# Tools > Every listed resource, editors’ picks first. The filters below can be combined. - Search: append `?q=` to the URL. Separate several keywords with spaces; all of them must match. Matches name, repository, tags, professions, description and README. - Filter by type: append `?type=` to the URL. - Filter by profession: append `?profession=` to the URL. Separate several ids with commas; a resource matches when it suits any of them. Ids are listed at https://hebbmind.com/api/v1/professions - Filter by tag: append `?tag=` to the URL. Separate several tags with commas; a resource must carry all of them. Tags are listed at https://hebbmind.com/api/v1/tags Resources for Full-stack / Indie or ML / AI, Tagged `secrets-management`: 9 items. > - Full-stack / Indie: General software work: coding-agent workflows, code review, debugging and Git collaboration. > - ML / AI: Model training, evaluation and LLM application development. - [mkcert](https://hebbmind.com/cli/mkcert.md): [CLI] Creates a local CA with one command and issues development HTTPS certificates trusted by your system and browsers, for localhost, IPs and wildcard domains, with no extra configuration. Run mkcert -install once first to add the root certificate to the trust store. - [Gitleaks](https://hebbmind.com/cli/gitleaks.md): [CLI] Detects hardcoded passwords, API keys and tokens in Git repos, files and stdin, and can run as a pre-commit hook or GitHub Action to block leaks. Now feature-frozen with security fixes only, as the author has moved on to Betterleaks. - [TruffleHog](https://hebbmind.com/cli/trufflehog.md): [CLI] Finds leaked credentials in Git, GitHub, S3, filesystems and more, recognizing 800+ secret types and checking with each service whether a key is still live to cut false positives. - [direnv](https://hebbmind.com/cli/direnv.md): [CLI] Loads and unloads environment variables per directory: reads .envrc (and optionally .env) when you enter a project and restores the environment when you leave, so configs and secrets do not leak between projects. Hook it into bash, zsh, fish or another shell first. - [CC Safety Net](https://hebbmind.com/plugin/cc-safety-net.md): [Plugin] Before tool calls run, blocks destructive Git and file commands (git reset --hard, rm -rf) and access to sensitive files like SSH keys and .env. Parses command semantics, so bash -c wrappers are caught too. Works with Claude Code, Codex and other coding CLIs; needs Node.js 18+. - [Docker MCP Gateway](https://hebbmind.com/mcp/mcp-gateway.md): [MCP] Docker's official MCP gateway (the docker mcp CLI plugin): runs servers from the Docker MCP Catalog in isolated containers, manages secrets, OAuth and tool toggles centrally, and gives multiple clients one endpoint. Built into Docker Desktop 4.59+; Docker CE and other setups must build the plugin. - [SonarQube](https://hebbmind.com/plugin/sonarqube-agent-plugins.md): [Plugin] Sonar's official plugin bringing SonarQube checks into the agent coding loop: secrets-scanning hook, issue fixing, quality gates, coverage and dependency risk; with Vortex analysis on, every edit is checked. Needs SonarQube (free Community Build works), the sonar CLI and Docker. - [GitGuardian MCP Server](https://hebbmind.com/mcp/ggmcp.md): [MCP] GitGuardian's official MCP: scans code for leaked secrets with 500+ detectors, and lets agents triage and remediate incidents, generate honeytokens and open fix PRs. Needs a GitGuardian account; the hosted endpoint with OAuth sign-in is recommended. - [Semgrep Guardian](https://hebbmind.com/plugin/semgrep-plugin.md): [Plugin] Semgrep's official MCP server plus hooks: every file the agent writes is scanned with Semgrep Code, Supply Chain and Secrets for vulnerabilities, malicious dependencies and hardcoded secrets; the agent rewrites until clean or you dismiss findings. Requires a Semgrep login.