# I built a secret scanner that tries to answer “is this secret actually live?" > Source: > Published: 2026-09-08 19:14:51+00:00 I’ve been building **SecretLoop**, and it’s now available in Preview on Open VSX. The problem I was trying to solve is pretty simple. You run a secret scanner and get: “Found an API key.” Cool. But then what? Is it still active? Was it already revoked? Is it buried somewhere in Git history? Do I need to rotate it? And how do I actually remove it without manually hunting through the code? SecretLoop is built around this flow: **Detect → Verify → Remediate** `.env` The MCP part was particularly important to get right. SecretLoop doesn't have an LLM inside it. The scanner produces deterministic findings; the AI assistant can explain and work with those findings. Credential values are always redacted in MCP responses, and **verification is opt-in and requires explicit human approval before a credential is sent to its provider**. You can try it without installing anything: ``` npx secretloop scan ``` Or scan Git history: ``` npx secretloop history ``` For CI: ``` npx secretloop scan --format sarif -o results.sarif ``` Open VSX: GitHub: It's still early/Preview, so I'm much more interested in **feedback than downloads**. If you use gitleaks, TruffleHog, GitGuardian, GitHub Secret Scanning, etc., I'd especially love to know: **What happens after your scanner finds a secret?** That's the part I'm trying to improve.