What problem does it solve? Agentic CI/CD pipelines and agent-skill codebases frequently leak credentials through hard-coded keys, debug logging, env-var injection, and MCP configuration files, leaving long-lived secrets exposed to prompt injection and exfiltration. ## Core Features & Use Cases - Static Credential Scanning: Runs a deterministic Python scanner to flag hard-coded secrets, secret-logging debug statements, and secrets in agent/MCP config, keyed to file:line. - Four-Layer Defense Mapping: Classifies every finding into a leakage pattern and assigns it to a sequenced defense-in-depth stack, from eliminating static credentials to lifecycle-triggered rotation. - Runtime-Secrets Architecture Design: Produces a target-state design replacing each credential class with Vault dynamic secrets, AWS Secrets Manager, or workload identity federation (IRSA, GCP Workload Identity, Azure Managed Identity) with task-duration TTLs. - Use Case: Ask it to audit your agent codebase and it emits four artifacts: a prioritized hardening plan, a runtime-secrets architecture, an agent-identity inventory under a trust-tier model, and an output-scrubber spec. ## Quick Start Audit this agent codebase for hard-coded secrets and produce a hardening plan with a runtime-secrets architecture.
