Secret scanner and redactor
Paste code, a .env file, a log or a chat before you share it. Spill finds API keys, tokens, private keys and passwords, tells you which are live and which are meant to be public, and gives you a clean copy.
Samples use randomly generated keys in real formats. None of them work.
Public keys in the clean copyPublishable keys (Stripe pk_, Supabase anon, Mapbox pk.) are built to ship in a page. Keep them so the code still runs, or hide everything before posting it in public.
OpenAI, Anthropic, Gemini, Groq, xAI, OpenRouter, Stripe, Supabase, AWS, GitHub, GitLab, npm, Slack, Discord, Twilio, SendGrid, Resend, Shopify and more, plus private keys, database URLs with passwords, JWTs, Authorization headers and secrets in named variables.
Each match is checked: GitHub tokens by their built-in checksum, JWTs and Supabase keys by decoding the role and expiry, docs examples and placeholders set aside, and anything in a NEXT_PUBLIC_ or VITE_ variable flagged as shipped to every visitor.
Every live finding links to the page where you revoke it. Deleting a key from code or git history does not stop it working; rotating it does. The clean copy swaps each secret for a label like [STRIPE_SECRET_KEY_1].
Coding agents can call Spill through MCP at https://spill.clawhard.com/mcp (tool spill_scan_secrets) to check a diff, a log or a prompt for secrets before sharing it, and get masked findings plus a redacted copy. For text you would rather not send anywhere, use this page.
Add Spill to ChatGPT, Claude, Cursor or any assistant that supports MCP, then ask it to find API keys, tokens, private keys and passwords in code, logs or .env files, see which are live, and get a redacted copy. No key, no login.
https://spill.clawhard.com/mcpclaude mcp add --transport http clawhard-spill https://spill.clawhard.com/mcp
Press Add to Claude, or open Customize → Connectors → Add custom connector, paste the URL and leave sign-in empty.
Open Plugins → + → Add custom MCP server, paste the URL, choose No authentication, accept the warning, then Create as a plugin. Start a chat and type @ to use it.
codex mcp add clawhard-spill --url https://spill.clawhard.com/mcp
gemini mcp add --transport http clawhard-spill https://spill.clawhard.com/mcp
{
"mcpServers": {
"clawhard-spill": { "url": "https://spill.clawhard.com/mcp" }
}
}{
"servers": {
"clawhard-spill": { "type": "http", "url": "https://spill.clawhard.com/mcp" }
}
}No desktop app? Add to VS Code in the browser · VS Code Insiders · Add to Cursor in the browser
Other apps: Goose · LM Studio. Any MCP client works with the URL (Streamable HTTP, no headers).
OpenAPI (custom GPT Actions, scripts) · llms.txt · MCP server card · Agent card · All Clawhard tools in one connector
Spill finds API keys, tokens, private keys and passwords in pasted text (code, .env, logs, chats), from 48 services. It says which are live, which are meant to be public, where to rotate each one, and gives you a redacted copy. Runs in your browser, no account.
Paste the text into Spill. It lists every API key, token, private key and password it finds, with the line, a masked preview, whether it is live or meant to be public, and where to rotate it. It also gives you a redacted copy that is safe to share.
The page scans in your browser and sends nothing anywhere: no upload, no account, no link containing your text. You can load the page, go offline and it still works.
No. The anon (and sb_publishable_) key is meant to be in the browser; what it can read depends on your Row Level Security policies. The service_role (and sb_secret_) key bypasses RLS and must never ship. Spill decodes the key and tells you which one it is.
No. Next.js copies NEXT_PUBLIC_ variables, and Vite copies VITE_ variables, into the JavaScript every visitor downloads. Spill marks any secret key in one of those as critical, because it is public the moment you deploy.
No. A leaked key keeps working until you revoke it at the provider, and it stays in git history and forks. Rotate it first using the link Spill gives you, then remove it.
No. It never contacts providers. It checks what can be checked offline: GitHub token checksums, JWT roles and expiry dates, and known example values.
Yes. Add the MCP server https://spill.clawhard.com/mcp (tool spill_scan_secrets) or call the JSON API described at /openapi.json. Agents can scan diffs, logs and prompts before sharing them and use the redacted copy.
For AI assistants and developers: llms.txt · API (OpenAPI) · MCP server · sitemap