The request names no product, so the best matches are dedicated secrets scanners that detect leaked API keys, tokens and credentials in code. Betterleaks is an open-source scanner for this job 1, Ship Safe offers a free CLI with a secrets scanning action 414, Semgrep's platform includes secrets detection alongside SAST 818, and GitGuardian provides secrets scanning with a CLI-based action 515.
- 1
Betterleaksbetterleaks.comwebsite read, tools not yet checked
Open-source secrets scanner that detects leaked API keys, tokens and credentials in codebases, including GitHub, GitLab, AWS and Slack secret types.
- 2
Ship Safeshipsafe.shverified and signed
Free CLI with a scan_secrets action that scans a directory or file for leaked secrets, API keys and credentials and returns findings with severity and location 14.
+2 community tools built for it
for agents: scan_secrets · scan_repo · analyze_file
- 3
Semgrep App Security Platformsemgrep.devverified and signed
Application security platform with Secrets Detection alongside SAST and SCA, with a semgrep action that runs static analysis scans on code 18.
+4 community tools built for it
for agents: semgrep · semgrep · code-security
- 4
GitGuardian APIgitguardian.comverified and signed
Credential security platform that finds secrets in code and public repositories, with a ggshield-action that scans commits for secrets 15.
+1 community tools built for it
for agents: GitGuardian/ggshield-action · get_current_token_info
Sources
- 1Betterleaks A Better Secrets Scanner | Detect Leaked API Keys & Credentialsbetterleaks.com · read 2026-10-29
- 4Ship Safe — AI Agent Security Scanner for Developersshipsafe.sh · read 2026-10-29
- 5GitGuardian: Credential Layer Security Platformgitguardian.com · read 2026-10-29
- 8Semgrep App Security Platform | AI-assisted SAST, SCA and Secrets Detectionsemgrep.dev · read 2026-10-29
- 14ship-safe: declares "scan_secrets" (the record we read and signed)unfragile.ai · read 2026-10-24
- 15GitGuardian Shield Action: declares "GitGuardian/ggshield-action" (the record we read and signed)unfragile.ai · read 2026-10-24
- 18semgrep: declares "semgrep" (the record we read and signed)unfragile.ai · read 2026-10-24
For agents: the 10 actions behind this answer
· Betterleaks A Better Secrets Scanner website read, tools not yet checked
Betterleaks is an open-source secrets scanner that detects leaked API keys, tokens, and credentials in your codebase. Scan for GitHub, GitLab, AWS, Slack, and dozens more secret types.
check_secrets · ContrastAPI verified and signed
Scan source code (or snippet) for hardcoded secrets — cloud provider keys, API tokens, connection strings, private keys, passwords. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect leaked credentials before commit; for injection detection use check_injection. Free:
· Truffle Security Co. website read, tools not yet checked
Truffle Security protects your company from secret leaks with TruffleHog Enterprise. Scan Git repos in real-time. Detect Live API Keys across SaaS, code and cloud. Remediate your secrets and NHIs.
scan_secrets · ship-safe verified and signed
Scan a directory or file for leaked secrets, API keys, and credentials. Returns structured findings with severity, file location, and remediation advice.
GitGuardian/ggshield-action · GitGuardian Shield Action verified and signed
Scan commits for secrets and other issues.
scan_secrets · Security Scanner AI MCP found in code, not yet checked
Scan code for hardcoded secrets, API keys, credentials.
· Sectora website read, tools not yet checked
Multi-layer application security platform. DAST, API security, supply chain analysis, secrets detection, vibe coding risk scoring, and PR security gates in one unified solution.
semgrep · semgrep verified and signed
Semgrep catches security vulnerabilities in real-time and guides Claude to write secure code from the start.
· Trestle website read, tools not yet checked
Trestle is a local secret scanner that finds API keys, tokens, passwords, and private keys in your code. It runs entirely on your machine, with no network calls and no telemetry.
· nittim website read, tools not yet checked
Free scan of any public GitHub repo for committed secrets and vulnerable dependencies. Then a full audit in Cursor, Claude Code, Windsurf, Codex or Copilot, with evidence for every finding.
Labels are the instruments' verdict and are never changed by ranking. Agents and robots get this same answer as JSON at /api/v1/find?q=…&answer=1 and through the MCP server.