Do you store what I send?

No. The text is scanned in memory and the response carries masked values only. Nothing is logged except the call's price and outcome.

Which secrets are detected?

AWS, GitHub, GitLab, OpenAI, Anthropic, Google (API key, OAuth token, client secret), Stripe, Slack tokens and webhooks, Discord, Telegram, SendGrid, Mailgun, Twilio, npm, PyPI, Hugging Face, DigitalOcean, Shopify, Supabase, Azure storage, Vercel, Cloudflare, JWTs, PEM private keys, EVM private keys, 12/24-word seed phrases, database and basic-auth URLs, Authorization headers and generic high-entropy assignments.

How does this compare with GitHub secret scanning or gitleaks?

Those run on repositories. This runs on any string an agent holds, at call time, from any language, for $0.002, with no install.

Catch the API key before your agent pastes it somewhere.

Agents read .env files, logs, diffs and tool output, then write summaries, commits and messages. The secrets leak detector scans any text (or a public URL) for credentials from 25+ vendors plus private keys, seed phrases, JWTs and connection strings, returns each one masked with its line number, and can hand back a redacted copy to pass on safely.

What you get back

found, count and the highest severity (high: usable secret; medium: likely; low: public identifiers such as Stripe pk_ keys)
findings[]: type (aws-access-key-id, github-token, openai-api-key, anthropic-api-key, stripe-secret-key, slack-webhook, private-key, bip39-seed-phrase, database-url…), provider, confidence, masked value, line and column
byProvider counts for a quick picture
redacted: the same text with every secret replaced by [REDACTED:type] (optional)
Generic key = … and password = … assignments only when the value has real entropy, so placeholders are skipped

Call it over HTTP

No account and no API key. The first response is 402 Payment Required with the price; an x402-capable client pays in USDC on Base and retries. You're only charged when the call succeeds.

curl -i -X POST https://api.exepal.com/v1/scan/secrets \
  -H "content-type: application/json" \
  -d '{"text":"AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY","redact":true}'
# → 402 Payment Required (price, network: base, pay-to address)
# An x402 client pays in USDC and retries → 200 with the JSON answer

Use it from Claude, Cursor or any MCP client

Add https://api.exepal.com/mcp as a remote MCP server. The tool is scan_secrets, at the same price.

{
  "mcpServers": {
    "exepal": { "type": "http", "url": "https://api.exepal.com/mcp" }
  }
}

Questions

Do you store what I send?: No. The text is scanned in memory and the response carries masked values only. Nothing is logged except the call's price and outcome.
Which secrets are detected?: AWS, GitHub, GitLab, OpenAI, Anthropic, Google (API key, OAuth token, client secret), Stripe, Slack tokens and webhooks, Discord, Telegram, SendGrid, Mailgun, Twilio, npm, PyPI, Hugging Face, DigitalOcean, Shopify, Supabase, Azure storage, Vercel, Cloudflare, JWTs, PEM private keys, EVM private keys, 12/24-word seed phrases, database and basic-auth URLs, Authorization headers and generic high-entropy assignments.
How does this compare with GitHub secret scanning or gitleaks?: Those run on repositories. This runs on any string an agent holds, at call time, from any language, for $0.002, with no install.