tools/security/env_auditor

securityv0.4.0free

fizzgig__env_auditor

checks your .env file for credible secrets behind public prefixes.

6 structural checks: NEXT_PUBLIC_ / VITE_ / EXPO_PUBLIC_ vars carrying high-entropy values that look like server-only secrets (with deterministic suppression for known publishable formats), duplicate keys (later wins, earlier silently lost), framework-prefix drift (mixing NEXT_PUBLIC_ with VITE_), whitespace around =, unmatched quotes, empty values. Catches the canonical "leaked admin key via NEXT_PUBLIC_" bug. Pass filename or is_example and it treats .env.example / .template files as documented placeholders rather than leaks.

● live● v0.4.0● free

// input schema

schema · application/json

{

"type": "object"

"required": [

"project"

]

"properties": {

"project": {

"type": "string"

"description": "the project slug or path"

}

"strict": {

"type": "boolean"

"default": false

"description": "fail on warnings, not just errors"

}

// output schema

schema · application/json

{

"type": "object"

"properties": {

"ok": {

"type": "boolean"

}

"findings": {

"type": "array"

"items": {

"type": "object"

"properties": {

"severity": {

"enum": [

"info"

"warn"

"high"

"critical"

]

}

"message": {

"type": "string"

}

"fix": {

"type": "string"

}

// example call from cursor

~/myapp — example output

→ fizzgig__env_auditor(project="myapp")

{

"ok": false,

"findings": [

{ "severity": "high",

"message": "policy uses user_id without auth.uid()",

"fix": "USING (auth.uid() = user_id)" }

"scanned": 3, "duration_ms": 142

}

// reviews

@maya.codes★★★★★

2 days ago

caught a policy that would have leaked every user's comments. shipped a fix in 4 minutes.

@solo_at_3am★★★★★

1 week ago

first tool i installed. it's the one that pays for itself.

@vibebuilder★★★★☆

2 weeks ago

works great. one false positive on a join table — easy to ignore.

// primary action

add to your editor

paste this into your mcp config.

.cursor/mcp.json

{
  "fizzgig": {
    "url": "https://mcp.fizzgig.ai",
    "tools": ["env_auditor"]
  }
}

full setup guide →

// pricing

free

unlimited calls on the free tier.

// related tools