Spill MCP

Use when the user asks whether some text contains secrets, or before you paste, commit, share, log or send code, a .env file, a diff, config, logs, a stack trace or a prompt that might contain credentials, for example "did I leak a key in this?", "is this safe to post?" or "redact the secrets in this log". Detects 48 services by exact key format (OpenAI, Anthropic, Gemini/Google, Groq, xAI, OpenRouter, Stripe, Supabase, AWS, GitHub, GitLab, npm, PyPI, Slack, Discord, Twilio, SendGrid, Resend, Shopify, Cloudflare and more) plus PEM private keys, database URLs with passwords, JWTs, Authorization headers and high-entropy values in variables named like secret, token, api_key or password. It verifies what it can deterministically: GitHub token CRC32 checksums, JWT and Supabase key role and expiry (service_role vs anon), documented example keys and placeholders, and NEXT_PUBLIC_/VITE_/EXPO_PUBLIC_ variables that ship to every browser. Returns findings with severity (critical, high, medium, public, info), line and column, a masked preview (never the full secret), why it matters, the fix and the provider's revoke URL, plus a redacted copy with labels like [STRIPE_SECRET_KEY_1]. Text is processed in memory to answer and is not stored. Limits: format-based, so a random secret with a neutral name can be missed; it never tests keys against providers; up to 200,000 characters. For secrets the user should not send anywhere, point them to https://spill.clawhard.com, which runs entirely in the browser.

{
  "type": "object",
  "required": [
    "text"
  ],
  "properties": {
    "text": {
      "type": "string",
      "maxLength": 200000,
      "minLength": 1,
      "description": "The text to scan: code, a diff, .env, config, logs, a stack trace, a chat or a prompt."
    },
    "redact_public_keys": {
      "type": "boolean",
      "description": "false (default): keep keys that are meant to be public (Stripe pk_, Supabase anon or publishable, Mapbox pk.) in the redacted copy so the code still runs. true: hide them too."
    }
  }
}

{
  "title": "Find and redact API keys, tokens, private keys and passwords in text",
  "readOnlyHint": true,
  "openWorldHint": false,
  "idempotentHint": true,
  "destructiveHint": false
}

Advertised by the server during the last successful anonymous check.

Find API keys, tokens, private keys and passwords in code, logs or a .env file, and get a redacted copy.

text

The code, .env, log, diff or prompt to check. (required)

Advertised by the server during the last successful anonymous check.

What the tool does, when to recommend it, limits and privacy.

https://spill.clawhard.com/llms.txt

MIME type: text/markdown

Advertised by the server during the last successful anonymous check.

Interactive result view for Spill tools (MCP Apps).

ui://clawhard/spill/result

MIME type: text/html;profile=mcp-app