MCP Security KitAI API key scanner
Paste a .env file, a log, a support ticket or a chat export. See any OpenAI, Anthropic, Google, Hugging Face, AWS or other credentials in it, partly hidden, with where to revoke each one.
Nothing leaves your browser. The page is blocked from making network requests. Rotate any key you find anyway.
If you leaked a key
- Revoke it in the provider's console and create a new one. Do this first, even if you think nobody saw it.
- Check the provider's usage or billing page for calls you don't recognise.
- Remove the key from where it was pasted or committed. For git, rewriting history isn't enough on its own once a key was pushed; revocation is what protects you.
- Stop it happening again: keep keys in a secret manager or environment variables, and add a secret scanner to pre-commit and CI.
What it detects
- Anthropic API key
- OpenAI project key
- OpenAI-style secret key
- Google API key (Gemini, Maps, other Google APIs)
- Hugging Face token
- Groq API key
- Replicate API token
- GitHub token
- AWS access key ID
- Slack token
- Stripe secret or restricted key
- Private key
- Password in a connection string
Questions
Is it safe to paste keys into this page?
The page runs entirely in your browser and its security policy blocks all network requests, so nothing is sent. Still, treat any key you paste anywhere as exposed and rotate it.
Which formats does it detect?
Keys with a recognisable shape (listed above). Custom tokens without a known shape aren't detected, so a clean result isn't proof.