{"id":"agent-secret-scanner","card_id":"card_agent_secret_scanner","name":"Agent secret scanner","description":"Scans supplied text/file metadata for likely secrets and returns redacted PASS/REVIEW/BLOCK findings before AI-mediated upload.","stage":1,"safety_level":"data_only_read_only","auth":{"type":"hmac-sha256","required_headers":["x-apex-tool-timestamp","x-apex-tool-nonce","x-apex-tool-content-sha256","x-apex-tool-signature"],"canonical_payload":"APEX-TOOL-V1\\n{tool_id}\\n{timestamp}\\n{nonce}\\n{sha256(canonical_json(body))}"},"permissionless":{"enabled":true,"tier":"bounded_public","rate_limit":"Shared 20 calls per IP per hour across permissionless bounded tools plus global agent-write protection","review_required":false,"note":"Anonymous bounded execution is allowed because this scanner is a deterministic DATA ONLY pass over caller-supplied text. It returns hashes, line numbers, and redacted labels only; raw secret values are never returned."},"input_schema":{"type":"object","properties":{"text":{"type":"string"},"files":{"type":"array"}}},"output_schema":{"type":"object","properties":{"decision":{"type":"string"},"findings":{"type":"array"},"not_echoing_secret_values":{"type":"boolean"}}},"sample_input":{"files":[{"path":"README.md","content":"GITHUB_TOKEN=ghp_redactedExampleToken123456"}]},"test_vectors":[{"input":{"files":[{"path":"README.md","content":"GITHUB_TOKEN=ghp_redactedExampleToken123456"}]},"expected":{"result":{"decision":"BLOCK","scanned_entries":1,"counts":{"high":1,"medium":1,"total":2},"findings":[{"path":"README.md","line":1,"type":"github_token","severity":"high","confidence":"high","match_sha256":"637f7a24a2d2f531","redacted":"[REDACTED:github_token]","remediation":"Remove and revoke the GitHub token."},{"path":"README.md","line":1,"type":"high_entropy_token","severity":"medium","confidence":"medium","match_sha256":"19a603963de92626","redacted":"[REDACTED:high_entropy_token]","remediation":"Review whether this high-entropy value is a token. If it is, remove it and rotate the credential."}],"rotation_required":true,"not_echoing_secret_values":true}},"match":"subset","verified_at":"2026-07-04T06:30:00.000Z"},{"input":{"text":"public config only, no credentials here"},"expected":{"result":{"decision":"PASS","scanned_entries":1,"findings":[],"counts":{"high":0,"medium":0,"total":0},"rotation_required":false,"not_echoing_secret_values":true}},"match":"subset","verified_at":"2026-07-04T06:30:00.000Z"}]}