An official GitGuardian-maintained MCP server that brings secret scanning, incident management, and honeytokens into AI agents. It supports hosted HTTP, self-hosted Docker, and local stdio (PAT) deployments, with the tool set gated by token OAuth scopes and a read-only-leaning default. Before use, confirm the region URL and auth mode, and be aware of the hosted request path plus the operational risk of automated code-fix pull requests.
Strongest · Documentation 13/20 Weakest · Reliability 8/20
Static review · not runListed 2026-09-10
Read the FMRS scoring method →Runtime：Hosted (no local runtime) · Python · Docker
GITGUARDIAN_PERSONAL_ACCESS_TOKEN
GitGuardian Personal Access Token, created in the dashboard under API → Personal Access Tokens; used in stdio/CI mode.
GITGUARDIAN_URL
GitGuardian dashboard URL, defaults to https://dashboard.gitguardian.com (US SaaS); change for self-hosted.
GITGUARDIAN_CLIENT_ID
OAuth client ID for custom OAuth applications, defaults to ggshield_oauth.
GITGUARDIAN_SCOPES
Comma-separated OAuth scopes to request; auto-detected by default.
GITGUARDIAN_TOKEN_NAME
Display name for OAuth-issued PATs, defaults to MCP Token.
GITGUARDIAN_TOKEN_LIFETIME
PAT lifetime in days (or never), default 30.
IS_ON_PREM
Set true for self-hosted GitGuardian; unset means guess from hostname.
MCP_PORT
Port for HTTP transport; unset means stdio.
MCP_HOST
Bind address for HTTP transport, default 127.0.0.1.
MCP_BASE_URL
Public URL of this MCP server in OAuth proxy mode, default http://localhost:8000.
MCP_OAUTH_PROXY_ENABLED
When true, advertises OAuth Protected Resource metadata (RFC 9728) and proxies /authorize and /token to the dashboard.
ENABLE_LOCAL_OAUTH
Legacy stdio OAuth flow switch (deprecated), defaults to true.
The recommended way is the hosted server: point your MCP client at the URL matching your GitGuardian region; the client handles OAuth automatically. For Cursor, edit ~/.cursor/mcp.json: {"mcpServers":{"GitGuardian":{"type":"http","url":"https://mcp.gitguardian.com/mcp"}}}. Windsurf uses {"mcp":{"servers":{"GitGuardian":{"type":"http","url":"https://mcp.gitguardian.com/mcp"}}}}. For Claude.ai (web), add the server in Settings → Connectors → Add custom connector. Claude Desktop and Zed use the same type: http snippet. For local stdio (PAT) mode, use the command uvx --from git+https://github.com/GitGuardian/ggmcp.git gg-mcp-server with ENABLE_LOCAL_OAUTH=false, GITGUARDIAN_PERSONAL_ACCESS_TOKEN, and GITGUARDIAN_URL; on macOS, Claude Desktop needs the absolute path to uvx. To self-host, run the ghcr.io/gitguardian/mcp-server image behind a TLS-terminating reverse proxy; it exposes the StreamableHTTP transport on port 8000 by default.
{"mcpServers":{"GitGuardian":{"type":"http","url":"https://mcp.gitguardian.com/mcp"}}}
Shown for Cursor. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.
{
"servers": {
"GitGuardian": {
"type": "http",
"url": "https://mcp.gitguardian.com/mcp"
}
}
}
Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).
claude mcp add --transport http GitGuardian https://mcp.gitguardian.com/mcp
Run it in a terminal; replace any <…> placeholders with your own values first.
Connect the client to https://mcp.gitguardian.com/mcp and complete the OAuth flow; the tools secret_scanning, incident_management, honeytokens, and code_fix_automation should appear in the client's tool list, or ask it to scan the codebase for leaked secrets to prove the connection works.
Once connected, you can ask your AI assistant things like:
No matching tools
Listed from the project's documentation, not tested by this site.
GitGuardian MCP Server is maintained by GitGuardian and brings its secret detection and incident management into AI agents. Backed by GitGuardian's API and 500+ detectors, it scans files for leaked credentials before they are public, lists and manages security incidents (including internal and Public Monitoring incidents), generates and lists honeytokens, and opens pull requests that remediate secrets. The server defaults to read-only-leaning permissions, and the exact set of exposed tools depends on the OAuth scopes held by your access token. It can run as a hosted HTTP server (US: https://mcp.gitguardian.com/mcp, EU: https://mcp.eu1.gitguardian.com/mcp), a self-hosted Docker image, or locally over stdio with a PAT.
Upstash's official server providing up-to-date third-party library docs for AI coding assistants
AI-powered NPM package analysis MCP server
An independent control layer that gives AI coding agents budgets, brakes, and receipts
GitHub's official MCP server for managing repos, issues, PRs, and workflows via natural language
Source revision 7a75a34bc553 Data synced 2026-10-19 Read the FMRS scoring method