Scans your agent workspace for leaked secrets — API keys, tokens, passwords, private keys, and credentials that should never be in plain text.
Agent workspaces accumulate secrets: API keys in config files, tokens in memory logs, passwords in environment files. A single leaked credential can compromise your entire infrastructure. Existing secret scanners work on git repos — nothing watches the agent workspace itself.
Scan all workspace files for secrets and high-risk files.
python3 {baseDir}/scripts/sentry.py scan --workspace /path/to/workspace
Check a specific file for secrets.
python3 {baseDir}/scripts/sentry.py check MEMORY.md --workspace /path/to/workspace
One-line summary of secret exposure risk.
python3 {baseDir}/scripts/sentry.py status --workspace /path/to/workspace
| Provider | Patterns |
|---|---|
| ---------- | ---------- |
| AWS | Access keys (AKIA...), secret keys |
| GitHub | PATs (ghp_, gho_, ghs_, ghr_, github_pat_) |
| Slack | Bot/user tokens (xox...), webhooks |
| Stripe | Secret keys (sk_live_), publishable keys |
| OpenAI | API keys (sk-...) |
| Anthropic | API keys (sk-ant-...) |
| API keys (AIza...), OAuth secrets | |
| Azure | Storage account keys |
| Generic | API keys, secrets, passwords, bearer tokens, connection strings |
| Crypto | PEM private keys, .key/.pem/.p12 files |
| Database | PostgreSQL/MySQL/MongoDB/Redis URLs with credentials |
| JWT | JSON Web Tokens |
| Environment | .env files with variables |
0 — Clean, no secrets found1 — Warnings (high-risk files detected)2 — Critical secrets foundPython standard library only. No pip install. No network calls. Everything runs locally.
Works with OpenClaw, Claude Code, Cursor, and any tool using the Agent Skills specification.
共 1 个版本