{"uid":"cap_TqSPAefL6wymL96oMvjzh","slug":"openverbs-secret-scanner-9dab42bf","name":"OpenVerbs Secret Scanner","description":"Scan source code or configuration text for hardcoded secrets: AWS access keys, GitHub/Slack/Google tokens, Stripe and OpenAI keys, PEM private-key blocks, JWTs and high-entropy secret assignments. Placeholder values are filtered out. Each finding gives the rule, a severity (critical/high/medium/low), line and column, entropy and a masked excerpt. Offline and deterministic.","url":"https://scan.openverbs.com/v1/secrets","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"type":"object","required":["content"],"properties":{"content":{"type":"string","maxLength":500000,"minLength":1,"description":"The source code or configuration text to scan for secrets."}},"additionalProperties":false},"type":{"type":"string","const":"http"},"method":{"enum":["POST"],"type":"string"},"bodyType":{"enum":["json","form-data","text"],"type":"string"}},"additionalProperties":false}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.004","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.004/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.004","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.004","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_-64tCvPxyF-7bAnudTukX","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.004","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Scans source code or configuration text for hardcoded secrets such as API keys, tokens, private keys, and JWTs, returning findings with severity, location, entropy, and masked excerpts.","exampleAgentPrompt":"Scan this code for hardcoded secrets and tell me what you find — I want to know the severity, which line each secret is on, and a masked preview so I can find and remove them: `AWS_SECRET_ACCESS_KEY = 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'`","exampleUseCases":[{"title":"Pre-commit secret audit","prompt":"Before I push this code to GitHub, scan it for any hardcoded secrets like AWS keys, API tokens, or private keys — tell me exactly which lines to fix and how severe each issue is."},{"title":"CI pipeline configuration check","prompt":"Here's my deployment config file — can you check it for any hardcoded credentials, Stripe keys, or OpenAI tokens that shouldn't be there? Show me the severity and line numbers for each finding."},{"title":"Third-party code vetting","prompt":"I just received this JavaScript library from a contractor — scan it for any embedded secrets or high-entropy strings that look like API keys or JWTs before I include it in our codebase."}],"resultDescription":"Returns a list of findings, each containing: the matched rule name (e.g. 'aws-access-key', 'openai-api-key'), a severity rating (critical/high/medium/low), the line and column where the secret was found, an entropy score, and a masked excerpt of the detected secret. Placeholder or dummy values are automatically filtered out. The response is deterministic and computed offline.","failureModes":["Empty or whitespace-only content returns no findings","Content exceeding 500,000 characters is rejected","Obfuscated or split secrets may not be detected","Secrets embedded in binary-encoded strings may be missed","False negatives for novel or uncommon token formats not covered by built-in rules"],"whenToPreferThis":"Choose this endpoint when you need fast, offline, deterministic secret scanning without sending code to a cloud analysis service. It is ideal for pre-commit hooks, CI pipelines, and automated code review where latency must be low and results must be reproducible. Prefer it over general SAST tools when the specific concern is credential leakage rather than broader code quality issues.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-13T12:30:06.323Z","isFirstParty":false}