GitHub Expands Secret Scanning with General Availability of MCP Server Integration

GitHub Expands Secret Scanning with General Availability of MCP Server Integration - InfoQ

Your choice regarding cookies on this site

We use cookies to optimise site functionality and give you the best possible experience.

I Accept I Do Not Accept Settings

[BT](https://www.infoq.com/int/bt/ "bt")

InfoQ Software Architects' Newsletter

A monthly overview of things you need to know as an architect or aspiring architect.

View an example

Enter your e-mail address

Select your country - [x] I consent to InfoQ.com handling my data as explained in this Privacy Notice.

We protect your privacy.

Close

Live Webinar and Q&A: Designing Data Layers for Agentic AI: Patterns for State, Memory, and Coordination at Scale (May 12, 2026)Save Your Seat

Close

Toggle Navigation

Facilitating the Spread of Knowledge and Innovation in Professional Software Development

English edition

• English edition
• Chinese edition
• Japanese edition
• French edition

[Write for InfoQ](https://www.infoq.com/write-for-infoq/ "Write for InfoQ")

Search

RegisterSign in

Unlock the full InfoQ experience

Unlock the full InfoQ experience by logging in! Stay updated with your favorite authors and topics, engage with content, and download exclusive resources.

Log In

or

Don't have an InfoQ account?

Register

• Stay updated on topics and peers that matter to youReceive instant alerts on the latest insights and trends.
• Quickly access free resources for continuous learningMinibooks, videos with transcripts, and training materials.
• Save articles and read at anytimeBookmark articles to read whenever youre ready.

Logo - Back to homepage

NewsArticlesPresentationsPodcastsGuides

Topics

[Development](https://www.infoq.com/development/ "Development")

• [Java](https://www.infoq.com/java/ "Java")
• [Kotlin](https://www.infoq.com/kotlin/ "Kotlin")
• [.Net](https://www.infoq.com/dotnet/ ".Net")
• [C#](https://www.infoq.com/c_sharp/ "C#")
• [Swift](https://www.infoq.com/swift/ "Swift")
• [Go](https://www.infoq.com/golang/ "Go")
• [Rust](https://www.infoq.com/rust/ "Rust")
• [JavaScript](https://www.infoq.com/javascript/ "JavaScript")

Featured in Development

• #### From VR to Flat Screens: Bridging the Input and Immersion Gap

Dany Lepage discusses the architectural journey of porting a hit VR title to seven non-VR platforms. He explains how his team solved the challenges of cross-progression, diverse input paradigms, and maintaining release velocity across Steam, iOS, and PlayStation. Beyond the tech, he shares candid lessons on the "product fit" gap when translating immersive social presence to 2D screens.


All in developmentFollow Topic

[Architecture & Design](https://www.infoq.com/architecture-design/ "Architecture & Design")

• [Architecture](https://www.infoq.com/architecture/ "Architecture")
• [Enterprise Architecture](https://www.infoq.com/enterprise-architecture/ "Enterprise Architecture")
• [Scalability/Performance](https://www.infoq.com/performance-scalability/ "Scalability/Performance")
• [Design](https://www.infoq.com/design/ "Design")
• [Case Studies](https://www.infoq.com/Case_Study/ "Case Studies")
• [Microservices](https://www.infoq.com/microservices/ "Microservices")
• [Service Mesh](https://www.infoq.com/servicemesh/ "Service Mesh")
• [Patterns](https://www.infoq.com/DesignPattern/ "Patterns")
• [Security](https://www.infoq.com/Security/ "Security")

Featured in Architecture & Design

• #### Stripe’s Docdb: How Zero-Downtime Data Movement Powers Trillion-Dollar Payment Processing

Jimmy Morzaria discusses the evolution of Stripe’s database tier to support 5 million QPS with 5.5 nines of reliability. He explains the architecture of DocDB and shares how Stripe leverages a custom zero-downtime data movement platform to perform horizontal sharding, version upgrades, and multi-tenant migrations - all while maintaining the strict consistency required for global commerce.


All in architecture-designFollow Topic

[AI Infrastructure](https://www.infoq.com/ai-ml-data-eng/ "AI Infrastructure")

• [Big Data](https://www.infoq.com/bigdata/ "Big Data")
• [Machine Learning](https://www.infoq.com/machinelearning/ "Machine Learning")
• [NoSQL](https://www.infoq.com/nosql/ "NoSQL")
• [Database](https://www.infoq.com/database/ "Database")
• [Data Analytics](https://www.infoq.com/data-analytics/ "Data Analytics")
• [Streaming](https://www.infoq.com/streaming/ "Streaming")

Featured in AI, ML & Data Engineering

• #### Time-Series Storage: Design Choices That Shape Cost and Performance

Every time-series database makes a set of storage design decisions: how to lay out rows, when to compress, what to partition on. These decisions determine cost and query performance more than the choice of database itself. This article works through those fundamentals from first principles, using widely available tools like PostgreSQL and Apache Parquet to make each trade-off measurable.


All in ai-ml-data-engFollow Topic

[Culture & Methods](https://www.infoq.com/culture-methods/ "Culture & Methods")

• [Agile](https://www.infoq.com/agile/ "Agile")
• [Diversity](https://www.infoq.com/diversity/ "Diversity")
• [Leadership](https://www.infoq.com/leadership/ "Leadership")
• [Lean/Kanban](https://www.infoq.com/lean/ "Lean/Kanban")
• [Personal Growth](https://www.infoq.com/personal-growth/ "Personal Growth")
• [Scrum](https://www.infoq.com/scrum/ "Scrum")
• [Sociocracy](https://www.infoq.com/sociocracy/ "Sociocracy")
• [Software Craftmanship](https://www.infoq.com/software_craftsmanship/ "Software Craftmanship")
• [Team Collaboration](https://www.infoq.com/team-collaboration/ "Team Collaboration")
• [Testing](https://www.infoq.com/testing/ "Testing")
• [UX](https://www.infoq.com/ux/ "UX")

Featured in Culture & Methods

• #### The AI Joy Gap: Why Some Developers Thrive While Others Struggle

In this podcast, Shane Hastie, Lead Editor for Culture & Methods, spoke to Michael Parker, VP of Engineering at TurinTech AI, about bringing joy back to software development in the AI era, the emerging role of "factory architects" who orchestrate AI agents rather than write code directly, and the cultural divide between AI hype and the reality developers face on legacy codebases.


All in culture-methodsFollow Topic

DevOps

• [Infrastructure](https://www.infoq.com/infrastructure/ "Infrastructure")
• [Continuous Delivery](https://www.infoq.com/continuous_delivery/ "Continuous Delivery")
• [Automation](https://www.infoq.com/automation/ "Automation")
• [Containers](https://www.infoq.com/containers/ "Containers")
• [Cloud](https://www.infoq.com/cloud-computing/ "Cloud")
• [Observability](https://www.infoq.com/observability/ "Observability")

Featured in DevOps

• #### Evolution of a Backend for a Streaming Application

Daniele Frasca explains the architectural evolution of Joyn, a German streaming giant. He discusses moving from fragile single-node setups to resilient serverless architectures using AWS. He shares insights on the Hub and Spoke pattern for data consistency, cell-based isolation to reduce blast radius, and cost-optimization strategies for achieving affordable multi-region active-active setups.


All in devopsFollow Topic

[Events](https://events.infoq.com/ "Events")

Helpful links

• [About InfoQ](https://www.infoq.com/about-infoq "About InfoQ")
• [InfoQ Editors](https://www.infoq.com/infoq-editors "InfoQ Editors")
• [Write for InfoQ](https://www.infoq.com/write-for-infoq "Write for InfoQ")
• [About C4Media](https://c4media.com/ "About C4Media")
• [Diversity](https://c4media.com/diversity "Diversity")

Choose your language

• [En](https://www.infoq.com/news/2026/05/github-mcp-secret-scanning/# "InfoQ English")
• 中文
• 日本
• Fr


[InfoQ Homepage](https://www.infoq.com/ "InfoQ Homepage")[News](https://www.infoq.com/news "News")GitHub Expands Secret Scanning with General Availability of MCP Server Integration

[DevOps](https://www.infoq.com/Devops/ "DevOps")

QCon San Francisco (Nov 16-20): Deep technical sessions. Peer conversations that change how you think.

GitHub Expands Secret Scanning with General Availability of MCP Server Integration

May 12, 2026 3 min read

by

• Craig Risi

Follow Software Architect | Game Designer| Writer | Speaker

#### Write for InfoQ

Feed your curiosity.Help 550k+ global

senior developers

each month stay ahead.Get in touch

Log in to listen to this article

Loading audio

Your browser does not support the audio element.

0:00 0:00

Normal 1.25x 1.5x

Like

• Reading list

GitHub has announced the general availability of secret scanning support through its MCP Server, extending automated credential detection and remediation capabilities into AI-assisted and agent-driven development workflows. The update is designed to help organizations identify exposed secrets - such as API keys, tokens, and credentials - earlier in the software lifecycle, while enabling AI tools and external systems to interact with GitHub security findings in a more structured and automated way.

