hackerdogs/gitleaks-mcp repository overview

⁠

⁠Gitleaks MCP Server

MCP server wrapper for Gitleaks⁠ — Secret detection tool for git repositories and files.

⁠What is Gitleaks?

Gitleaks (gitleaks) is a security tool that provides: Secret detection tool for git repositories and files.

See gitleaks/gitleaks⁠ for full documentation.

No API keys required — Gitleaks runs locally inside the Docker container.

Summary. MCP server wrapper for Gitleaks⁠ — Secret detection tool for git repositories and files.

Tools:

• run_gitleaks — Run gitleaks with the given arguments. Returns structured JSON output.
• download_file — Download a file or repository from a URL into the container workspace. Use this to pre-download content before running multiple analyses on the same data.
• cleanup_downloads — Remove downloaded files from the container workspace.

⁠Tools Reference

⁠run_gitleaks

Run gitleaks with the given arguments. Returns structured JSON output.

{
  "raw": "gitleaks output will appear here"
}

⁠download_file

Download a file or repository from a URL into the container workspace. Use this to pre-download content before running multiple analyses on the same data.

Returns JSON with path (local file path to use in other tools) and job_id (for cleanup).

⁠cleanup_downloads

Remove downloaded files from the container workspace.

⁠Example Prompts

Here are example prompts you can use with Claude (or any MCP client) when this tool is connected:

• "Run gitleaks with --help to see all available options."
• "Use gitleaks to scan the target 192.168.1.1."
• "What options does gitleaks support? Show me its help output."
• "Run gitleaks against example.com with default settings."
• "Execute gitleaks with verbose output enabled."
• "Use the gitleaks tool to analyze the target and report findings."

URL-based ingestion (no volume mounts needed):

• "Scan https://github.com/org/repo⁠ for leaked secrets in the git history using source_url."
• "Download the repo at https://github.com/org/backend⁠ and check it for API key leaks with gitleaks."

⁠Deploy

⁠Docker Compose (recommended)

docker-compose up -d

⁠Docker Run (stdio mode)

docker run -i --rm hackerdogs/gitleaks-mcp:latest

⁠Docker Run (HTTP streamable mode)

docker run -d -p 8332:8332 \
  -e MCP_TRANSPORT=streamable-http \
  -e MCP_PORT=8332 \
  hackerdogs/gitleaks-mcp:latest

⁠MCP Client Configuration

⁠Stdio mode (default)

Add to your Claude Desktop or Cursor MCP config:

{
  "mcpServers": {
    "gitleaks-mcp": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "-e", "MCP_TRANSPORT", "hackerdogs/gitleaks-mcp:latest"],
      "env": {
        "MCP_TRANSPORT": "stdio"
      }
    }
  }
}

⁠HTTP mode (streamable-http)

First, start the server using Docker Compose or docker run with HTTP mode (see Deploy⁠ above), then point your MCP client at the running server:

{
  "mcpServers": {
    "gitleaks-mcp": {
      "url": "http://localhost:8332/mcp"
    }
  }
}

⁠Environment Variables

⁠Installing in Hackerdogs

The fastest way to get started is through Hackerdogs⁠:

1. Log in to your Hackerdogs account.
2. Go to the Tools Catalog.
3. Search for the tool by name (e.g. "nuclei", "naabu", "julius").
4. Expand the tool card and click Install — you're ready to go.

1. Vendor API key required? Add your key in the config environment variable field before clicking Install. Your key will be encrypted at rest.
2. Enable / Disable the tool anytime from the Enabled Tools page.
3. Need to update a key or parameter? Go to My Tools → toggle Show Decrypted Values → edit → Save.

⁠Build

docker build -t hackerdogs/gitleaks-mcp:latest .

⁠Testing

⁠Automated tests

./test.sh

⁠Test directly with Docker

1. Start the server in HTTP mode:

docker run -d --rm --name gitleaks-mcp-test -p 8332:8332 \
  -e MCP_TRANSPORT=streamable-http \
  hackerdogs/gitleaks-mcp:latest

2. Initialize the MCP session:

SESSION_ID=$(curl -s -D - -X POST http://localhost:8332/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"test","version":"0.1"}}}' \
  2>&1 | grep -i mcp-session-id | awk '{print $2}' | tr -d '\r\n')

curl -s -X POST http://localhost:8332/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "mcp-session-id: $SESSION_ID" \
  -d '{"jsonrpc":"2.0","method":"notifications/initialized"}'

3. Call a tool:

curl -s -X POST http://localhost:8332/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "mcp-session-id: $SESSION_ID" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"run_gitleaks","arguments":{"arguments":"--help"}}}'

4. Clean up:

docker stop gitleaks-mcp-test

⁠Running the tool directly (bypassing MCP)

You can run the gitleaks CLI in the same container by overriding the entrypoint to detect secrets in Git repos without starting the MCP server.

Scan repo (mount it):

docker run -i --rm --entrypoint gitleaks hackerdogs/gitleaks-mcp:latest detect -s /path/to/repo

Show help:

docker run -i --rm --entrypoint gitleaks hackerdogs/gitleaks-mcp:latest --help