Share Check docs

Share Check looks for secrets with a recognizable shape (API keys, tokens, private keys) in text you send it. You can call it over REST, or from an AI agent over MCP. Both use the same key, the same limits and the same credits.

Your key looks like ttk_ followed by a 10-character id, an underscore and 32 characters. It is shown once, when it is made. Keep it out of the text you share; Share Check reports its own keys too.

REST: POST /v1/check

POST https://vend.tasktoxica.com/v1/check
Authorization: Bearer ttk_...
Content-Type: application/json

{ "content": "the text you are about to share" }

• content is the only field, and it is required. Any other field is refused with unknown_field, so a typo never passes silently.
• The whole body may be at most 32,768 bytes.
• There is no file name and no language hint. Everything is checked in the strictest mode.
• The endpoint sends no CORS headers: call it from your server, script or agent, not from a web page.

The answer

{
  "receipt": {
    "id": "chk_01JABCDEFGHJKMNPQRSTVWXYZ",
    "created_at": "2026-10-20T15:04:05Z",
    "input_sha256": "<hex SHA-256 of the UTF-8 bytes you sent>",
    "input_bytes": 5123,
    "rules_version": "secret-scan@a566c7e+tt1",
    "result": "findings"
  },
  "summary": { "findings": 1, "high": 1, "medium": 0, "low": 0 },
  "findings": [
    {
      "rule": "aws-access-key-id",
      "type": "AWS access key ID",
      "severity": "high",
      "line": 1,
      "column": 14,
      "length": 20,
      "masked": "AK…WZ",
      "what_to_do": "Deactivate and delete this access key in AWS IAM and issue a new one."
    }
  ],
  "limitations": "Share Check looks for known secret patterns in the text you sent. ...",
  "credits": { "charged": 1, "free_remaining": 24, "balance": 0 }
}

• result is one of three values:
  • findings.
  • no_findings: nothing matched a known pattern in what was scanned.
  • not_scanned: the text could not be fully read, for example because it contains a NUL character or broken Unicode. It carries a reason and is not charged.
• masked shows at most the first two and the last two characters. The full value never leaves the scanner.
• line and column start at 1.
• Up to 200 findings are listed. summary counts all of them, and findings_truncated is set when more were found.
• The receipt's input_sha256 lets you match a receipt to the text you kept. We do not store that hash.

MCP: connect your AI agent

The MCP server is at https://vend.tasktoxica.com/mcp, over Streamable HTTP. It speaks the 2026-07-28 revision, and the older initialize handshake for clients that still use it. Send your key as a bearer token. In a client that takes a JSON config:

{
  "mcpServers": {
    "share-check": {
      "url": "https://vend.tasktoxica.com/mcp",
      "headers": { "Authorization": "Bearer ttk_..." }
    }
  }
}

Tools

Errors from a tool come back as a tool result with isError: true and the same code as REST, so your agent can read them and react.

Calls from a web page are refused unless they come from this site, so another site cannot use your key from a visitor's browser.

Errors

Every error has the shape { "error": { "code": "...", "message": "..." } } and is never charged.

If you ever get an answer that is not JSON, treat the text as not scanned, and check your balance before you try again.

Limitations

• "No findings" means no known secret pattern was found in what was scanned. A secret with no recognizable shape, or one split across lines, encoded (for example base64) or encrypted, can be missed.
• Some matches are not secrets, especially in code, because everything is checked in the strictest mode.
• "Allow" comments in your text are ignored.
• Files, archives and images are not checked.