Secrets-LE

Secrets-LE: Zero Hassle Secret Detection

Find hardcoded credentials across your workspace, then redact them in place

API keys, tokens, passwords, private keys — 100% local, nothing leaves your machine

---

Useful? A star or rating is how other developers find it —

★ GitHub ·

★ Open VSX ·

★ Marketplace

What it does

Open a workspace, run Secrets-LE: Detect Secrets, and every detected secret lands in a results document — grouped by file, with line/column positions pointing at the value itself. Run Secrets-LE: Sanitize Secrets to replace the secrets in the active file with a placeholder. Works in VS Code and in VS Code–based editors like Cursor and VSCodium (installable from Open VSX).

Detection is regex-based over the full text of each file, so it works on any text format — code, configs, .env files, YAML, JSON, logs. It is a pre-commit safety net, not a guarantee: a scanner built on patterns can miss secrets and can flag non-secrets. Review the results.

Install

Use it from an AI agent

The same engine runs as an MCP server, so an agent can call it directly instead of you running a command.

detect_secrets(content, sensitivity?, includeApiKeys?, includePasswords?, includeTokens?, includePrivateKeys?, maxResults?)

Reports each finding by type, confidence, key name and 1-based position. Values are never returned — previews are truncated and length-annotated, and the context line has the secret masked out, so a finding can be located without the credential leaving the machine it was found on.

The server takes content and returns data — it reads no files and makes no network requests of its own. Published as secrets-le-mcp on npm and as io.github.nolindnaidoo/secrets-le in the MCP registry.

Configuring it by hand — any host with an MCP config file

Most hosts read a JSON config. Add one entry:

{

"mcpServers": { "secrets-le": { "command": "npx", "args": ["-y", "secrets-le-mcp"] } } }

-y skips the install prompt on first run. Pin a version if you would rather not track releases — secrets-le-mcp@2.5.0.

Prefer not to go through npx on every launch? Install it once and point at the binary instead:

npm install -g secrets-le-mcp

{

"mcpServers": { "secrets-le": { "command": "secrets-le-mcp" } } }

It speaks MCP over stdio and needs no environment variables, no API key and no configuration of its own. To check it before wiring it into anything:

echo '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | npx -y secrets-le-mcp

That prints the tool list and exits — if you see detect_secrets, the server works.

Across a folder or a workspace

Detect reads files from disk and gives one report, grouped by file.

• The whole workspace: run Secrets-LE: Detect Secrets from the command palette.
• One folder: right-click it in the Explorer and choose Detect Secrets in Folder, or run Secrets-LE: Detect Secrets in Folder and pick one.

# Secrets Detection Results

⚠️ Found 2 potential secret(s):

📄 .env (1 secret(s))

PASSWORD (1)

• Line 1, Column 19 Key: database_password Type: Password Confidence: high Value: hunter2… (14 chars) Context: DATABASE_PASSWORD=hunter2… (14 chars)

📄 src/config.ts (1 secret(s))

API-KEY (1)

• Line 1, Column 17 Key: apikey Type: Generic API key Confidence: high Value: sk_demo_… (40 chars) Context: const apiKey = "sk_demo_… (40 chars)";

---

Warnings

• Not read: dependency folders, build output, caches and lockfiles; images, fonts, archives and other binary files; 1 file(s) ignored by .gitignore. The secrets-le.workspace.* settings change this.

What a scan reads. Files come from disk, so an unsaved edit is not seen. A file over the safety size, or one that is not UTF-8 text, is left unread. It stops at 10,000 files or 10,000 listed secrets. The report ends with a line for each thing it left out.

`.env` files are read even though `.gitignore` leaves them out. That is where a project keeps its secrets, and it is what this tool is run to look at. scanAlwaysInclude holds **/.env and **/.env.* by default. Empty it to leave them to .gitignore.

A scan that skips is not a clearance. A secret in a dependency folder, in another file .gitignore leaves out, or in a binary file is not reported. To screen everything, turn the three switches off.

What it skips, and how to change that. Three switches are on by default, and each can be turned off on its own in Settings:

Two lists adjust the result without turning a switch off. To skip more, add a pattern to scanExcludes. To read something a switch would skip, add it to scanAlwaysInclude:

{

// Also skip the test fixtures. "secrets-le.workspace.scanExcludes": ["/fixtures/"], // Keep reading .env files, and read the vendored code as well. "secrets-le.workspace.scanAlwaysInclude": ["/.env", "/.env.*", "/vendor/"] }

Secrets-LE: Open Settings opens all of these in the Settings editor.

The built-in list

Folders, wherever they appear:

.git, .hg, .svn, node_modules, bower_components, jspm_packages, .pnpm-store, .yarn, vendor, site-packages, Pods, Carthage, dist, build, out, target, _build, _site, dist-newstyle, zig-out, storybook-static, cdk.out, DerivedData, CMakeFiles, .next, .nuxt, .output, .svelte-kit, .angular, .astro, .docusaurus, .vuepress, .expo, .turbo, .parcel-cache, .cache, .sass-cache, .jekyll-cache, .dart_tool, .pub-cache, .gradle, .kotlin, .cxx, .externalNativeBuild, captures, ephemeral, .symlinks, .swiftpm, .build, .bundle, .stack-work, .zig-cache, .godot, elm-stuff, .vercel, .netlify, .serverless, .aws-sam, .terraform, .venv, venv, __pycache__, .tox, .nox, .mypy_cache, .pytest_cache, .ruff_cache, .ipynb_checkpoints, .eggs, coverage, htmlcov, .nyc_output, .vscode-test, .idea, .vs, xcuserdata, *.egg-info

Files, wherever they appear:

*.min.js, *.min.css, *.map, *.snap, *.lock, package-lock.json, pnpm-lock.yaml, npm-shrinkwrap.json, go.sum, *.pbxproj, *.iml, local.properties, output-metadata.json, .flutter-plugins, .flutter-plugins-dependencies, .packages, Generated.xcconfig, flutter_export_environment.sh, GeneratedPluginRegistrant.*, fastlane/report.xml, fastlane/test_output/**, doc/api/**

Not on the list, because they are ordinary folders in many projects: bin, obj, tmp, logs, public, generated. A project that generates those ignores them in git, and the scan reads .gitignore.

In the Problems panel. Turn on secrets-le.workspace.scanProblemsEnabled and each secret is also a warning on its line. Each scan replaces the last one's. A message names the kind of secret, never its value.

The settings that shape a scan are under Settings.

The CLI

The same detection runs from a terminal or a CI step: a Rust CLI in crate/, sharing one pattern table with the extension — crate/signatures/patterns.toml — so the two can never disagree about what counts as a credential. The same command line also ships on npm as secrets-le, for a machine with Node and no Rust, and CI holds it to the crate byte for byte on three operating systems.

secrets-le .                        # scan a tree

secrets-le --sensitivity high . # only high-confidence findings secrets-le --no-ignore --hidden . # reach .env and everything git ignores secrets-le mcp # the same detection over MCP on stdio

Install it from npm (secrets-le) or from crates.io (secrets-le). Both install the same secrets-le command.