MCP server for ClassiFinder — secret scanning tools for AI agents
SaferSkills independently audited classifinder-mcp (MCP Server) and scored it 91/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP server that gives AI agents the ability to scan text for leaked secrets and redact them before they reach an LLM.
pip install classifinder-mcpGet a free API key at classifinder.ai, then add to your agent config:
{
"mcpServers": {
"classifinder": {
"command": "classifinder-mcp",
"env": {
"CLASSIFINDER_API_KEY": "ss_live_your_key_here"
}
}
}
}Add to .cursor/mcp.json in your project:
{
"mcpServers": {
"classifinder": {
"command": "classifinder-mcp",
"env": {
"CLASSIFINDER_API_KEY": "ss_live_your_key_here"
}
}
}
}classifinder_scanScan text for leaked secrets and credentials. Returns findings with type, severity, confidence, and remediation guidance.
Agent: "Check this config for secrets"
→ classifinder_scan(text="AWS_ACCESS_KEY_ID=AKIAJGKJHSKLDJFH3284")
→ Found 1 secret: aws_access_key (critical, confidence 0.95)classifinder_redactReplace all detected secrets with safe placeholders. Returns clean text safe to forward to any LLM.
Agent: "Clean this before sending to the model"
→ classifinder_redact(text="key=sk_live_EXAMPLE_KEY_HERE")
→ "key=[STRIPE_LIVE_SECRET_KEY_REDACTED]"179 detection patterns:
<|im_start|> and [INST], tool-call tag injection, known jailbreak personas like DAN/AIM, Unicode bidirectional override / Trojan Source) + 6 phase-2 medium-precision (zero-width Unicode smuggling, fake "Assistant:" turns, system-prompt extraction, instruction override like "ignore previous instructions", persona override (context-gated), encoded-payload markers) + 4 phase-3 SAFE-MCP-derived markers cross-referenced to the SAFE-MCP technique catalog. Catches 20.6% of in-the-wild jailbreaks (validated against the verazuo/jailbreak_llms corpus). Severity caps at high — these are attack markers, not credentials.One scan returns both secret findings and injection markers — no second vendor, no separate pipeline.
The MCP server is intentionally minimal: ~180 lines, two read-only tools, a single egress destination (api.classifinder.ai:443), and the API key as the only secret in scope. That makes it cheap to run under a sandbox. Three documented profiles:
docker run --rm -i \
--read-only \
--tmpfs /tmp \
-v ~/.classifinder:/root/.classifinder \
-e CLASSIFINDER_API_KEY \
python:3.12-slim sh -c "pip install -q classifinder-mcp && classifinder-mcp"--read-only — container filesystem is read-only--tmpfs /tmp — writable scratch space for pip / Python-v ~/.classifinder:/root/.classifinder — only persistent mount, used for the audit log-e CLASSIFINDER_API_KEY — key passed via env, never written to disk-i — keeps stdin attached (MCP transport is stdio)For a faster invocation in production, build a thin image with classifinder-mcp pre-installed.
firejail \
--noroot \
--caps.drop=all \
--seccomp \
--private-tmp \
--whitelist=~/.classifinder \
--read-only=~ \
--read-write=~/.classifinder \
classifinder-mcp~/.classifinder/ writableapi.classifinder.ai) — pair with host-level egress filtering (ufw, iptables, or nftables) if you want network restrictionbwrap \
--ro-bind / / \
--bind ~/.classifinder ~/.classifinder \
--proc /proc --dev /dev --tmpfs /tmp \
--unshare-pid --unshare-uts --new-session --die-with-parent \
--setenv CLASSIFINDER_API_KEY "$CLASSIFINDER_API_KEY" \
classifinder-mcp/; writable bind only for ~/.classifinder/--die-with-parent ensures the sandbox tears down if the host process exitsThese profiles are documented starting points. None are exercised in this repo's CI — they're correctness-by-construction (read-only bind mounts, dropped caps, single-purpose tmpfs) rather than test-validated. If you run a sandbox in production and want me to roll a verified profile into a future release, open an issue with the exact invocation you're using.
The MCP server appends one JSONL line per tool call to a local audit file. Metadata only — the audit log never contains your input text or any detected secret values.
Default path: ~/.classifinder/mcp-audit.log
Fields per line:
{
"timestamp": "2026-05-22T15:30:42.123456Z",
"tool": "classifinder_scan",
"input_byte_count": 142,
"finding_count": 1,
"latency_ms": 87.4
}Configuration (env vars):
| Variable | Default | Purpose |
|---|---|---|
CLASSIFINDER_MCP_AUDIT | 1 (on) | Set to 0 to disable logging entirely |
CLASSIFINDER_MCP_AUDIT_PATH | ~/.classifinder/mcp-audit.log | Override the log path |
The audit log is observability for your own use — useful for compliance (proving the MCP server ran), debugging (correlating latency spikes), and forensic review (which tool ran when). Write failures are silent; the tool call always succeeds even if the audit cannot be written.
Every published release is signed twice:
pip when installing from PyPI; you don't need to do anything.*.sigstore.json next to the sdist + wheel). Verify with sigstore-python:pip install sigstore
gh release download v0.1.4 --repo ClassiFinder/classifinder-mcp \
--pattern '*.whl' --pattern '*.sigstore.json'
sigstore verify identity \
--bundle classifinder_mcp-0.1.4-py3-none-any.whl.sigstore.json \
--cert-identity 'https://github.com/ClassiFinder/classifinder-mcp/.github/workflows/release.yml@refs/tags/v0.1.4' \
--cert-oidc-issuer 'https://token.actions.githubusercontent.com' \
classifinder_mcp-0.1.4-py3-none-any.whlThe signing identity binds the artifact to this repo's release.yml workflow at a specific tag — an attacker can't forge a valid bundle without compromising GitHub's OIDC token issuance.
For CLI scanning instead of MCP, see cfsniff — a command-line tool that scans files, shell history, and configs for secrets (pipx install cfsniff).
ClassiFinder is a detection aid, not a guarantee. No scanner catches 100% of secrets in 100% of formats. See our Terms of Service for full details.
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.