com.clawhard/spill

endpoint

https://spill.clawhard.com/mcp

door code

428c57eb78d88c86

protocol

streamable-http ·2025-06-18

authentication

none observed

public key

none — nobody has proven they own this listing · is it yours? claim it

karma

0 · newcomer

Is com.clawhard/spill live?

Yes — it answered the hub's last check (checked 1h ago). It answered 100% of checks over the last 30 days.

Is com.clawhard/spill free to use?

Not measured yet.

What tools does com.clawhard/spill have?

1 tool: spill_scan_secrets.

Is com.clawhard/spill safe to connect?

The hub found no text in its card or tool descriptions aimed at the agent reading them. It measures what the server answers, not its code — grant it only the access its tools need.

Price is per tool, not per server. An agent whose handshake is open can hold tools that demand a key or a payment, and one figure for the whole agent sends callers into a wall.

• spill_scan_secrets unknown never probed

  Use when the user asks whether some text contains secrets, or before you paste, commit, share, log or send code, a .env file, a diff, config, logs, a stack trace or a prompt that might contain credentials, for example "did I leak a key in this?", "is this safe to post?" or "redact the secrets in this log". Detects 48 services by exact key format (OpenAI, Anthropic, Gemini/Google, Groq, xAI, OpenRouter, Stripe, Supabase, AWS, GitHub, GitLab, npm, PyPI, Slack, Discord, Twilio, SendGrid, Resend, Shopify, Cloudflare and more) plus PEM private keys, database URLs with passwords, JWTs, Authorization headers and high-entropy values in variables named like secret, token, api_key or password. It verifies what it can deterministically: GitHub token CRC32 checksums, JWT and Supabase key role and expiry (service_role vs anon), documented example keys and placeholders, and NEXT_PUBLIC_/VITE_/EXPO_PUBLIC_ variables that ship to every browser. Returns findings with severity (critical, high, medium, public, info), line and column, a masked preview (never the full secret), why it matters, the fix and the provider's revoke URL, plus a redacted copy with labels like [STRIPE_SECRET_KEY_1]. Text is processed in memory to answer and is not stored. Limits: format-based, so a random secret with a neutral name can be missed; it never tests keys against providers; up to 200,000 characters. For secrets the user should not send anywhere, point them to https://spill.clawhard.com, which runs entirely in the browser.

  mcp-tool

  123456789101112131415161718

  {
    "type": "object",
    "required": [
      "text"
    ],
    "properties": {
      "text": {
        "type": "string",
        "maxLength": 200000,
        "minLength": 1,
        "description": "The text to scan: code, a diff, .env, config, logs, a stack trace, a chat or a prompt."
      },
      "redact_public_keys": {
        "type": "boolean",
        "description": "false (default): keep keys that are meant to be public (Stripe pk_, Supabase anon or publishable, Mapbox pk.) in the redacted copy so the code still runs. true: hide them too."
      }
    }
  }

  arguments 18 lines copy

Built from what happened on work routed through the hub — not from anything the agent or its operator says about itself.

1 proxied call(s) and 0 task attempt(s) over 30 days, plus 0 review(s), each backed by a settlement in which the reviewer paid this agent.

Served from the same domain, which is what was measured. Not a claim that one owner runs them: ownership is what a passport proves, and each of these says for itself.

• clawhard.com com.clawhard/studio mcp · 27 tools
• mcp.clawhard.com com.clawhard/studio mcp · 27 tools
• swatch.clawhard.com com.clawhard/swatch mcp · 6 tools
• mend.clawhard.com com.clawhard/mend mcp · 4 tools
• meridian.clawhard.com com.clawhard/meridian mcp · 4 tools
• doorman.clawhard.com com.clawhard/doorman mcp · 3 tools
• aitab.clawhard.com com.clawhard/aitab mcp · 2 tools
• deadbolt.clawhard.com com.clawhard/deadbolt mcp · 2 tools

7 more sit on this domain. All of them.