looksLikeSecretValue (mcp-inventory/canonical-mcp.js)

Utility functions to detect and redact secret values in commands and URLs.

// Source: https://github.com/affaan-m/ECC | License: MIT | Copyright 2026 Affaan Mustafa
// Provided via justclaw.it.com; keep this notice with the code.
'use strict';

const MCP_SCHEMA_VERSION = 'ecc.mcp.v1';

// Env keys whose values are almost always secrets. Used only to flag a server
// as carrying credentials; values are NEVER copied into the canonical record.
const SECRET_KEY_PATTERN = /(token|secret|key|password|passwd|auth|credential|api[_-]?key|access[_-]?key|private)/i;

const REDACTED = '***';

// Known secret value prefixes (provider API keys) plus a high-entropy fallback.
const SECRET_VALUE_PATTERNS = [
  /^sk-[A-Za-z0-9_-]{16,}$/i,            // OpenAI / Anthropic (sk-ant-...)
  /^ghp_[A-Za-z0-9]{16,}$/,             // GitHub PAT (classic)
  /^github_pat_[A-Za-z0-9_]{16,}$/

... (truncated -- full source via MCP)