{"version":"2.1.300","anchor":"secret-scan-tool-for-the-plugin-authoring-mods-built-in-pl","canonical_anchor":"secret-scan-tool-for-the-plugin-authoring-mods-built-in-pl","heading":"Claude Code can scan a mod's folder for keys and tokens before you share it","tier":"use","area":"Plugins","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.300\/e\/secret-scan-tool-for-the-plugin-authoring-mods-built-in-pl","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.300","markdown":"### Claude Code can scan a mod's folder for keys and tokens before you share it\n\nA new built-in tool scans a mod's folder for keys and tokens before it is shared, asks you first, and reports file names and secret types\n\n**Unclear.** Whether the mod-building plugin, and with it this scan and the sharing offer, is available to ordinary users is not clear.\n\n**What**\n\nClaude Code has a built-in plugin for building mods (add-ons you create with Claude's help). That plugin gains a new tool, `mcp__plugin-authoring__scan_secrets`. It looks through a mod's folder for known formats of keys and tokens, such as passwords for online services, before the mod is shared.\n\nIt reads the files as they are on disk, skips the `.git` folder, and reports only which files hold a secret and what kind it is. It never shows the secret itself.\n\nBefore scanning, it checks your Read permission rules. Then it asks you in a dialog headed \"Secret scan\", with the choices \"Scan it\" and \"Don't scan\". A yes lasts until you run `\/clear` or restart Claude Code.\n\nThe tool refuses to scan:\n\n- folders on network paths\n\n- when managed hooks for reading files are set, or managed settings cannot be read\n\n- when your organization's HIPAA or ZDR compliance settings are on\n\nThe instructions for building mods also gain a sharing step. Once a mod has loaded and worked, Claude offers once to share it as a GitHub repository and asks whether it should be public or private.\n\n**Why**\n\nThe scan aims to catch a key or token left in a mod before you publish it. It runs only with your consent and stays off where an organization's settings could interfere with how files are read.\n\n- Area: Plugins\n- Names: `mcp__plugin-authoring__scan_secrets`\n- Tier: Use it now\n- Useful: 5\/5\n- Signal: 3\/5\n- Scope: individual\n- Heads-up: no"}