Secrets-LE
Find hardcoded credentials in a codebase, and never print one into the report
No editor in the loop? npx -y secrets-le-mcp runs the same engine as an MCP server, so an agent can call detect_secrets with nothing else installed, and cargo install secrets-le puts the same check in a terminal. Every way to install it.
What Secrets-LE does
The cheapest place to catch a committed credential is before the commit. Secrets-LE scans your workspace for API keys, passwords, tokens and private keys, groups the findings by file with positions pointing at the value, and can replace them in place with a placeholder. Detection is regex-based over full text, so it works on code, configs, .env files, YAML, JSON and logs alike.
What people use it for
Pre-commit safety net
Scan the workspace and see every detected credential grouped by file, with line and column positions.
Sanitize in place
Replace the secrets in the active file with a placeholder, ready to share or paste into an issue.
Patterns, not proof
A scanner built on patterns can miss secrets and can flag things that are not. Review the results — it is a net, not a guarantee.
4 commands in the palette
Open the command palette and type the name. Nothing is bound to a shortcut by default — the editor's keymap is the user's, not ours.
secrets-le.detectsecrets-le.sanitizesecrets-le.openSettingssecrets-le.helpInstall Secrets-LE
VS Code
ext install nolindnaidoo.secrets-leOpen Quick Open (Cmd/Ctrl+P) and paste.
Cursor / VSCodium
cursor --install-extension OffensiveEdge.secrets-leVS Code forks pull from Open VSX, where the namespace is OffensiveEdge.
Zed
npx -y secrets-le-mcpWorks in Zed today — add the command above as a custom MCP server from the agent panel, and detect_secrets appears in its tool list. There is no one-click listing in Zed's extension registry yet.
AI agents
npx -y secrets-le-mcpRuns Secrets-LE's engine as an MCP server, so an agent can call detect_secrets with no editor involved. VS Code 1.101+ needs nothing — the extension registers it for you.
Where it ships
One engine, 6 places to get it. The ids differ by registry — copy the one for the editor you use.
Zed
built from Rust in the tool reposecrets-leOpenno listing yet — this links Zed’s instructions for adding it by hand
Where Secrets-LE lives
- VS Code Marketplacesecrets-le
- Open VSXfor Cursor and VSCodium
- npmsecrets-le-mcp
- GitHubsource, issues, changelog
- MCP registryio.github.nolindnaidoo/secrets-le
The other 15
Extract every string in a codebase, with its position, so a person can read them
Extract every hardcoded number in a codebase, so a person can check them
Extract every file path in a codebase, and say whether it still points at anything
Extract every color in a codebase, and say which ones are not in your palette
Extract every URL in a codebase, with its protocol and exact position
Extract every date and timestamp, and the exact instant each one resolves to
Extract every quantity with its unit, normalized, and refuse the ambiguous ones by name
Extract every UUID, ULID, NanoID, ObjectId and Snowflake, and decode the time inside
Extract every IP address, CIDR block and MAC, normalized and classified by scope
Find every regex in a codebase, and report which can be driven into catastrophic backtracking
Check whether a page is scrapeable before the scraper is written, and say when it cannot tell
Find where one dependency is constrained differently across a repository's manifests
Identify the i18n library a project uses, then audit its catalogs by that library's rules
Compare the dotenv files in a tree, and say which keys are missing from which
Find the Unicode that hides meaning — bidi controls, invisibles, homoglyphs, mixed scripts