The release reflects a growing industry focus on securing AI-enhanced software delivery pipelines, where autonomous agents and AI coding assistants increasingly generate, modify, and interact with source code at scale. By integrating secret scanning capabilities with the MCP Server, GitHub is enabling external tools and AI-driven workflows to programmatically access security insights, automate remediation processes, and incorporate credential protection directly into development automation.

Secret exposure remains one of the most common and dangerous security risks in modern software development. Credentials accidentally committed to repositories can provide attackers with direct access to production systems, cloud environments, and sensitive services. GitHub's secret scanning technology already detects leaked credentials across repositories, but the MCP Server integration expands this capability into machine-consumable workflows, allowing AI agents and automation platforms to respond to findings in real time.

This is particularly important as organizations adopt AI coding tools that can rapidly generate large amounts of code and configuration. While these tools accelerate development, they also increase the risk of unintentionally introducing secrets into repositories or pipelines. GitHub's latest update positions secret scanning not just as a developer feature, but as a foundational component of AI-aware DevSecOps practices.

The MCP Server integration allows external systems to interact with secret scanning alerts programmatically, enabling workflows such as automated alert triage, remediation recommendations, and policy enforcement. Rather than relying solely on developers to manually review findings, organizations can now integrate security responses directly into CI/CD pipelines, orchestration systems, and AI agents.

This reflects a broader evolution in application security, where tooling is shifting from passive detection toward continuous, automated governance. Security systems are increasingly expected not only to identify risks but also to provide context, coordinate responses, and operate seamlessly within automated engineering environments.

GitHub's announcement comes amid rising concern over credential leakage in public and private repositories. As AI-generated code becomes more prevalent, security researchers and platform providers have warned that secrets management is becoming more complex, particularly when AI systems interact with infrastructure, APIs, and deployment pipelines autonomously.

Other major platforms are responding similarly. GitLab has expanded its own secret detection capabilities within CI/CD pipelines, while tools such as Snyk and TruffleHog focus on continuously scanning repositories and developer workflows for exposed credentials. Meanwhile, cloud providers, includingAmazon Web Services andGoogle Cloud continue to invest in tighter integrations between secrets management systems and development tooling to reduce accidental exposure. Across the industry, the trend is clear: secrets management is evolving from a standalone security function into an integrated part of automated software delivery.

The broader significance of the release lies in its support for the transition toward agentic and AI-native development environments. As AI systems become active participants in coding, deployment, and operations workflows, platforms must ensure that security controls are equally automated, observable, and machine-readable.

By making secret scanning accessible through the MCP Server, GitHub is laying the groundwork for a future in which AI agents can not only write and modify code but also understand and respond to security risks as part of their normal operations. The move underscores a growing realization across the industry: in highly automated development ecosystems, security tooling must evolve into an autonomous participant in the software lifecycle, not just an after-the-fact checkpoint.

About the Author

#### Craig Risi

Craig Risi is a man of many talents but has no sense of how to use them. He could be out changing the world but prefers to make software instead. He possesses a passion for software design, but more importantly software quality and designing systems in a technically diverse and constantly evolving tech world. Craig is also the writer of the book, Quality By Design: Designing Quality Software Systems, and writes regular articles on his blog sites and various other tech sites around the world. When not playing with software, he can often be found writing, designing board games, or running long distances for no apparent reason.

Show more Show less

#### This content is in the DevOps topic

Follow Topic

##### Related Topics:

• DevOps### DevOps

Followers: 5069

Follow Topic

• Model Context Protocol (MCP)### Model Context Protocol (MCP)

Followers: 32

Follow Topic

• Application Security### Application Security

Followers: 90

Follow Topic

• github### github

Followers: 40

Follow Topic

* #### Popular in DevOps

• ##### Cloudflare Announces Agent Memory, a Managed Persistent Memory Service for AI Agents

• ##### Cloudflare Introduces Flagship: an Edge-Native Feature Flag Service Built on OpenFeature

• ##### Grafana's Kubernetes Monitoring Helm Chart v4 Brings Multiple Fixes

• ##### MySQL 9.7: First Major LTS Since 8.4 Brings Enterprise Features to Community Edition

• ##### How GitHub Is Securing Agentic Workflows in Modern CI CD Systems

* #### Related Sponsors

• ##### The Case for Real-Time Threat Monitoring and Analysis in Modern Mobile App Security

• ##### Does your AI stack need a session layer? A maturity framework for teams building AI agents

• ##### How an AI Agent Deleted Production Data and Its Backups at a Company (and How to Protect Yours)

• ##### Understanding AI Agent Security

• ##### Harder, Better, Prompter, Stronger: AI system prompt hardening

* #### Related Sponsor


• June 11, 2026, 10 AM EDT

##### Rethinking AppSec: Why Compiler‑Level Security Changes the Architecture Conversation

Presented by: Anton Baranenko - Product Manager at Guardsquare

SPONSORED BY GUARDSQUARE Save your seat

Related Content

• ##### GitHub Enhances CodeQL with Declarative Security Modeling for Faster, More Flexible Analysis

May 05, 2026

• ##### GitHub Targets Large Merge Problem with Stacked PRs

Apr 29, 2026

• ##### GitHub Uses eBPF to Eliminate Deployment Risks and Prevent Circular Failures

Apr 28, 2026

• ##### Dropbox Collaborates with GitHub to Reduce Monorepo Size from 87GB to 20GB

Apr 22, 2026

• ##### GitHub Acknowledges Recent Outages, Cites Scaling Challenges and Architectural Weaknesses

Apr 21, 2026

• ##### Anthropic Introduces Agent-Based Code Review for Claude Code

Apr 17, 2026

• ##### Attacker Bought 30 WordPress Plugins on Flippa and Backdoored All of Them

May 06, 2026

• ##### Meta's Approach to Migrating their Systems to Post-Quantum Cryptography

Apr 30, 2026

• ##### DBmaestro MCP Server Puts Natural Language in Control of Database Pipelines

Apr 30, 2026

Related Sponsors

• #### Why APIs Can’t Trust Clients—and How to Bridge the Gap

Modern apps rely on APIs but can’t trust clients running in hostile environments. This report shows how to bridge client-side protections and server-side API trust by propagating integrity signals into backend security decisions.

• #### Rethinking AppSec: Why Compiler‑Level Security Changes the Architecture Conversation (Live Webinar Jun 11th) - Save Your Seat

Security bolted on after the build process adds fragility and blind spots. Embedding protection at compile time improves performance and resilience. This session compares wrapper, runtime, and compiler approaches to help you choose where security belongs in your SDLC.

• Sponsored by


Related Content

• ##### HashiCorp Vault 2.0 Marks Shift to IBM Lifecycle with New Identity Federation

Apr 24, 2026

• ##### Cloudflare Outlines MCP Architecture as Enterprises Confront Security and Governance Risks

Apr 22, 2026

• ##### CodeGuardian: a Model Context Protocol Server for AI-Assisted Code Quality Analysis and Security Scanning

Apr 28, 2026 

• ##### AWS Launches Agent Registry in Preview to Govern AI Agent Sprawl across Enterprises

Apr 17, 2026

• ##### Cloudflare Launches Code Mode MCP Server to Optimize Token Usage for AI Agents

Apr 16, 2026

• ##### New Rowhammer Attacks on NVIDIA GPUs Enable Full System Takeover

Apr 14, 2026

**The InfoQ** Newsletter

A round-up of last week’s content on InfoQ sent out every Tuesday. Join a community of over 250,000 senior developers. View an example

Enter your e-mail address

Select your country - [x] I consent to InfoQ.com handling my data as explained in this Privacy Notice.

We protect your privacy.

• Development

• ##### [Cangjie, a New Open-Source Compiled Language with Native Effect Handlers and Algebraic Data Types](https://www.infoq.com/news/2026/05/cangjie-effect-handlers-adt/ "Cangjie, a New Open-Source Compiled Language with Native Effect Handlers and Algebraic Data Types")

• ##### [Attacker Bought 30 WordPress Plugins on Flippa and Backdoored All of Them](https://www.infoq.com/news/2026/05/wordpress-plugins-supply-chain/ "Attacker Bought 30 WordPress Plugins on Flippa and Backdoored All of Them")

• ##### [Cloudflare Introduces Flagship: an Edge-Native Feature Flag Service Built on OpenFeature](https://www.infoq.com/news/2026/05/cloudflare-flagship-openfeature/ "Cloudflare Introduces Flagship: an Edge-Native Feature Flag Service Built on OpenFeature")

• Architecture & Design

• ##### [Netflix Serves 84% of Query Results from Cache with Interval-Aware Caching in Apache Druid](https://www.infoq.com/news/2026/05/netflix-druid-interval-cache/ "Netflix Serves 84% of Query Results from Cache with Interval-Aware Caching in Apache Druid")

• ##### [How GitHub Is Securing Agentic Workflows in Modern CI CD Systems](https://www.infoq.com/news/2026/05/github-agentic-workflows/ "How GitHub Is Securing Agentic Workflows in Modern CI CD Systems")

• ##### [OpenAI Introduces Websocket-Based Execution Mode to Reduce Latency in Agentic Workflows](https://www.infoq.com/news/2026/05/openai-websocket-responses-api/ "OpenAI Introduces Websocket-Based Execution Mode to Reduce Latency in Agentic Workflows")

• Culture & Methods

• ##### [The AI Joy Gap: Why Some Developers Thrive While Others Struggle](https://www.infoq.com/podcasts/some-developers-thrive-while-others-struggle/ "The AI Joy Gap: Why Some Developers Thrive While Others Struggle")

• ##### [Applying Best Simple System for Now for Software Design](https://www.infoq.com/news/2026/05/best-simple-system-design/ "Applying Best Simple System for Now for Software Design")

• ##### [The Human Scalability Problem: Why Your Teams Don’t Scale Like Your Code](https://www.infoq.com/presentations/human-scalability/ "The Human Scalability Problem: Why Your Teams Don’t Scale Like Your Code")

• AI, ML & Data Engineering

• ##### [Time-Series Storage: Design Choices That Shape Cost and Performance](https://www.infoq.com/articles/time-series-storage-design/ "Time-Series Storage: Design Choices That Shape Cost and Performance")

• ##### [Coder Agents Enable Running AI Coding Workflows on Self-Hosted Infrastructure](https://www.infoq.com/news/2026/05/coder-agents-self-hosted-ai/ "Coder Agents Enable Running AI Coding Workflows on Self-Hosted Infrastructure")

• ##### [Netflix Introduces ‘Model Lifecycle Graph’ to Scale Enterprise Machine Learning](https://www.infoq.com/news/2026/05/netflix-ml-graph/ "Netflix Introduces ‘Model Lifecycle Graph’ to Scale Enterprise Machine Learning")

• DevOps

• ##### [GitHub Expands Secret Scanning with General Availability of MCP Server Integration](https://www.infoq.com/news/2026/05/github-mcp-secret-scanning/ "GitHub Expands Secret Scanning with General Availability of MCP Server Integration")

• ##### [Copy Fail and Dirty Frag: Linux Page-Cache Exploits Target Every Major Distribution](https://www.infoq.com/news/2026/05/copy-fail-dirty-frag-linux/ "Copy Fail and Dirty Frag: Linux Page-Cache Exploits Target Every Major Distribution")

• ##### [Evolution of a Backend for a Streaming Application](https://www.infoq.com/presentations/streaming-application-aws-infrastructure/ "Evolution of a Backend for a Streaming Application")

**The InfoQ** Newsletter

A round-up of last week’s content on InfoQ sent out every Tuesday. Join a community of over 250,000 senior developers. View an example

• Get a quick overview of content published on a variety of innovator and early adopter technologies
• Learn what you don’t know that you don’t know
• Stay up to date with the latest information from the topics you are interested in

Enter your e-mail address

Select your country - [x] I consent to InfoQ.com handling my data as explained in this Privacy Notice.

We protect your privacy.

**ONLINE INFOQ CERTIFICATION PROGRAM** A Cohort for Senior Engineers and Architects * **Focused on ARCHITECTURE** with Luca Mezzalira | JUNE 10 * **Focused on AI ENGINEERING** with Hien Luu | JULY 25 Bring a real architecture or AI engineering challenge from your work. Spend 5 weeks pressure-testing your approach with senior peers from other companies and experienced facilitators. Explore the upcoming cohorts. **Register Now.**

#### Events

• ##### QCon AI Boston

June 1-2, 2026

• ##### Online InfoQ Architect Certification

June 10, 2026

• ##### Online InfoQ AI Engineering Certification

July 25, 2026

• ##### QCon San Francisco

November 16-20, 2026

#### Follow us on

Youtube 232K FollowersLinkedin 26K FollowersInstagram NewRSS 19K ReadersX 57.1k FollowersFacebook 21K LikesBluesky New

#### Stay in the know

The InfoQ PodcastEngineering Culture PodcastThe Software Architects' Newsletter

General Feedback [feedback@infoq.com](mailto:feedback@infoq.com) Advertising [sales@infoq.com](mailto:sales@infoq.com) Editorial [editors@infoq.com](mailto:editors@infoq.com) Marketing [marketing@infoq.com](mailto:marketing@infoq.com)

InfoQ.com and all content copyright © 2006-2026 C4Media Inc.

Privacy Notice, Terms And Conditions, Cookie Policy

Close

[BT](https://www.infoq.com/int/bt/ "bt")