# Klarion

Klarion detects possible API keys, passwords, and tokens in code, then has a model verify each candidate. Use it before writes and commits.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 11
- Author: 0x1Adi
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/0x1Adi/Klarion
- Updated: 2026-10-03
- HTML: https://affpapa.org/en/nevibecode/mcp/klarion

## What it does

Klarion starts with local checks for known key formats, credential files, password-style assignments, and strings with high randomness. Each candidate is then sent with nearby code to a model, which labels it a secret, a false positive, or uncertain. Uncertain results fail the check.

The MCP server calls `scan_text` before an agent writes code and `scan_file` before a commit. It can be used with Claude Code, Codex, Cursor, GitHub Copilot, Cline, Zed, and the other listed clients. Claude Code also has a hook that blocks a secret before the file is created. Without a configured model, `klarion scan` and commit hooks stop with an error; the MCP path asks the agent to judge the candidate.

Install it with Homebrew on macOS, or with `go install` when Go 1.25 or newer is available. Anthropic uses `ANTHROPIC_API_KEY`; OpenAI-compatible setups use `OPENAI_API_KEY`. Ollama and the Claude Code login are supported too. Configuration belongs in `.klarion.toml`.

## Requirements
- Environment variables: `ANTHROPIC_API_KEY` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- find exposed keys, passwords, and tokens in source code
- separate test values, IDs, and hashes from likely leaks
- stop an agent from writing a secret to disk
- check changed files before a commit
- scan only newly introduced secrets with a baseline

## Example prompts
- Use Klarion to inspect this code for exposed credentials before writing the file.
- Run a Klarion check on the changed files before I commit, and block any secret you find.
- Ask Klarion to scan `services/billing/client.py` and show suppressed findings.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [GitHub](https://affpapa.org/en/nevibecode/mcp/github.md) — MCP server · ★ 33989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [Netdata](https://affpapa.org/en/nevibecode/mcp/netdata.md) — MCP server · ★ 81163
- [Front-End Checklist](https://affpapa.org/en/nevibecode/mcp/front-end-checklist.md) — MCP server · ★ 74569
- [Scrapling MCP Server](https://affpapa.org/en/nevibecode/mcp/scrapling-mcp-server.md) — MCP server · ★ 89899

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md