Sign in
Ciphra

Run Ciphra. Get proof. Fix what's exposed.

02 · detect, fix, watch

Detect

Scan your code and built bundles for API keys. Every detection is validated against the live service.

Fix

ciphra harden applies reversible, stack-aware patches. Beta for Next.js + Supabase at launch.

Coming soon

Watch

Continuous monitoring of deployed sites. Coming after launch.

How it works

  1. 1.Install the CLI and optionally the MCP server. It runs entirely on your machine.
  2. 2.Runciphra scanin any project. Findings appear in seconds.
  3. 3.Sign up for the dashboard to track findings across projects and teams. Optional.
Sign in
03 · setup

Install once. Scan anywhere.

Runs locally. Sends redacted findings only when you add a dashboard key.

CLI
npm install -g ciphra
ciphra scan .
Cursor
~/.cursor/mcp.json
{
  "mcpServers": {
    "ciphra": {
      "command": "uvx",
      "args": ["ciphra-mcp"]
    }
  }
}
Claude Code
~/.claude.json
{
  "mcpServers": {
    "ciphra": {
      "command": "uvx",
      "args": ["ciphra-mcp"]
    }
  }
}
04 · receipt preview

Stripe key confirmed live.

service
Stripe
validation
Live secret detected
location
apps/api/billing.ts:42
next step
Rotate the key. Move it server-side. Scan again.
ciphra receipt · validated · 0.41s
$ ciphra scan .

warn: STRIPE_SECRET_KEY found in client bundle

service: Stripe
status: live key confirmed
file: apps/api/billing.ts:42

fix: rotate, move server-side, scan again
05 · pricing and faq

Pricing

Free during beta. Team and Compliance tiers coming after launch.

Solo: free, open source CLI + MCP, dashboard with generous limits.

Team: paid, multiple projects, GitHub App, Slack notifications.

Compliance: custom pricing, SSO, SOC 2 / HIPAA evidence pack, private-VPC dashboard.

FAQ

Does Ciphra send my source code anywhere?

No. The CLI runs on your machine. Only redacted findings and metadata are sent to the dashboard, and only if you add a CIPHRA_API_KEY.

How is this different from TruffleHog or GitLeaks?

Ciphra validates findings against the live service, scans built bundles where keys actually ship, and exposes itself as an MCP server for coding agents.

What does it cost?

Free during beta. Solo stays free after launch; Team and Compliance pricing will be announced later.