Server data from the Official MCP Registry
Local secret & credential checks for AI-assisted dev — runs on your machine, results redacted.
About
Local secret & credential checks for AI-assisted dev — runs on your machine, results redacted.
Security Report
Netallion MCP Lite is a well-designed, security-conscious MCP server with strong credential detection capabilities and excellent operational security. The codebase demonstrates proper input validation, path confinement, sensitive file blocking, and comprehensive secret redaction. No authentication vulnerabilities, credential leaks, or dangerous code patterns were identified. Permissions align with the server's purpose of local secret scanning. Supply chain analysis found 5 known vulnerabilities in dependencies (0 critical, 5 high severity). Package verification found 1 issue.
7 files analyzed · 9 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
Permissions Required
This plugin requests these system permissions. Most are normal for its category.
How to Install
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-netallion-netallion-mcp-lite": {
"args": [
"netallion-mcp-lite"
],
"command": "uvx"
}
}
}Documentation
View on GitHubFrom the project's GitHub README.
Netallion MCP Lite
Free, local, IP-safe AI-development security — an MCP server from Netallion.
Netallion MCP Lite is a small Model Context Protocol server that helps you and your AI coding assistants avoid the most common mistake in AI-assisted development: leaking a credential. It flags a curated set of commodity, high-confidence secrets and credentials (AWS, GitHub, Stripe, OpenAI, private keys, database URIs, and more) in text and files.
It runs entirely on your machine. No account. No data sent to Netallion. Detected secrets are redacted before results are returned, so they are safe to hand back into an AI assistant's context.
Part of Netallion's Agentic Development Governance approach — secret detection is one capability, not the whole story.
What it is (and isn't)
| Netallion MCP Lite (this package) | Netallion AI Assurance (the platform) | |
|---|---|---|
| Price | Free | Commercial (free trial) |
| Runs | Locally, no account | SaaS + IDE + CI |
| Detection | ~27 commodity, high-confidence checks | Advanced detection well beyond commodity patterns |
| AI/MCP governance | — | AI provider governance, MCP governance |
| Policy & visibility | — | Central policy management, org-wide visibility |
| Compliance | — | Compliance and audit evidence |
| Data | Nothing leaves your machine | Enterprise controls |
MCP Lite is deliberately limited. It is a genuinely useful local utility and an on-ramp: if you want advanced detection, AI/MCP governance, central policy, and audit evidence across your organisation, that lives in Netallion AI Assurance.
This package does not contain or depend on Netallion's proprietary detection engine.
Install & run
Requires Python 3.10+.
pip install netallion-mcp-lite
# or, zero-install:
uvx netallion-mcp-lite
It speaks MCP over stdio. Add it to any MCP-compatible client (Claude, Cursor, Windsurf, VS Code, …):
{
"mcpServers": {
"netallion-mcp-lite": {
"command": "netallion-mcp-lite"
}
}
}
Optionally confine scan_file to a specific directory:
{
"mcpServers": {
"netallion-mcp-lite": {
"command": "netallion-mcp-lite",
"env": { "NETALLION_MCP_LITE_WORKSPACE_ROOT": "/path/to/your/project" }
}
}
}
Tools
| Tool | What it does |
|---|---|
scan_text | Scan a string for commodity secrets; returns redacted findings (rule, severity, line/column, remediation). |
scan_file | Scan a file inside the workspace root; sensitive files (.env, keys) are refused; findings redacted. |
list_supported_checks | List the commodity checks (no secrets). |
about | About the tool, privacy posture, and Lite vs AI Assurance. |
Run list_supported_checks to see the full set. Findings never include the full secret value.
Privacy
Local-only. No telemetry. No source, file contents, prompts, or secrets are sent anywhere. See PRIVACY.md.
Scope & limitations
- Commodity, high-confidence formats only — it will not catch obfuscated, encoded, or org-specific secrets. That is by design; advanced detection is part of Netallion AI Assurance.
scan_filereads only within a single workspace root and refuses obviously-sensitive files.- No generic high-entropy scanning (it produces noise without advanced technique).
We make no claims about detection rates, false-positive rates, customer adoption, certifications, or regulatory compliance for this free utility.
Links
- Netallion AI Assurance — https://www.netallion.ai
- VS Code / Cursor / Windsurf extension — VS Code Marketplace · Open VSX
- Azure Marketplace — Netallion AI Assurance
License
MIT — see LICENSE.
Reviews
No reviews yet
Be the first to review this server!
More Developer Tools MCP Servers
Git
Freeby Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
Fetch
Freeby Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
Toleno
Freeby Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
mcp-creator-python
Freeby mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
MCP Marketplace
Freeby mcp-marketplace · Developer Tools
Search and install MCP servers from inside your AI client.
MarkItDown
Freeby Microsoft · Content & Media
Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption