Scan and redact secrets
before they leave your machine
The CleanMyPrompt CLI detects API keys, tokens, and PII in any file — and fixes them in one command. Works in your terminal, git hooks, CI/CD pipelines, and LLM preprocessing workflows.
npm install -g cleanmypromptFive commands. That's it.
No config files, no YAML, no cloud account required.
cmp scan <file>Detect secrets, API keys, and PII. Outputs a findings table with severity levels.
cmp fix <file>Redact detected values in-place. Replaces secrets with labeled placeholders like [OPENAI-KEY].
cmp squeeze <file>Compress tokens by removing comments, unused imports, and whitespace. Cuts costs by 40–50%.
cmp install-hookInstall a git pre-commit hook in the current repo. Blocks commits containing secrets.
cmp uninstall-hookRemove the pre-commit hook from the current repo.
What gets detected
Three priority tiers. When a HIGH finding overlaps a LOW one, HIGH always wins — no false positives.
- OpenAI keys (sk-...)
- Anthropic keys (sk-ant-...)
- Google AI, AWS, GitHub tokens
- Stripe, Twilio, Slack API keys
- Private key PEM headers
- Generic bearer tokens
- Email addresses
- US phone numbers
- Social Security Numbers
- Credit card numbers
- IBANs
- Hardcoded variable assignments
- process.env.SECRET = "..."
- api_key = "value"
Where it fits your workflow
Drop it into the places where secrets most commonly leak.
Git Pre-Commit Hook
Automatically blocks commits containing secrets. No configuration — one command installs it.
cmp install-hookCI/CD Pipeline
Run scans in GitHub Actions with SARIF output. Findings appear as code scanning alerts on PRs.
cmp scan src/ --format sarif > results.sarifLLM Context Prep
Redact then squeeze before sending files as context to any LLM. Fewer tokens, no leaked secrets.
cmp fix context.ts && cmp squeeze context.tsDebug Log Sanitization
Scan logs and config dumps before sharing with your team or pasting into AI assistants.
cmp fix debug.log && cat debug.logToken Squeeze: cut LLM costs by 50%
The cmp squeeze command removes comments, strips unused imports, collapses whitespace, and deduplicates repeated blocks. A typical TypeScript file goes from 2,847 tokens to 1,391 — a 51% reduction. At scale in a CI pipeline, this pays back the install in the first hour.
cmp squeeze context.ts --level aggressive --verboseGitHub Actions — SARIF Integration
Secrets findings appear as code scanning alerts on pull requests — visible inline, no dashboard required.
# .github/workflows/secrets-scan.yml
name: Secrets Scan
on: [push, pull_request]
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install CleanMyPrompt CLI
run: npm install -g cleanmyprompt
- name: Scan for secrets
run: cmp scan src/ --format sarif > results.sarif
- name: Upload SARIF to GitHub
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: results.sarifLicensing
- Individual developers
- Open-source projects
- Personal CI/CD pipelines
- Learning and experimentation
- Use in a commercial product or service
- Team or org-wide CI/CD deployment
- Bundled in a paid offering