I built a secret scanner that tries to answer “is this secret actually live?"

A developer has built SecretLoop, a secret scanner now in Preview on Open VSX that goes beyond detection to verify whether exposed credentials are still live and guide remediation. The tool integrates with MCP for AI-assisted workflows, redacts credential values, and requires explicit human approval before any verification request is sent to a provider.

I’ve been building SecretLoop , and it’s now available in Preview on Open VSX. The problem I was trying to solve is pretty simple. You run a secret scanner and get: “Found an API key.” Cool. But then what? Is it still active? Was it already revoked? Is it buried somewhere in Git history? Do I need to rotate it? And how do I actually remove it without manually hunting through the code? SecretLoop is built around this flow: Detect → Verify → Remediate .env The MCP part was particularly important to get right. SecretLoop doesn't have an LLM inside it. The scanner produces deterministic findings; the AI assistant can explain and work with those findings. Credential values are always redacted in MCP responses, and verification is opt-in and requires explicit human approval before a credential is sent to its provider . You can try it without installing anything: npx secretloop scan Or scan Git history: npx secretloop history For CI: npx secretloop scan --format sarif -o results.sarif Open VSX: GitHub: It's still early/Preview, so I'm much more interested in feedback than downloads . If you use gitleaks, TruffleHog, GitGuardian, GitHub Secret Scanning, etc., I'd especially love to know: What happens after your scanner finds a secret? That's the part I'm trying to improve.