GitGuardian/ggmcp

Bring GitGuardian's secret detection and incident management into your AI agent.
Scan code for credentials before they leak, triage existing incidents, generate
honeytokens, and remediate findings — all from inside your IDE or chat client,
backed by GitGuardian's 500+ detectors.
> [!CAUTION]
> MCP servers are an emerging technology. Agents act on your behalf and under
> your responsibility. Use trusted MCP servers and review agent actions when
> they interact with tools. To limit blast radius the server defaults to
> read-only-leaning permissions; what is actually exposed is determined by
> the OAuth scopes your access token holds.
What it does
- **Secret scanning** — proactively scan files for leaked credentials.
- **Incident management** — list, filter, assign, resolve, and tag incidents
(both internal and Public Monitoring incidents).
- **Honeytokens** — generate honeytokens and list existing ones.
- **Code-fix automation** — open pull requests that remediate secrets in
repositories your workspace monitors.
The exact set of tools exposed to your agent depends on the OAuth scopes
granted to your access token.
Prompt examples
Quick start
The recommended way to run the GitGuardian MCP server is to point your MCP
client at the hosted server. The MCP client handles OAuth automatically; no
local install, no token to manage, no uvx.
Pick the URL that matches your GitGuardian region:
| Region | URL |
|-------------|-----------------------------------------------------------------|
| US SaaS | https://mcp.gitguardian.com/mcp |
| EU SaaS | https://mcp.eu1.gitguardian.com/mcp |
| Self-hosted | See Self-hosting the MCP server |
Cursor
Edit ~/.cursor/mcp.json:
Claude Desktop
Edit ~/Library/Application Support/Claude Desktop/mcp.json (macOS) or
%APPDATA%\Claude Desktop\mcp.json (Windows). Same JSON as Cursor. Claude
Desktop versions that pre-date HTTP MCP support need the
Local stdio fallback.
Claude.ai (web)
Add the server in **Settings → Connectors → Add custom connector** with the
URL above. OAuth is handled in the browser tab.
Windsurf
Edit ~/Library/Application Support/Windsurf/mcp.json (or
~/.config/Windsurf/mcp.json on Linux):
Zed
Edit ~/Library/Application Support/Zed/mcp.json (or
~/.config/Zed/mcp.json on Linux) with the same type: http snippet.
Choosing a deployment
Two deployment paths are supported. Pick based on where your GitGuardian
instance lives and what tradeoffs you accept.
| Deployment | When to use |
|------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------|
| **Hosted MCP** (Quick start above) | GitGuardian SaaS (US/EU) and you accept that requests transit mcp.gitguardian.com in addition to api.gitguardian.com |
| **Self-hosted MCP** (§) | Self-hosted GitGuardian, airgapped environments, or you want the MCP server on your own infrastructure |
| **Local stdio with PAT** (§) | CI/CD, scripts, one-off invocations, or older MCP clients without type: http support |
Authentication
> Most users do not need to touch this — the Quick start
> config implicitly uses the **OAuth proxy** mode on the hosted server, and the
Local stdio config uses **PAT env**.
There are four authentication modes the server can run in; you pick one via
env vars.
| Mode | Configuration | Used by |
|----------------------------------------|------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------|