# maskline

> An MCP server that scans AI agent transcripts and build logs for leaked secrets, including shell-trace lines, and returns a redacted copy with a plain report.

- Type: MCP server
- Author: EngineeringErgonomics
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-11-04
- Source repository: https://github.com/EngineeringErgonomics/maskline
- Repo state: not archived
- Last push: 2026-11-03T13:19:31Z
- Stars: 0 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: Python
- Health checked at: 2026-11-05T20:35:15.821Z
- Domains: data-security, ai-security
- Tags: secrets-detection, log-redaction, agent-transcripts, python
- Date added: 2026-11-03
- Transport: stdio
- Runtime: python
- Auth method: none
- Tools:
  - `scan_text`: Scan a text string for leaked secrets and return the findings with a redacted copy.
  - `scan_file`: Scan a file for leaked secrets and return the findings with a redacted copy.
- Listing page: https://exchange.tenable.com/mcp-servers/maskline
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/mcp-servers/maskline.md

maskline is an MCP server for one step in the agent workflow: check text before you share it. It scans AI agent transcripts and build logs for leaked secrets, including shell-trace lines, and returns a redacted copy with a plain report.

## What it does

The server exposes two tools. `scan_text` takes a text string. `scan_file` takes a file. Each tool returns the findings, by line and rule name, and a redacted copy of the input. A reviewer can share the redacted copy in place of the raw log and does not search the log by hand first.

## How it works

The scan core uses named patterns and runs in Python with the standard library only. The patterns cover PEM header lines, token prefixes, `KEY=value` lines, shell-trace lines such as `+ export KEY=...`, and high-entropy runs. The server runs over MCP stdio and needs no network access and no model call for the core scan. A plain demo mode (`python3 server.py --demo`) scans the bundled synthetic example files, so a first run needs no secret and no service.

This is a first-pass scanner. It can miss secrets (false negatives) and it can flag text that is not a secret, such as long hashes (false positives). Treat a clean report as a check, not a guarantee.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/mcp-servers/maskline.json. The full index and how to read it: https://exchange.tenable.com/llms.txt