Holster MCP — Claude Code MCP server: scan a repo for leaked secrets
A local MCP server that finds leaked keys in your repository, checks .gitignore, and outlines credential rotation. Handy before a push, or right after a key lands in a commit.
claude mcp add holster-mcp -- uvx holster-mcpWhat Holster MCP does
Holster MCP hands Holster Doctor checks to your agent. The free tools shell out to a bundled holster-doctor binary, so repository contents stay on the machine.
Three tools ship free. holster.scan_repo walks files down to a given depth and returns findings with a secret kind and severity. holster.check_gitignore reports which patterns your .gitignore is missing. holster.rotation_playbook returns rotation steps for a provider. Paid tools wrap holster-cli and need a license: the key comes from a tool argument, HOLSTER_LICENSE_KEY, or ~/.holster/config.toml. With no key configured, the first paid call mints a local 7-day trial key prefixed holster_trial_.
Wheels are built for macOS ARM and Linux x86_64 only — there is no universal build. The server resolves holster-doctor in this order: HOLSTER_DOCTOR_BIN, the binary packaged in the wheel, PATH, then target/release and target/debug inside the repo. Miss all five and the tools have nothing to call.
What it helps with
- catch an API key that slipped into source files
- add missing patterns to
.gitignorebefore.env.localgets committed - get provider-specific steps for rotating a token
- keep credentials in a local vault instead of project files
- review when vault entries were added and by which action
Example prompts for the agent
- Scan this repo for secrets with
holster.scan_repo, path/absolute/repo/path, depth 3 - Check the
.gitignorein this repo and tell me what to append - Give me the
githubrotation steps fromholster.rotation_playbook
How to install Holster MCP
Platform CLI
claude mcp add holster-mcp -- uvx holster-mcpuvx runs the command named after the package; if the README names another one, use uvx --from holster-mcp <command>
Platform CLI
codex mcp add mcp -- uvx holster-mcpuvx runs the command named after the package; if the README names another one, use uvx --from holster-mcp <command>
Config file
{
"mcpServers": {
"mcp": {
"command": "uvx",
"args": [
"holster-mcp"
]
}
}
}uvx runs the command named after the package; if the README names another one, use uvx --from holster-mcp <command>
Config file
{
"servers": {
"mcp": {
"type": "stdio",
"command": "uvx",
"args": [
"holster-mcp"
]
}
}
}uvx runs the command named after the package; if the README names another one, use uvx --from holster-mcp <command>
Platform CLI
gemini mcp add mcp uvx holster-mcpuvx runs the command named after the package; if the README names another one, use uvx --from holster-mcp <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Holster MCP
How do I install Holster MCP in Claude Code?
Run claude mcp add holster-mcp -- uvx holster-mcp. That registers the server in your Claude config, and uvx fetches the holster-mcp package when it starts.
What does Holster MCP do?
It gives the agent tools to scan a repository for secrets, check .gitignore coverage, and fetch rotation playbooks. Paid tools add a local vault and an audit log.
Do I need a license?
The free tools do not — they call holster-doctor locally. Paid tools need a Holster key; without one, the first call creates a local 7-day trial key.
