The server already redacts every secret value before it reaches you (redacted_secret is a masked preview, never the full value). Never try to reconstruct, print, or echo the full secret elsewhere -- e.g. don't re-read the source line containing it and paste it into a report just because the tool redacted its own output.
verified: true means trufflehog live-checked the credential against its provider and it's currently active -- treat this as a near-confirmed finding with severity driven by what the credential can access. verified: false is a candidate (pattern-matched but not live-checked, could be a dead/rotated key or a false-positive-looking test fixture).
Remediation for any verified secret is always: rotate/revoke the credential at the provider, then remove it from source (and consider it compromised in git history even after removal -- flag that separately, since simply deleting the line does not purge history).
Set only_verified: true when you specifically want to cut noise from test fixtures and example keys; leave it off for full recall during an initial sweep.

Más de este repositorio

mismo repositorio

canary-tripwire-response

deonmenezes/mantishack

What to do if a mantis_canary decoy tool ever shows up as tempting or gets called -- treat it as a security incident, not a normal tool result

2026-07-06382

codeql-audit

deonmenezes/mantishack

Build a CodeQL database and run dataflow-backed query-suite analysis via the mantis_codeql MCP server

2026-07-06382

detection-breadth

deonmenezes/mantishack

When and how to reach for the companion detectors -- bandit (Python SAST) and trivy (deps + secrets + IaC misconfig) -- alongside the core semgrep/CodeQL/osv/trufflehog toolchain

2026-07-06382

findings-spine

deonmenezes/mantishack

Record and advance every vulnerability finding through the tool-owned mantis_findings service instead of tracking findings in prose

2026-07-06382

http-evidence

deonmenezes/mantishack

Turn a captured HTTP request/response into a bounded, redacted evidence pack with a stable request-ref using the mantis_http_audit MCP server, instead of pasting raw traffic into a finding

2026-07-06382

mantis-pipeline

deonmenezes/mantishack

The master Mantis playbook -- how to run an authorized vulnerability-discovery engagement end to end, which subagent owns each stage, which MCP tool feeds it, and how findings move through the tool-owned lifecycle

2026-07-06382

name	secrets-scan
description	Run trufflehog via the mantis_trufflehog MCP server and handle secret findings without ever exposing the raw secret

Use trufflehog_scan({ path, only_verified }) (mantis_trufflehog MCP server) for the Detect stage's secrets coverage.

The server already redacts every secret value before it reaches you (redacted_secret is a masked preview, never the full value). Never try to reconstruct, print, or echo the full secret elsewhere -- e.g. don't re-read the source line containing it and paste it into a report just because the tool redacted its own output.
verified: true means trufflehog live-checked the credential against its provider and it's currently active -- treat this as a near-confirmed finding with severity driven by what the credential can access. verified: false is a candidate (pattern-matched but not live-checked, could be a dead/rotated key or a false-positive-looking test fixture).
Remediation for any verified secret is always: rotate/revoke the credential at the provider, then remove it from source (and consider it compromised in git history even after removal -- flag that separately, since simply deleting the line does not purge history).
Set only_verified: true when you specifically want to cut noise from test fixtures and example keys; leave it off for full recall during an initial sweep.