I built a secret scanner that tries to answer “is this secret actually live?"

I’ve been building SecretLoop, and it’s now available in Preview on Open VSX. The problem I was trying to solve is pretty simple. You run a secret scanner and get: “Found an API key.” Cool. But then what? Is it still active? Was it already revoked? Is it buried somewhere in Git history? Do I need to rotate it? And how do I actually remove it without manually hunting through the code? SecretLoop is built around this flow: Detect → Verify → Remediate What it does Scans your working tree, staged files and Git history Uses 100+ provider rules + entropy detection Can verify supported credentials against their provider to determine whether they're currently live Shows findings directly in VS Code Provides quick fixes to redact a secret or move it to .env Supports rotation where the provider API allows it Includes pre-commit and CI/SARIF support Has an MCP server for AI coding agents The MCP part was particularly important to get right. SecretLoop doesn't have an LLM inside it. The scanner produces deterministic findings; the AI assistant can explain and work with those findings. Credential values are always redacted in MCP responses, and verification is opt-in and requires explicit human approval before a credential is sent to its provider. You can try it without installing anything: npx secretloop scan Or scan Git history: npx secretloop history For CI: npx secretloop scan --format sarif -o results.sarif Open VSX: SecretLoop – Open VSX GitHub: SecretLoop on GitHub It's still early/Preview, so I'm much more interested in feedback than downloads. If you use gitleaks, TruffleHog, GitGuardian, GitHub Secret Scanning, etc., I'd especially love to know: What happens after your scanner finds a secret? That's the part I'm trying to improve.