trufflehog icon indicating copy to clipboard operation
trufflehog copied to clipboard

feat(detectors): added make.com api_token and mcp_token detectors

Open Jeff-Rowell opened this issue 4 months ago • 7 comments

Description:

Make.com is a low-code/no-code automation platform that allows users to connect apps and services typically to automate business workflows. I've added two new detectors for Make.com:

  1. api_token - authentication keys permitting access to a make.com API. The /users/me/current-authorization endpoint is used for validity checks. A 200 OK response code is returned iff the API key is valid and the correct FQDN/zone is used. The api_token detector attempts to match a Make.com API URL and tries to validate against the matched URLS first. If there are no API URLs found, or if the matched API URL(s) fail to validate, the api_token detector attempts validation using the /users/me/current-authorization endpoint for each of the known make.com zones until one of them succeeds or they all fail:
    • https://eu1.make.com/api/v2/
    • https://eu2.make.com/api/v2/
    • https://us1.make.com/api/v2/
    • https://us2.make.com/api/v2/
    • https://us1.make.celonis.com/api/v2/
    • https://eu1.make.celonis.com/api/v2/
  2. mcp_token - a unique URL provided by Make.com that allows external AI systems to access automation workflows and tools in Make.com. Make.com provides a cloud-based MCP server that communicates via Server-Sent Events (SSE) and provides users a URL that contains an embedded MCP auth token using a pattern that looks like this: https://<MAKE_ZONE>/mcp/api/v1/u/<MCP_TOKEN>/sse. The detector finds these URLs and looks for a 200 OK response when calling them.

Checklist:

  • [x] Tests passing (make test-community)?
  • [x] Lint passing (make lint this requires golangci-lint)?

Jeff-Rowell avatar Jul 27 '25 14:07 Jeff-Rowell