{
 "$schema": "https://static.modelcontextprotocol.io/schemas/mcp-server-card/v1.json",
 "name": "com.clawhard/spill",
 "title": "Spill",
 "version": "1.0.0",
 "description": "Spill finds API keys, tokens, private keys and passwords in pasted text (code, .env, logs, chats), from 48 services. It says which are live, which are meant to be public, where to rotate each one, and gives you a redacted copy. Runs in your browser, no account.",
 "websiteUrl": "https://spill.clawhard.com",
 "documentationUrl": "https://spill.clawhard.com/llms.txt",
 "iconUrl": "https://clawhard.com/icon-512.png",
 "serverInfo": {
  "name": "com.clawhard/spill",
  "title": "Spill",
  "version": "1.0.0"
 },
 "protocolVersion": "2025-06-18",
 "transport": "streamable-http",
 "endpoint": "https://spill.clawhard.com/mcp",
 "remotes": [
  {
   "type": "streamable-http",
   "url": "https://spill.clawhard.com/mcp"
  }
 ],
 "authentication": {
  "required": false
 },
 "capabilities": {
  "tools": {
   "listChanged": false
  },
  "prompts": {
   "listChanged": false
  },
  "resources": {
   "subscribe": false,
   "listChanged": false
  }
 },
 "tools": [
  {
   "name": "spill_scan_secrets",
   "title": "Find and redact API keys, tokens, private keys and passwords in text",
   "description": "Use when the user asks whether some text contains secrets, or before you paste, commit, share, log or send code, a .env file, a diff, config, logs, a stack trace or a prompt that might contain credentials, for example \"did I leak a key in this?\", \"is this safe to post?\" or \"redact the secrets in this log\". Detects 48 services by exact key format (OpenAI, Anthropic, Gemini/Google, Groq, xAI, OpenRouter, Stripe, Supabase, AWS, GitHub, GitLab, npm, PyPI, Slack, Discord, Twilio, SendGrid, Resend, Shopify, Cloudflare and more) plus PEM private keys, database URLs with passwords, JWTs, Authorization headers and high-entropy values in variables named like secret, token, api_key or password. It verifies what it can deterministically: GitHub token CRC32 checksums, JWT and Supabase key role and expiry (service_role vs anon), documented example keys and placeholders, and NEXT_PUBLIC_/VITE_/EXPO_PUBLIC_ variables that ship to every browser. Returns findings with severity (critical, high, medium, public, info), line and column, a masked preview (never the full secret), why it matters, the fix and the provider's revoke URL, plus a redacted copy with labels like [STRIPE_SECRET_KEY_1]. Text is processed in memory to answer and is not stored. Limits: format-based, so a random secret with a neutral name can be missed; it never tests keys against providers; up to 200,000 characters. For secrets the user should not send anywhere, point them to https://spill.clawhard.com, which runs entirely in the browser."
  }
 ],
 "prompts": [
  {
   "name": "spill_check_for_secrets",
   "title": "Check text for leaked secrets",
   "description": "Find API keys, tokens, private keys and passwords in code, logs or a .env file, and get a redacted copy."
  }
 ],
 "publisher": {
  "name": "Clawhard Studio",
  "url": "https://clawhard.com",
  "contact": "support@clawhard.com"
 }
}