# Holster MCP

A local MCP server that finds leaked keys in your repository, checks .gitignore, and outlines credential rotation. Handy before a push, or right after a key lands in a commit.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI
- Author: nauta-ai
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/nauta-ai/holster/tree/HEAD/mcp
- Updated: 2026-06-04
- HTML: https://affpapa.org/en/nevibecode/mcp/holster-mcp

## What it does

Holster MCP hands Holster Doctor checks to your agent. The free tools shell out to a bundled `holster-doctor` binary, so repository contents stay on the machine.

Three tools ship free. `holster.scan_repo` walks files down to a given depth and returns findings with a secret kind and severity. `holster.check_gitignore` reports which patterns your `.gitignore` is missing. `holster.rotation_playbook` returns rotation steps for a provider. Paid tools wrap `holster-cli` and need a license: the key comes from a tool argument, `HOLSTER_LICENSE_KEY`, or `~/.holster/config.toml`. With no key configured, the first paid call mints a local 7-day trial key prefixed `holster_trial_`.

Wheels are built for macOS ARM and Linux x86_64 only — there is no universal build. The server resolves `holster-doctor` in this order: `HOLSTER_DOCTOR_BIN`, the binary packaged in the wheel, `PATH`, then `target/release` and `target/debug` inside the repo. Miss all five and the tools have nothing to call.

## Requirements
- Needs: Python and uv (commands run via uvx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add holster-mcp -- uvx holster-mcp
```
uvx runs the command named after the package; if the README names another one, use uvx --from holster-mcp <command>

### Codex

**Platform CLI**
```bash
codex mcp add mcp -- uvx holster-mcp
```
uvx runs the command named after the package; if the README names another one, use uvx --from holster-mcp <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "mcp": {
            "command": "uvx",
            "args": [
                "holster-mcp"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from holster-mcp <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "mcp": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "holster-mcp"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from holster-mcp <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add mcp uvx holster-mcp
```
uvx runs the command named after the package; if the README names another one, use uvx --from holster-mcp <command>

## When to use it
- catch an API key that slipped into source files
- add missing patterns to `.gitignore` before `.env.local` gets committed
- get provider-specific steps for rotating a token
- keep credentials in a local vault instead of project files
- review when vault entries were added and by which action

## Example prompts
- Scan this repo for secrets with `holster.scan_repo`, path `/absolute/repo/path`, depth 3
- Check the `.gitignore` in this repo and tell me what to append
- Give me the `github` rotation steps from `holster.rotation_playbook`

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7718
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2066
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md