Klarion · LLM Mart

Name: Klarion
Author: LLM Mart

No install snippet on purpose. A working MCP config is a command, its arguments and an environment block — the last two are where API keys live, so this catalogue never stores them and cannot publish them. Follow the link above for the authors' own instructions.

Install · Use it · Results · How it works · Reference

Klarion finds secrets in your code: API keys, passwords and tokens.

It works in two steps:

Find. Fast local checks flag anything that looks like a secret.
Check. An AI model reads each one with the code around it and decides if it is real.

Pattern scanners stop at step 1, so they also flag test values, IDs and hashes. Klarion shows you the real leaks.

$ klarion scan .

services/billing/client.py
  [critical] stripe-secret-key  39:18  sk_l****4bQx
    verdict: secret (confidence 0.96)
    | stripe.api_key = "sk_l****4bQx"

Summary: 1 finding(s) across 1 file(s), 198 suppressed [1204 files scanned in 612ms]

Install

go install github.com/0x1Adi/Klarion/cmd/klarion@latest

Or download a binary from the releases page.

Klarion needs an AI model. Pick one:

Model	Setup
Anthropic (default)	`export ANTHROPIC_API_KEY=...`
OpenAI or compatible	`export OPENAI_API_KEY=...` and set `provider = "openai"`
Local model, nothing leaves your machine	Run Ollama and set `provider = "ollama"`
Your Claude Code login	Set `provider = "claude-cli"`

Settings go in .klarion.toml under [ai]. All options are in the reference.

Use it

What you want	How
Scan a folder	`klarion scan .`
Block commits that add a secret	`klarion protect`
Block commits with the pre-commit framework	The `.pre-commit-config.yaml` below
Stop Claude Code from writing a secret	`/plugin marketplace add 0x1Adi/Klarion` then `/plugin install klarion@klarion`
Stop Cline, Cursor or any MCP agent from writing a secret	The MCP server below
Fail pull requests that add a secret	The GitHub Action below
Start on a repo that already has findings	`klarion baseline create`, so only new secrets fail

# .github/workflows/secrets.yml
name: secret-scan
on: [push, pull_request]

jobs:
  klarion:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - uses: 0x1Adi/Klarion@v0.3.8
        with:
          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}

On a pull request it scans only what the PR adds. It caches the AI answers, so unchanged code costs nothing. Findings show in the job log. On a private repo without GitHub Code Security, add upload-sarif: "false" to skip the Security tab upload. GitLab CI and every option are in the reference.

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/0x1Adi/Klarion
    rev: v0.3.8
    hooks:
      - id: klarion
        stages: [pre-commit]

Without the stages line the hook is off and runs only when you ask for it, with pre-commit run --hook-stage manual klarion. The klarion hook builds Klarion with Go the first time it runs; use id: klarion-system if klarion is already installed. Everyone who commits needs a model set up.

// ~/.cline/mcp.json, or the MCP settings of any other client
{
  "mcpServers": {
    "klarion": {
      "command": "klarion",
      "args": ["mcp"],
      "autoApprove": ["scan_text", "scan_file", "verify_finding"]
    }
  }
}

The agent calls scan_text before it writes code and scan_file before it commits. With no model configured the server hands each candidate and its decision rules to that agent to judge, so it needs no API key. Configure one and Klarion judges instead. Full steps, including the tools and how to verify the install: llms-install.md.

Results

Klarion found about 1.7× more real secrets than gitleaks, and 89% of its alerts were real (gitleaks: 91%).