GitGuardian MCP Server

Name: GitGuardian MCP Server
Author: GitGuardian

Secret scanning, incident triage, honeytokens and fixes from a GitGuardian workspace

Official · GitGuardian Python Remote (hosted) · Streamable HTTP Local · stdio Security DevOps and monitoring

GitHub Website

40 popularity score ★ 41

Connect your client

Remote (hosted)

Add in one click

Add to Cursor Add to VS Code Add to LM Studio Add to Goose

Opens the app, which asks before it adds the server.

Or add it by command or config

Claude CodeTerminal

claude mcp add --transport http gitguardian https://mcp.gitguardian.com/mcp

Claude (desktop and web)Settings → Connectors → Add custom connector

https://mcp.gitguardian.com/mcp

ChatGPTSettings → Apps → Advanced → Developer mode, then Create app

https://mcp.gitguardian.com/mcp

Cursor~/.cursor/mcp.json

{
  "mcpServers": {
    "gitguardian": {
      "url": "https://mcp.gitguardian.com/mcp"
    }
  }
}

VS Code.vscode/mcp.json

{
  "servers": {
    "gitguardian": {
      "type": "http",
      "url": "https://mcp.gitguardian.com/mcp"
    }
  }
}

Codex~/.codex/config.toml

[mcp_servers.gitguardian]
url = "https://mcp.gitguardian.com/mcp"

Gemini CLITerminal

gemini mcp add --scope user --transport http gitguardian https://mcp.gitguardian.com/mcp

Local (from source)

Add in one click

Add to Cursor Add to VS Code Add to LM Studio Add to Goose

Opens the app, which asks before it adds the server.

Or add it by command or config

Claude CodeTerminal

claude mcp add gitguardian -- uvx --from git+https://github.com/GitGuardian/ggmcp.git gg-mcp-server

Claude Desktopclaude_desktop_config.json

{
  "mcpServers": {
    "gitguardian": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/GitGuardian/ggmcp.git",
        "gg-mcp-server"
      ]
    }
  }
}

Cursor~/.cursor/mcp.json

{
  "mcpServers": {
    "gitguardian": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/GitGuardian/ggmcp.git",
        "gg-mcp-server"
      ]
    }
  }
}

VS Code.vscode/mcp.json

{
  "servers": {
    "gitguardian": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/GitGuardian/ggmcp.git",
        "gg-mcp-server"
      ]
    }
  }
}

Codex~/.codex/config.toml

[mcp_servers.gitguardian]
command = "uvx"
args = ["--from", "git+https://github.com/GitGuardian/ggmcp.git", "gg-mcp-server"]

Gemini CLITerminal

gemini mcp add --scope user gitguardian uvx -- --from git+https://github.com/GitGuardian/ggmcp.git gg-mcp-server

Settings 9

`GITGUARDIAN_PERSONAL_ACCESS_TOKEN`	Optional: Personal access token for local stdio use; its scopes decide which tools appear.
`ENABLE_LOCAL_OAUTH`	Optional: Set to false to use a token instead of the deprecated browser sign-in in stdio mode.
`GITGUARDIAN_URL`	Optional: GitGuardian dashboard URL; defaults to https://dashboard.gitguardian.com (US SaaS).
`IS_ON_PREM`	Optional: true for a self-hosted GitGuardian instance.
`GITGUARDIAN_SCOPES`	Optional: Comma-separated OAuth scopes to request.
`GITGUARDIAN_TOKEN_LIFETIME`	Optional: Lifetime in days of OAuth-issued tokens, or never; default 30.
`MCP_PORT`	Optional: Port for HTTP transport; unset means stdio.
`MCP_BASE_URL`	Optional: Public URL of a self-hosted server in OAuth proxy mode.
`MCP_OAUTH_PROXY_ENABLED`	Optional: Makes a self-hosted server proxy OAuth to the GitGuardian dashboard.

What it does

GitGuardian's MCP server connects an assistant to a GitGuardian workspace. Through it the assistant can send file contents to GitGuardian's detection API to check for leaked credentials, read and filter the secret incidents GitGuardian has already raised, and act on them: assign, resolve, ignore or reopen an incident, change its severity, add tags and comments, or revoke a secret.

It covers two kinds of incidents kept apart by separate tools: internal ones found in the repositories and other sources a workspace has connected, and Public Monitoring ones found on public GitHub, gists and Docker Hub. It can also create AWS honeytokens and list existing ones, and ask GitGuardian to open pull requests that remove secrets from monitored repositories.

The makers recommend the hosted endpoint, where the MCP client signs in with OAuth and nothing is installed (US and EU regions have separate URLs). It can also run locally over stdio with a personal access token, or be self-hosted from a Docker image for self-hosted GitGuardian. Which tools appear depends on the scopes held by the token in use.

What it needs

To run it yourself	Python

A GitGuardian account (US or EU SaaS, or a self-hosted GitGuardian instance). The hosted endpoint needs an MCP client that supports HTTP transport and OAuth. Local stdio use needs uv (uvx) and a GitGuardian personal access token; self-hosting needs Docker and a reverse proxy terminating TLS.

