returns a redacted copy with a plain report.
What it does
The server exposes two tools. scan_text takes a text string. scan_file takes a file. Each tool returns the findings, by line and rule name, and a redacted copy of the input. A reviewer can share the redacted copy in place of the raw log and does not search the log by hand first.
How it works
The scan core uses named patterns and runs in Python with the standard library only. The patterns cover PEM header lines, token prefixes, KEY=value lines, shell-trace lines such as + export KEY=..., and high-entropy runs. The server runs over MCP stdio and needs no network access and no model call for the core scan. A plain demo mode (python3 server.py --demo) scans the bundled synthetic example files, so a first run needs no secret and no service.
This is a first-pass scanner. It can miss secrets (false negatives) and it can flag text that is not a secret, such as long hashes (false positives). Treat a clean report as a check, not a guarantee.