I’ve been building SecretLoop, and it’s now available in Preview on Open VSX.
The problem I was trying to solve is pretty simple.
You run a secret scanner and get:
“Found an API key.”
Cool. But then what?
Is it still active?
Was it already revoked?
Is it buried somewhere in Git history?
Do I need to rotate it?
And how do I actually remove it without manually hunting through the code?
SecretLoop is built around this flow:
Detect → Verify → Remediate
.env
The MCP part was particularly important to get right.
SecretLoop doesn't have an LLM inside it. The scanner produces deterministic findings; the AI assistant can explain and work with those findings.
Credential values are always redacted in MCP responses, and verification is opt-in and requires explicit human approval before a credential is sent to its provider.
You can try it without installing anything:
npx secretloop scan
Or scan Git history:
npx secretloop history
For CI:
npx secretloop scan --format sarif -o results.sarif
Open VSX:
GitHub:
It's still early/Preview, so I'm much more interested in feedback than downloads.
If you use gitleaks, TruffleHog, GitGuardian, GitHub Secret Scanning, etc., I'd especially love to know:
What happens after your scanner finds a secret?
That's the part I'm trying to improve.