Limits

Tools shown depend on the scopes of the access token. Many tools work only on internal incidents or only on Public Monitoring incidents, and the IDs are not interchangeable. Honeytokens it generates are AWS type only. Browser-based OAuth in stdio mode is deprecated and will be removed; the old developer-mcp-server and secops-mcp-server commands are deprecated too. With the hosted server, requests pass through mcp.gitguardian.com as well as the GitGuardian API.

Who it suits

Suits teams already on GitGuardian who want an assistant to check code for secrets before committing and to work through their incident queue; it is official and the hosted endpoint needs no install. It is of no use without a GitGuardian account. Because it can resolve incidents and revoke secrets, those wanting read-only use should grant a token with read scopes only. Self-hosted or airgapped setups should use the Docker image or local stdio with a token.

Tools 36

scan_secrets: Sends one or more files or text snippets to GitGuardian to detect secrets and policy breaks
list_detectors: Lists the secret detectors available
list_incidents: Lists internal secret incidents with filters for status, severity, source and more
count_incidents: Counts internal incidents matching filters without fetching them
get_incident: Fetches one internal incident's details
list_repo_occurrences: Lists where secrets were found in an internal repository or incident, down to file and line
list_remediation_targets: Lists secret occurrences to fix in a repository's default branch, newest first
get_remediation_workflow: Returns remediation instructions for incidents
find_current_source_id: Finds the GitGuardian source ID for the current repository from its remote URL
list_sources: Lists the sources connected to the workspace
list_public_incidents: Lists Public Monitoring incidents found on public GitHub, gists and Docker Hub
get_public_incident: Fetches one Public Monitoring incident
list_public_occurrences: Lists occurrences of one Public Monitoring incident
list_incident_members: Lists members with access to an incident
list_incident_teams: Lists teams with access to an incident
list_incident_comments: Lists comments on an internal incident
list_public_incident_comments: Lists comments on a Public Monitoring incident
list_incident_activity_logs: Shows the activity history of an internal incident
list_public_incident_activity_logs: Shows the activity history of a Public Monitoring incident
manage_private_incident: Assigns, unassigns, resolves, ignores or reopens an internal incident
assign_incident: Assigns an internal incident to a member or to yourself
update_incident_severity: Changes an internal incident's severity
update_or_create_incident_custom_tags: Sets custom tags on an internal incident
manage_incident_comment: Adds or edits a comment on an internal incident
assign_public_incident: Assigns a Public Monitoring incident to a member
update_public_incident_status: Resolves, ignores or reopens a Public Monitoring incident
manage_public_incident_comment: Adds or edits a comment on a Public Monitoring incident
create_code_fix_request: Asks GitGuardian to open pull requests removing secrets for chosen incidents
revoke_secret: Revokes a secret through the GitGuardian API
generate_honeytoken: Creates an AWS honeytoken and suggests where to plant it
list_honeytokens: Lists honeytokens with filters
read_custom_tags: Reads the workspace's custom tags
write_custom_tags: Creates or deletes workspace custom tags
list_users: Lists users in the workspace
get_member: Fetches one workspace member
get_current_token_info: Shows the scopes, owner and expiry of the token in use

Popularity

40 popularity score, on our list (the bar is 36)

★ 41

GitHub stars	41	19.5 points
Official server	Yes	8 points
Hosted by its vendor	Yes	12.5 points

Measured 2026-11-07. How the score works.

Where it is published

Code	gitguardian/ggmcp ★ 41
Container	ghcr.io/gitguardian/mcp-server
PyPI	ggmcp
Hosted	`https://mcp.gitguardian.com/mcp` Streamable HTTP · OAuth sign-in

What it can reach

Runs	On your machine, or on the maker's servers
Reaches	The internet, Your account at a service, Your code
Changes things	Yes: it can write, send, create or delete
Sign-in	OAuth sign-in
Licence	MIT (GitHub)
Latest version	0.7.4 GitHub release, 2026-10-23
Last code change	2026-10-22

Reaches the user's GitGuardian workspace through its API. Write tools can resolve, ignore, reassign, tag and comment on incidents, revoke secrets, create honeytokens and request pull requests on monitored repositories. The hosted endpoint runs on GitGuardian's servers and signs in with OAuth; requests pass through mcp.gitguardian.com. Local stdio and self-hosted modes run on your machine or infrastructure with a personal access token. scan_secrets sends the file contents it is given to GitGuardian's API. Tools are hidden when the token lacks their scope, so a read-only token limits it to reading.

Over time

GitHub stars 41 +3 (+8 %)

4138

14 Oct 20267 Nov 2026

Popularity score 40 +0

4040

14 Oct 20267 Nov 2026

What is rising across the directory

Sources

Page checked 2026-10-14.

Badge for your README

Shows this server's rank in its category, and stars for a server that runs on your machine. It updates every hour.

MarkdownREADME.md

[![GitGuardian MCP Server on EveryMCPServer](https://everymcpserver.com/badge/gitguardian-mcp-server.svg)](https://everymcpserver.com/servers/gitguardian-mcp-server)

Connect your client

Add in one click

Or add it by command or config

Add in one click

Or add it by command or config

Settings 9

What it does

What it needs

Limits

Who it suits

Tools 36

Similar servers

GitHub MCP Server

MikroTik MCP

GitKraken MCP Server

Linux MCP Server

PostHog MCP Server

Socket MCP Server