Discover tools that detect leaked secrets, API keys, and credentials in your codebase before they cause security incidents.
Secret Detection tools are AI-powered software designed to help developers and teams tackle secret detection-related tasks more efficiently. These tools are typically published as open-source projects on GitHub and can be integrated into existing workflows via MCP (Model Context Protocol), Claude Skills, or standalone agent frameworks. On Agent Skills Hub, we index 10 quality-scored secret detection tools across languages including Rust, Python, JavaScript.
In 2026, the AI agent ecosystem is maturing rapidly. Secret Detection tools can significantly boost development efficiency by automating repetitive tasks, reducing human error, and providing intelligent suggestions. The top 3 tools — kru, key-amnesia, vahta — have earned an average of 296 GitHub stars, reflecting strong community validation. 9 of the listed tools come with clear open-source licenses, ensuring freedom to use and modify.
When choosing a secret detection tool, consider these factors: 1) Community activity — GitHub stars and recent commit frequency indicate reliability; 2) Integration method — check if it supports MCP, Claude, or your preferred agent framework; 3) Language compatibility — the most common language in this list is Rust; 4) Quality score — Agent Skills Hub's composite score evaluates code quality, documentation completeness, and maintenance activity. Our recommendation: start with kru — it ranks highest in both star count and quality score.
Local-first MCP password and credential manager for AI agents. Use passwords, API keys, SSH identities, and TOTP without exposing hidden plaintext to the model.
Let your AI agent use your passwords and API keys - without ever letting it see them
Let your AI agent use your passwords and API keys - without ever letting it see them
AI-first security scanner. NEW in v2026.7: Claude Code compromise detection — vet .claude/ hooks, permissions & skills before you clone — plus an always-on AI attack-signature scanner and native Rust & PHP rules. Also: medusa scan --git to vet any repo, medusa secrets scan for leaked API keys. 40,000+ patterns, zero setup.
Lightweight, stateless privacy gateway for LLM APIs — redact secrets before OpenAI/Anthropic upstreams and restore them transparently in SSE and tool calls.
Credential gateway for AI agents. Log in once via Oauth2 or API Key. Every agent stays authenticated — headless, no SaaS, agents never see your credentials.
Your local AI session library. Browse, pin, and ⌘K-search every Claude Code, Codex, Gemini & OpenCode session — and let the built-in scanner catch leaked secrets. Local-first, nothing leaves your machine.
```bash
curl -fsSL https://spool.pro/install.sh | bash
```Self-hosted runtime control plane for AI agents. Observe or HITL approve or Block rogue tool calls before it executes: secret leaks, prompt injection, supply chain etc in a local dashboard. Agent agnostic (Claude, codex, langchain etc.)
The local firewall for AI agents — keep your secrets off the model, the API relay, and the supply chain. Local credential masking, per-route model routing, and security detectors on the wire. Free & fully open source.
Runtime Security for tool-using AI agents, with local policies, pre-action enforcement, and forensic audit trails.
| Tool | Stars | Language | License | Score |
|---|---|---|---|---|
| kru | ★ 126 | Rust | MIT | 70 |
| key-amnesia | ★ 71 | Python | Apache-2.0 | 71 |
| vahta | ★ 71 | Python | Apache-2.0 | 64 |
| medusa | ★ 962 | Python | AGPL-3.0 | 75 |
| CosyRedactGateway | ★ 83 | JavaScript | Apache-2.0 | 71 |
| authsome | ★ 92 | Python | MIT | 62 |
| spool | ★ 591 | TypeScript | — | 66 |
| prismor | ★ 398 | Python | Apache-2.0 | 66 |
| agentfw | ★ 360 | TypeScript | MIT | 62 |
| kontext-cli | ★ 210 | Go | MIT | 68 |
The top secret detection tools in 2026 are kru, key-amnesia, vahta. Agent Skills Hub ranks 10 options by GitHub stars, quality score (6 dimensions including completeness, examples, and agent readiness), and recent activity. The list is rebuilt every 8 hours from live GitHub data.
kru (126 stars) is the most adopted choice for general secret detection workflows, written in Rust. key-amnesia (71 stars) is a strong alternative and uses Python instead. Pick by your existing stack: match the language and runtime your team already uses to minimize integration cost. If unsure, start with kru — it has the deepest community and the most examples online.
Avoid pre-built secret detection tools when (1) your use case requires deep customization that the tool's plugin system doesn't support, (2) you have strict compliance requirements that ban third-party dependencies, (3) the tool's maintenance is inactive (last commit >6 months ago), or (4) your data volume is small enough that a 50-line custom script is cheaper than learning the tool. For most production workflows above 100 requests/day, the time savings from a maintained tool outweigh the customization loss.
Secret Detection focuses specifically on discover tools that detect leaked secrets, api keys, and credentials in your codebase before they cause security incidents. Security Auditing is a related but distinct category — see https://agentskillshub.top/best/security-audit/ for those tools. The two often appear in the same agent pipeline but solve different problems: choose secret detection when your primary goal is the specific task, and security auditing when the workflow is broader.
For most teams, yes. kru has 126 stars worth of community testing, handles edge cases you haven't thought of, and ships with documentation. Build your own only when (1) your requirements are deeply non-standard, (2) you have a security/compliance reason to avoid OSS dependencies, or (3) the maintenance burden is small enough (<200 lines of code) that you'll save time long-term. The break-even point is usually around 2-3 weeks of dev time saved.
Most secret detection tools listed are open source under permissive licenses (MIT, Apache 2.0). A handful offer paid managed/cloud versions on top of free self-hosted core. Always check the LICENSE file on each tool's GitHub repository before commercial use — some use AGPL or non-commercial restrictions that may not fit your deployment model.
Grades come from a rule-based scan built on the SlowMist agent-security taxonomy, covering 11 red-flag categories including credential harvesting, data exfiltration, and curl | sh installers. It is a first-layer scan, not a manual audit — we say so rather than overstate it.
The scale of the problem is documented independently: Liu et al. (2026), in a study of 31,132 agent skills, report that 26.1% contain security vulnerabilities. Our own full-catalog census is published as a citable open dataset.
Sources & who's responsible: