Secrets Scan

Use trufflehog_scan({ path, only_verified }) (mantis_trufflehog MCP server) for the Detect stage's secrets coverage.

• The server already redacts every secret value before it reaches you (redacted_secret is a masked preview, never the full value). Never try to reconstruct, print, or echo the full secret elsewhere -- e.g. don't re-read the source line containing it and paste it into a report just because the tool redacted its own output.
• verified: true means trufflehog live-checked the credential against its provider and it's currently active -- treat this as a near-confirmed finding with severity driven by what the credential can access. verified: false is a candidate (pattern-matched but not live-checked, could be a dead/rotated key or a false-positive-looking test fixture).
• Remediation for any verified secret is always: rotate/revoke the credential at the provider, then remove it from source (and consider it compromised in git history even after removal -- flag that separately, since simply deleting the line does not purge history).
• Set only_verified: true when you specifically want to cut noise from test fixtures and example keys; leave it off for full recall during an initial sweep.