codesecurity / repo scanner

Repo Scanner

repo_scanner

Scans local source files for leaked secrets (API keys, tokens, passwords, private keys), PII (emails, SSNs, credit cards), and missing .gitignore protections. Works on any language — scans file content, not package metadata. Use when: user asks about hardcoded credentials, leaked tokens, .env exposure, or PII in source files. Scope: local directory — no network access, no GitHub API. Not for: package vulnerabilities (use dependency_audit), code quality issues (use python_lint_checker), or GitHub code scanning findings from a remote repo (use code_scanning_alerts).

How to use repo_scanner

Provide only the required inputs below. Start with the smallest scope that answers the task, then review the risk properties before an agent executes the call.

Risk and execution properties

Read only: yes

Destructive: no

Idempotent: yes

Open world: no — operates locally or through configured services

Inputs

pathstringrequired

Absolute or relative path to the directory to scan. Example: '/Users/me/my-project'

checksstring

Comma-separated checks to run: secrets, gitignore, pii. Default: 'all'. Example: 'secrets,gitignore'

Default: "all"

Example input

{
  "path": "<string>",
  "checks": "all"
}

Browse or search the full 74-tool reference to choose the smallest suitable capability.

Browse all tools →