Credentials Python Packages

ggshield

Detect and validate 500+ types of hardcoded secrets with advanced checks. Use it as a pre-commit hook, GitHub Action, or CLI for proactive secret detection and security.

kingfisher-bin

Detect secrets + live validation. Map blast radius. Revoke fast. Use the CLI or embed in Rust and Python.

trufflehog

Find, verify, and analyze leaked credentials

rds-proxy-password-rotation

Python script to rotate the RDS credentials using a separate credential for the application.

tools-registry

OpenRouter for agent tools. Join community here: https://discord.gg/6mQYYfFMAn

pepperize-cdk-ses-smtp-credentials

Generate SES smtp credentials for a given user and store the credentials in a SecretsManager Secret.

boto3-refresh-session

A drop-in replacement for boto3.Session named RefreshableSession. It automatically refreshes temporary AWS credentials, caches clients, and natively supports MFA providers. It also supports automatic temporary AWS security credential refresh for STS, IOT Core, and custom credential callables.

credsweeper

CredSweeper is a tool to detect credentials in any directories or files. CredSweeper could help users to detect unwanted exposure of credentials (such as token, passwords, api keys etc.) in advance. By scanning lines, filtering, and using AI model as option, CredSweeper reports lines with possible credentials, where the line is, and expected type o

whispers

Identify hardcoded secrets in static structured text (version 2)

click-creds

Pluggable credentials storage and management for click CLI apps

kingfisher-secret-scanner

Detect secrets + live validation. Map blast radius. Revoke fast. Use the CLI or embed in Rust and Python.

credbox

A leak-safe secret store for Python apps and CLIs. Secrets come back as a masking Secret you reveal() at the point of use; stored in a hardened atomic-0600 file (XDG by default, OS-native on request), with opt-in OS keyring and Argon2id+AES-GCM backends. Zero-dependency core.

vamp-secrets-scanner

Static secrets scanner — 271 patterns across 9 YAML rule files (cloud, AI APIs, CI/CD, SaaS, hardware, web3), git history, Docker, K8s, SARIF, --delta

qso-graph-auth

Persona and credential management for qso-graph MCP servers

afp-cli

CLI for the AWS Federation Proxy

dbeaver-creds

Decrypt DBeaver's credentials-config.json file and display the output (a JSON string).

notenv

Encrypted .env replacement: secrets encrypted client-side, stored on storage you already own, injected into your process.

ranbval-sdk

Secrets that refuse to be stolen. Sealed API keys that decrypt only on your allowlisted repo — and raise a security error if anything tries to print, iterate, or read them. Every access attempt alerts the owner.

chiasmodon

Chiasmodon is an OSINT tool designed to assist in the process of gathering information about a target domain. Its primary functionality revolves around searching for domain-related data, including domain emails, domain credentials, CIDRs , ASNs , and subdomains, the tool also allows users to search Google Play application ID.

tokenstash

Your AI agent needs your API keys. It doesn't need to see them. tokenstash writes keys straight into .env.local for Claude Code, Codex, Cursor and Gemini CLI. Paste each key once, in your browser, never in the chat.

honeypots

30 different honeypots in one package! (dhcp, dns, elastic, ftp, http proxy, https proxy, http, https, imap, ipp, irc, ldap, memcache, mssql, mysql, ntp, oracle, pjl, pop3, postgres, rdp, redis, sip, smb, smtp, snmp, socks5, ssh, telnet, vnc)

testisolation

Uncompromising test isolation: your tests structurally cannot touch your real files, secrets, or git identity -- First-class support for Go, Python with pytest, and TypeScript with Node

stricttest

Uncompromising test isolation: your tests structurally cannot touch your real files, secrets, or git identity -- First-class support for Go, Python with pytest, and TypeScript with Node

vibemaxxing

Multi-account manager and usage dashboard for Claude Code