trufflehog
trufflehog copied to clipboard
feat(detectors): added make.com api_token and mcp_token detectors
Description:
Make.com is a low-code/no-code automation platform that allows users to connect apps and services typically to automate business workflows. I've added two new detectors for Make.com:
- api_token - authentication keys permitting access to a make.com API. The /users/me/current-authorization endpoint is used for validity checks. A 200 OK response code is returned iff the API key is valid and the correct FQDN/zone is used. The api_token detector attempts to match a Make.com API URL and tries to validate against the matched URLS first. If there are no API URLs found, or if the matched API URL(s) fail to validate, the api_token detector attempts validation using the /users/me/current-authorization endpoint for each of the known make.com zones until one of them succeeds or they all fail:
- https://eu1.make.com/api/v2/
- https://eu2.make.com/api/v2/
- https://us1.make.com/api/v2/
- https://us2.make.com/api/v2/
- https://us1.make.celonis.com/api/v2/
- https://eu1.make.celonis.com/api/v2/
- mcp_token - a unique URL provided by Make.com that allows external AI systems to access automation workflows and tools in Make.com. Make.com provides a cloud-based MCP server that communicates via Server-Sent Events (SSE) and provides users a URL that contains an embedded MCP auth token using a pattern that looks like this:
https://<MAKE_ZONE>/mcp/api/v1/u/<MCP_TOKEN>/sse. The detector finds these URLs and looks for a 200 OK response when calling them.
Checklist:
- [x] Tests passing (
make test-community)? - [x] Lint passing (
make lintthis requires golangci-lint)?