Secret Scan

Scan code, config or logs for leaked secrets: AWS keys, GitHub tokens, Stripe keys, API keys, private keys, database URLs and JWTs.

Pay by wallet (x402) secret-scan

Example

Example answer

{
  "clean": true,
  "findings": [],
  "lines_scanned": 1,
  "total_findings": 0,
  "severity_summary": {
    "high": 0,
    "medium": 0,
    "critical": 0
  }
}

Inputs

Field	Type	Required	What it is
`text`	string	Yes	Code, config, or log output

Output fields

How reliably each field appears in a successful answer.

Field	Type	Appears
`clean`	boolean	Always (present in every successful answer)
`findings`	array	Always (present in every successful answer)
`total_findings`	integer	Always (present in every successful answer)
`severity_summary`	object	Always (present in every successful answer)

How to call it

The same tool through each route. MCP clients reach it through Strale’s server at https://api.strale.io/mcp; the call below is what the agent sends.

# Needs an API key. max_price_cents caps what this call may cost.
curl -X POST https://api.strale.io/v1/do \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "capability_slug": "secret-scan",
    "inputs": {
      "text": "This is a test input for automated capability testing."
    },
    "max_price_cents": 2
  }'

{
  "tool": "strale_execute",
  "arguments": {
    "slug": "secret-scan",
    "inputs": {
      "text": "This is a test input for automated capability testing."
    },
    "max_price_cents": 2
  }
}

import { Strale } from "straleio";

const strale = new Strale({ apiKey: process.env.STRALE_API_KEY! });
const result = await strale.do({
  capability_slug: "secret-scan",
  inputs: {
    "text": "This is a test input for automated capability testing."
  },
  max_price_cents: 2,
});

import os
from straleio import Strale, DoRequest

strale = Strale(api_key=os.environ["STRALE_API_KEY"])
result = strale.do(DoRequest(
    capability_slug="secret-scan",
    inputs={
        "text": "This is a test input for automated capability testing.",
    },
    max_price_cents=2,
))

# No account. The first request answers 402 with the price in USDC;
# an x402 client pays it from your wallet and repeats the request.
curl -i 'https://api.strale.io/x402/v2/secret-scan?text=This+is+a+test+input+for+automated+capability+testing.'

Limitations

Custom formats and encrypted secrets are not detected
Pattern-based detection of common secret formats — custom API key formats and encrypted secrets will not be detected
What to do instead: Add custom regex patterns for your organisation's API key formats and service-specific credential patterns

Bundled checks that include it

Pre-Merge Check €0.32
Repo Health Check €0.22