maisecrets menu

maisecrets / Python library

The detection core as a Python library

The plugin finds secrets and personal data with rules. The same rules are on PyPI as a library, so you can use them in your own code: in a log pipeline, before an export, or before you send text to a model.

Install

pip install maisecrets

The library needs Python 3.9 or later and no other package. License: Apache-2.0.

Example

from maisecrets.detection import Active, Detector, Host, NO_REFERENCES, NO_SOURCES

d = Detector(
    regions=Active(regions=("generic", "de"), languages=("en", "de"), source="mine"),
    sources=NO_SOURCES,
    references=NO_REFERENCES,
    host=Host(user="me", year=2026),
)
text = open("app.log", encoding="utf-8").read()
for m in d.findings(text, channel="tool"):
    print(m.type, m.kind, m.start, m.end)     # e.g. SECRET gitlab-pat 120 146

A detector with these four arguments reads nothing of the computer it runs on: no home folder, no config. Each finding has its type, its kind and its position in the text. The arguments, the regions and the fields of a finding: DETECTION.md.

What it finds, and what it does not

  • Secrets: API keys and tokens of many vendors, private keys, passwords and keys after a label, credentials in URLs and connection strings.
  • Personal data (89 types): e-mail addresses, phone numbers, cards, bank accounts, national ID and tax numbers of the regions you activate, names and addresses after a label.

It finds by rules, not by a model. It leaves documented test values alone, such as a test card or an address at example.com. It misses what no rule describes, most of all a name without a label. The details and the measured recall: What it detects and What it does not protect.

What the package holds

The wheel holds the detection core only: maisecrets/__init__.py, py.typed and maisecrets/detection with its rules and the licenses of the rule sources. The hooks of the plugin, the local vault and the keychain access are not in it.

The library opens a network connection only if you ask for it. The optional RemoteDetector sends text to a name service that you run. By default it accepts only a loopback address or a Unix socket, and the service never sees a value that the rules found.

Which one for which job

You want to protectUse
Your own sessions in Claude Code or Codex, on your computerthe maisecrets plugin
The company tools that a team connects to its AIthe mcpgate gateway
Text in your own program or pipelinethe library from PyPI