Detects leaked secrets (API keys, tokens, private keys) in source code.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport — counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit d36bfbf · analyzer v33 · 3w ago
danger signals2
- committed secret GitHub token toro-guapo-trestle-d36bfbf/trestle-net/tests/validation.rs :18
ghp_aa…(40 chars, redacted) - committed secret Stripe live key toro-guapo-trestle-d36bfbf/trestle-net/tests/validation.rs :19
sk_liv…(32 chars, redacted)
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 133
filesystem 1
- fs toro-guapo-trestle-d36bfbf/editors/vscode/src/extension.ts :2
import { accessSync, chmodSync, constants, existsSync } from "fs";
shell / exec 1
- shell toro-guapo-trestle-d36bfbf/editors/vscode/src/extension.ts :1
import { spawnSync } from "child_process";
declared dependencies 86
- rmcp@1.6
- vscode-languageclient@^9.0.1
- @types/node@^25.6.0
- @types/vscode@^1.80.0
- @vscode/vsce@^3.9.1
- typescript@^6.0.3
- aho-corasick@1.1.4
- base64@0.22.1
- bip39@2.2.2
- blake3@1
- brush-parser@0.3.0
- chrono@0.4
show 28 more
- cms@0.2
- croner@3.0.1
- crossbeam-channel@0.5
- csv@1.4
- csscolorparser@0.8
- der@0.7
- dirs@6.0
- dockerfile-parser@0.9
- email_address@0.2
- fastrand@2
- form_urlencoded@1
- glob-match@0.2
- gix@0.81
- heck@0.5
- icu_locale_core@2.2
- icu_time@2.2
- in_definite@1.1
- ixdtf@0.6
- hcl-edit@0.9
- jsonc-parser@0.32.3
- mago-ast@0.22.2
- mago-interner@0.22.2
- mago-parser@0.22.2
- mago-source@0.22.2
- mago-span@0.22.2
- mime@0.3
- mimalloc@*
- notify@8
46 more not shown — this panel samples each group; the count above is the real total.