About

What this site is, what it does with your data, and what it does not claim.

What this is

An independent, non-commercial reference about credential hygiene for AI agents and MCP servers. It exists because the failure mode is common, entirely preventable, and almost never reported.

The scanner on the home page is the product. Everything else is the reasoning behind what it checks.

What happens to what you paste

Nothing, because nothing leaves your browser.

• The scanner is JavaScript running in your tab. It reads the text you pasted and writes a result into the same tab.
• There is no server call, no analytics event, no error reporting, no storage.
• The site sets no cookies and runs no third-party scripts.

You do not have to take that on faith, and you should not take it on faith anywhere. Open your browser’s developer tools, switch to the Network tab, and press Scan. Then paste your config. If you see a request, this claim is wrong.

What the scanner does not do

• It does not send your config anywhere, by design.
• It is a pattern and structure checker. It cannot tell you whether a credential is still valid, or whether an attacker has already used it.
• It does not replace a secret manager. Environment variables are the baseline, not the ceiling.
• It does not detect prompt injection, and nothing in your configuration will.

About the figures quoted here

Numbers on this site come from published research rather than our own measurement, and each is attributed at the point of use. They are order-of-magnitude figures about a fast-moving ecosystem, not precise counts. If you cite them, cite the underlying research.

The scanner’s own output is not a statistic. It is a report about the text you gave it, and nothing more.

Corrections

Security claims go stale. If something here is wrong, outdated, or overconfident, that is a bug worth hearing about and will be fixed.

One more thing

If you are reading this because something already happened: start there, and rotate before you investigate.