🛡️ MCP Security Toolkit: Key Scanner

A specialized Model Context Protocol (MCP) server for automated security auditing. This server doesn't just scan files—it uses Agentic Sampling to fetch and validate secrets from local paths or remote GitHub URLs autonomously.

✨ Features

• Smart Scan (New): Provide a GitHub URL, and the server will autonomously ask the AI agent to fetch the content for analysis using its own tools.
• Agentic Sampling: Uses the latest 2026 MCP spec to "chain" tasks between different servers (e.g., GitHub server + Security server).
• Multi-Provider Detection: Optimized for OpenAI, Anthropic, Gemini, and Azure.
• Live Validation: Safely checks if discovered keys are active via metadata-only API calls.

🛠️ Tools Included

1. smart_scan 🧠

The primary entry point. It intelligently handles both local and remote targets.

• Input: target (local path or GitHub URL)
• Logic: If a GitHub URL is detected, it uses MCP Sampling to request the AI to fetch the code.

2. scan_directory

Recursively scans a physical directory on the host machine.

• Input: path (string)

3. validate_key

Validates active status for OpenAI, Anthropic, and Azure.

• Input: provider, api_key, azure_endpoint (optional).

---

⚡ Prompt Shortcuts

This server provides built-in MCP Prompts to simplify your workflow:

• /audit_repo [url] — Automatically instructs the agent to fetch a repo and scan it for leaks in one go.

---

🚀 Quick Deployment (Render)

• Build: pip install fastmcp httpx uvicorn starlette
• Start: uvicorn server:app --host 0.0.0.0 --port $PORT

🔌 Connection

Cursor/VS Code SSE URL: https://your-app-name.onrender.com/sse

💬 Sample Prompts (Try These!)

Copy and paste these into your AI chat (Cursor, Claude, or Copilot) to see the toolkit in action.

1. The "Deep Audit" (Smart Scan)

"Use the Security-Toolkit to smart scan this GitHub file: https://github.com/rohitdhamija/mcp-security-scanner. If you find any keys, tell me which provider they belong to."

2. The "Local Clean-up"

"Audit my current project directory for any exposed API keys using scan_directory. Ignore the venv folder and give me a summary of findings."

3. The "Key Validator"

"I found an Anthropic key in my .env file: sk-ant-api03-xxxx.... Can you use the Security-Toolkit to check if this key is still active? Do not show the full key in the chat."

4. The "One-Click Repo Scan" (Using Prompt Shortcut)

"/audit_repo repo_url='https://github.com/rohitdhamija/mcp-security-scanner'"