Content
# EnviroGuard
An MCP (Model Context Protocol) server that audits `.env` files and source code for security issues — exposed secrets, unsafe defaults, hardcoded credentials, and missing configurations.
## Installation
### Via Cargo
```bash
cargo install enviroguard
```
### Download Binary
Download the latest binary for your platform from [GitHub Releases](https://github.com/sinescode/enviroguard/releases).
| Platform | Asset |
|----------|-------|
| Linux x86_64 | `enviroguard-linux-x86_64` |
| Linux ARM64 | `enviroguard-linux-aarch64` |
| macOS Intel | `enviroguard-macos-x86_64` |
| macOS Apple Silicon | `enviroguard-macos-aarch64` |
| Windows x86_64 | `enviroguard-windows-x86_64.exe` |
```bash
# After downloading, mark executable and move to PATH
chmod +x enviroguard-linux-x86_64
sudo mv enviroguard-linux-x86_64 /usr/local/bin/enviroguard
```
## MCP Server Setup
EnviroGuard runs as a stdio MCP server — your MCP client launches it as a subprocess and communicates over stdin/stdout JSON-RPC.
### Claude Code
Add to `.claude/settings.json` in your project (or `~/.claude/settings.json` for global):
```json
{
"mcpServers": {
"enviroguard": {
"command": "enviroguard"
}
}
}
```
### Claude Desktop
**macOS** — `~/Library/Application Support/Claude/claude_desktop_config.json`:
```json
{
"mcpServers": {
"enviroguard": {
"command": "/usr/local/bin/enviroguard"
}
}
}
```
**Windows** — `%APPDATA%\Claude\claude_desktop_config.json`:
```json
{
"mcpServers": {
"enviroguard": {
"command": "C:\\Tools\\enviroguard.exe"
}
}
}
```
### Continue.dev / VS Code
In `~/.continue/config.json`:
```json
{
"experimental": {
"mcpServers": {
"enviroguard": {
"command": "enviroguard"
}
}
}
}
```
### Cursor
In Cursor Settings → MCP → Add new MCP server:
- **Name**: `enviroguard`
- **Type**: `command`
- **Command**: `enviroguard`
### Verify It Works
After configuring, ask your AI assistant: *"Scan this project for .env security issues"* — it should invoke EnviroGuard's `scan_env` tool.
## Tools
### `scan_env`
Scan a project directory for `.env` security issues.
| Parameter | Required | Description |
|-----------|----------|-------------|
| `path` | Yes | Absolute path to the project root directory |
| `env_example` | No | Path to `.env.example` for cross-reference validation |
**Checks performed:**
- `.env` tracked by git (CRITICAL)
- Missing `.env.example` (MEDIUM)
- Variables in `.env.example` but missing from `.env` (HIGH)
- Variables in `.env` but not in `.env.example` (LOW)
- Debug mode enabled (HIGH)
- Weak or default secrets/keys/tokens (HIGH)
- Default admin passwords (CRITICAL)
- Database URLs with default credentials (CRITICAL)
- Placeholder API keys (MEDIUM)
- HTTP URLs for secret keys (MEDIUM)
- localhost URLs in production keys (LOW)
- `.env.*` variant files present
- Commented-out secrets in `.env` files
- High-entropy strings that may be unrecognized secrets
### `list_env_vars`
List all environment variables found across `.env`, `.env.example`, and source files.
| Parameter | Required | Description |
|-----------|----------|-------------|
| `path` | Yes | Absolute path to the project root directory |
Returns a table showing which variables are defined, missing, or unused, with masked value previews.
### `scan_source`
Scan source files for hardcoded secrets and credentials.
| Parameter | Required | Description |
|-----------|----------|-------------|
| `path` | Yes | Absolute path to the project root directory |
| `patterns` | No | Glob patterns for files to scan (default: `*.{py,js,ts,rb,go,java,rs,yaml,yml,toml}`) |
Detects:
- Hardcoded password/secret/key/token assignments
- AWS access keys (`AKIA*`)
- GCP service account patterns
- Stripe/SendGrid/GitHub token patterns
- JWT tokens in code
- Base64-encoded secrets with high entropy
## Security Rules Reference
| Severity | Rule | Recommendation |
|----------|------|----------------|
| **CRITICAL** | `.env` tracked by git | `git rm --cached .env && echo '.env' >> .gitignore` |
| **CRITICAL** | Default admin password | Use 16+ character strong password |
| **CRITICAL** | DB URL with default creds | Use unique, strong database credentials |
| **HIGH** | Variable in example but missing in .env | Add the variable with a proper value |
| **HIGH** | Debug mode enabled in production | Set to `false` / `0` |
| **HIGH** | Weak secret/key/token value | Generate with `openssl rand -hex 32` |
| **MEDIUM** | Missing `.env.example` | Create one with all required keys and placeholders |
| **MEDIUM** | Placeholder API key | Replace with real key |
| **MEDIUM** | HTTP URL for secret | Use HTTPS |
| **LOW** | Variable in .env but not in example | Add to `.env.example` with placeholder |
| **LOW** | localhost URL in production key | Update for production deploy |
## Example Output
```
EnviroGuard scan of /home/user/myproject:
.env: exists
.env.example: exists
.env tracked by git: no
CRITICAL (1)
─────────────────────────────────────────────
.env:15 DB_URL uses default credentials
postgres://postgres:postgres@localhost:5432/db
→ Use unique database credentials
HIGH (2)
─────────────────────────────────────────────
.env:3 SECRET_KEY value is too short (8 chars)
→ Generate: openssl rand -hex 32
.env:8 DEBUG is enabled (true)
→ Set to false in production
MEDIUM (1)
─────────────────────────────────────────────
.env:22 SENDGRID_API_KEY looks like a placeholder
→ Replace with real API key
```
## CLI
```bash
enviroguard --help # Show help
enviroguard --version # Show version (0.2.0)
enviroguard # Start MCP server mode (stdin/stdout JSON-RPC)
```
When run with no arguments, EnviroGuard enters MCP server mode and listens for JSON-RPC requests on stdin.
## Development
Requires Rust 1.70+.
```bash
git clone https://github.com/sinescode/enviroguard.git
cd enviroguard
cargo build --release
cargo test
```
The GitHub Actions CI builds and tests on every push, and publishes multi-platform binaries to GitHub Releases on version tags.
