GitGuardian MCP Server — Secrets Scanning & Remediation

Overview

This MCP (Model Context Protocol) server integrates GitGuardian’s secrets-scanning capabilities into agent-driven workflows. It lets an AI assistant or other MCP-capable agent scan code, inspect incidents, manage honeytokens, and surface contextual data so remediation can be automated or guided without switching to the GitGuardian console. The server exposes read-oriented operations that help agents find and triage hardcoded credentials, API keys, and other sensitive artifacts detected by GitGuardian’s detector catalogue (500+ detector types).

The implementation is suitable for both GitGuardian SaaS and self-hosted instances and is intended to minimize risk by operating with limited permissions. Treat agents as powerful tools that require supervision: review actions taken on behalf of an agent and run this server only from trusted sources.

Features

• Secret scanning across a codebase (500+ detector signatures)
• Incident listing and detail lookup for the current project
• Honeytoken creation, listing and retrieval to detect credential exfiltration
• Authenticated user info and token metadata endpoints
• Token revocation (revoke tokens associated with the agent)
• Designed for read-only, low-privilege operation by default

Prerequisites

• A working MCP client (Cursor, Claude Desktop, Windsurf, Zed, etc.)
• uv/uvx tool for installing the MCP server package (see https://docs.astral.sh/uv/getting-started/installation/)
• A GitGuardian API key and (if applicable) base URL for self-hosted instances

Note: Environment variable names and exact auth details may vary by deployment. Check the repository README for the most up-to-date configuration keys: https://github.com/GitGuardian/gg-mcp

Installation / Configuration

Below are example MCP client configurations. Replace placeholders with real paths and credentials.

Cursor (one-click or manual)

• One-click install is available via Cursor’s MCP marketplace.
• Manual entry (~/.cursor/mcp.json):

{
  "mcpServers": {
    "GitGuardianDeveloper": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/GitGuardian/gg-mcp.git",
        "developer-mcp-server"
      ]
    }
  }
}

Claude Desktop

• Edit the MCP config (macOS: ~/Library/Application Support/Claude Desktop/mcp.json):

{
  "mcpServers": {
    "GitGuardianDeveloper": {
      "command": "/absolute/path/to/uvx",
      "args": [
        "--from",
        "git+https://github.com/GitGuardian/gg-mcp.git",
        "developer-mcp-server"
      ]
    }
  }
}

Windsurf

• Edit the Windsurf MCP config (example file locations vary by OS):

{
  "mcp": {
    "servers": {
      "GitGuardianDeveloper": {
        "type": "stdio",
        "command": "uvx",
        "args": [
          "--from",
          "git+https://github.com/GitGuardian/gg-mcp.git",
          "developer-mcp-server"
        ]
      }
    }
  }
}

Environment variables (example)

• For SaaS (default), you typically only need an API key. For self-hosted or EU instances set a base URL:

export GITGUARDIAN_API_KEY="sk_live_..."
export GITGUARDIAN_BASE_URL="https://your.gitguardian.instance/api"

Always consult the repository for exact variable names and any additional options.

Available Tools / Resources

The server exposes endpoints (tools) for typical secrets-security workflows. Typical resources you can call from your agent:

Refer to the project README for exact method names and request payload schemas.

Use Cases (concrete examples)

• “Scan this repo for leaked secrets”: Agent runs scanCode over the working tree, returns findings grouped by file with detector type and suggested remediation (rotate keys, remove secret, commit history scrub).
• “Remediate all incidents related to my project”: Agent lists incidents, opens each, proposes edits or PRs to remove hardcoded secrets and supplies step-by-step remediation (revoke key, rotate credentials).
• “Create and embed a honeytoken”: Agent creates a honeytoken named “dev-db”, returns the token string and shows where to place it in config files to detect unauthorized usage.
• “Check recent incidents assigned to me”: Agent filters incidents by assignee, shows unresolved items with severity and creation time so you can prioritize triage.

Prompt examples you can use with your agent:

• Remediate all incidents related to my project
• Scan this codebase for any leaked secrets or credentials
• Help me understand this security incident and provide remediation steps

Safety & Best Practices

• Treat agent-driven remediation as high-capability: require human approval for destructive actions.
• Use the server with low-privilege tokens where possible; this implementation focuses on read-only operations by default.
• For self-hosted GitGuardian instances, configure the base URL and network access carefully.

Where to get it

Source code and issue tracker: https://github.com/GitGuardian/gg-mcp

For feedback, feature requests, or to report issues, open an issue in the GitHub repository.