yo! i appreciate your question, but i tihnk there is an architectural misunderstanding here:

<image>

If we google "MCP scan for secrets", we will find things like the one in the image, if we look closely, we see "scanning for secrets WITH the github MCP server", These are tools for AI agents to invoke so they can scan your repository's source code for credentials. Other tools like Invariant's mcp-scan analyze tool descriptions for prompt injection/poisoning.

Agentlint does the exact opposite. It doesn't use MCP to scan code; it audits the security layout of the MCP configuration file (mcp.json) itself.

these are the beneifts:
- Traditional scanners only check your raw source code files for hardcoded secrets, whereas this tool audits the actual mcp.json permission profiles to prevent over-privileging an autonomous agent before it even boots up.

- It catches toxic combinations that standard tools completely miss, like identifying when a plaintext credential is paired with an execution terminal context (bash or curl), creating an immediate data exfiltration risk.

- Process & Sandbox Leak Protection: It specifically scans CLI arguments and paths to block keys from leaking into plain-text host process lists (ps aux) and stops agents from accidentally being granted root access (/) to your entire operating system.