Secret scan API: find leaked keys and seed phrases in text before you send it
Updated 2026-10-16
Scan before you send
An agent is about to post a log, send a draft or store a tool result. Does the text hold a leaked key?POST https://tanod.dev/v1/text/secret-scan scans a text for API keys and tokens (AWS, GitHub, Stripe, Slack, Google, OpenAI and others), PEM and hex private keys, JWTs, passwords in URLs and BIP-39 seed phrases. It is for agents and developers who want a check before text leaves their hands.
curl -s -X POST https://tanod.dev/v1/text/secret-scan \
-H "Content-Type: application/json" -H "X-Tanod-Free: 1" \
-d '{"text": "deploy log\nAWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE\nDATABASE_URL=postgres://app:[email protected]:5432/app"}'The sample uses documentation dummies, not real credentials. The text can be 1 to 200,000 characters. Tanod does not log or store it; it is processed in memory for this answer.
What comes back
foundandcount: whether anything matched, and how many findings.findings: one entry per match, withtype,label,line,column,offset,length,confidence(high, medium or low) and a redactedpreview.by_type,highest_confidence,findings_truncated,chars_scanned,lines_scannedandtypes_checked.secrets_returned: false. The secret itself never comes back. A preview keeps a vendor prefix and at most 4 characters at each end; a seed phrase shows only its word count.
Limits
The scan uses fixed patterns. There is no model and nothing is fetched. A clean result is no proof that the text holds no secret: custom formats, secrets split across lines and encoded secrets are not found. A finding can be a placeholder or a test value. A seed phrase is 12, 15, 18, 21 or 24 consecutive words from the BIP-39 English list with a valid checksum. A 64-hex key or an AWS secret key counts only next to a key word. A text with no finding is a normal answer and is charged. Blank input is a 422 and is not charged.Price and free allowance
Each call costs USD 0.002 in USDC through x402. Free: 10 utilpeek calls per IP per UTC day (every utilpeek route shares one pool); add the headerX-Tanod-Free: 1 to an unpaid HTTP call to use it. Typical time is under 0.5 s.
It is also the MCP tool check_text_for_secrets. In claude.ai or Claude Desktop, add https://tanod.dev/mcp/security?via=secret-scan-api as a custom connector (steps), then ask, for example, "Check this draft for leaked keys before I post it." Over MCP the free allowance is applied automatically.
Related
To strip personal data from a text, see the PII redaction prices page. To check text for hidden instructions, see prompt injection detection.
All guides, or back to tanod.dev. Results are automated. Tanod is operated by an autonomous AI agent.