Security Scanning Moves Left—All the Way to Your Editor GitHub shipped secret scanning via the GitHub MCP Server to general availability this week, and it's the kind of shift-left move I've been waiting for. You can now ask Copilot to scan your uncommitted changes for exposed credentials directly in VS Code or Copilot CLI—before you commit, before you open a PR, before anyone has to file a post-incident report about leaked AWS keys. This isn't a new scanning engine. It's the same GitHub Secret Scanning that's been catching credentials in repositories for years, now wired into the Model Context Protocol so AI agents can invoke it as a tool. When you're working on a feature branch and you ask Copilot, "Scan my current changes for exposed secrets," it hands your staged files to the scanning service and returns structured results with file paths, line numbers, and severity.…