Klarion — Claude Code MCP server: what it does, how to install
Klarion detects possible API keys, passwords, and tokens in code, then has a model verify each candidate. Use it before writes and commits.
Open on GitHubWhat Klarion does
Klarion starts with local checks for known key formats, credential files, password-style assignments, and strings with high randomness. Each candidate is then sent with nearby code to a model, which labels it a secret, a false positive, or uncertain. Uncertain results fail the check.
The MCP server calls scan_text before an agent writes code and scan_file before a commit. It can be used with Claude Code, Codex, Cursor, GitHub Copilot, Cline, Zed, and the other listed clients. Claude Code also has a hook that blocks a secret before the file is created. Without a configured model, klarion scan and commit hooks stop with an error; the MCP path asks the agent to judge the candidate.
Install it with Homebrew on macOS, or with go install when Go 1.25 or newer is available. Anthropic uses ANTHROPIC_API_KEY; OpenAI-compatible setups use OPENAI_API_KEY. Ollama and the Claude Code login are supported too. Configuration belongs in .klarion.toml.
What it helps with
- find exposed keys, passwords, and tokens in source code
- separate test values, IDs, and hashes from likely leaks
- stop an agent from writing a secret to disk
- check changed files before a commit
- scan only newly introduced secrets with a baseline
Example prompts for the agent
- Use Klarion to inspect this code for exposed credentials before writing the file.
- Run a Klarion check on the changed files before I commit, and block any secret you find.
- Ask Klarion to scan
services/billing/client.pyand show suppressed findings.
How to install Klarion
Install
The MCP registry has no launch command for it: see the repository README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Klarion
How do I install Klarion in Claude Code?
Run /plugin marketplace add 0x1Adi/Klarion, then /plugin install klarion@klarion, and restart Claude Code.
What does Klarion do?
It uses local rules and entropy checks to find possible secrets, then sends each candidate with nearby code to a model for classification.
Does Klarion require an API key?
A configured model is required for klarion scan and commit hooks. The MCP server can pass candidates and its rules to the agent for a decision without an API key; with a provider configured, Klarion makes the decision.
