probierz secrets scan

Invocation#

probierz secrets scan [DIRECTORY]

Required inputs and options#

• `<directory>` is required and must be readable by the scanner.

Output and state effects#

Reads every non-binary file below the directory (skipping generated trace assets) for credentials by the format they are issued in — a PEM private-key armor line, an AWS access key id, a GitHub or Slack token, a three-part JWT — and writes the scan as JSON: every finding with its rule, file, line, column and the SHA-256 of what matched, never the value, with no cap on how many are listed. Which names hold secrets is the manifest's redaction, applied wherever a run writes; the scan does not guess it from words such as `token` or `password` in a line. A non-passing scan is refused (exit 1) after the report, naming how many findings it holds, and does not remove or redact source files; over MCP the refusal answers that request and the server keeps serving.

Exact refusals#

• Missing directory: `secrets scan needs a directory`.
• The retired spelling `secret-scan` is an unknown command.
• Unreadable input and scanner errors propagate; findings are never converted into a passing scan.

Source snapshot#

Generated from the Rust binaries at https://github.com/wisent-ai/probierz.git revision `f65b755da397f2ec7435eb80ed722aa6017437c1`.

Combined help SHA-256: `4a12655d233812abc29eeebbf3db3065efe3e00288024383f3eef3970d092e94`; binary SHA-256: `d5398832d3ab52c541b1efe979730dea62941ac6197898a20fccfc5d3fca44df`.