01 · Agents
Coding agents & harnesses
Claude Code, Codex CLI, Gemini CLI, Kilo CLI, Grok Build, Copilot CLI, Aider, Goose, DeepSeek Harness, and more — with their hooks, skills, and subagents.
Open source · MIT · free forever
A Geiger counter for AI agents.
One read-only command inventories every AI agent, harness, MCP server, plugin, and AI extension on a machine — and tells you, in plain language, what each one can touch. Zero dependencies. No account. No telemetry.
$ npx geiger-scanGEIGER · a Geiger counter for AI agents machine dev-laptop · read-only · no telemetry ────────────────────────────────────────────── 10 findings across 3 ecosystems 8 can execute code · 1 credential in config files claude-code (6) magic MCP server [EXECUTES] [HOLDS-SECRETS] [BROAD-FILESYSTEM] origin: registry · @21st-dev/magic@latest credential: "API_KEY" — value never shown fix: pin an exact version, rotate the key hooks: PreToolUse hook [EXECUTES] note: runs without a prompt on every event
Coverage
What is actually running on this machine?
Agents live in dotfiles nobody reads twice. Geiger reads them all — configs and directories only, never executing anything it finds:
02 · MCP
MCP servers, everywhere
Claude Desktop, Cursor, Windsurf, VS Code, Cline, Roo Code, Continue, Zed — global and per-project, including wrapped and remote servers.
03 · Plugins
Plugins & extensions
Agent plugins, AI settings in VS Code, Cursor, and JetBrains IDEs, and AI browser extensions — Chrome, Edge, Brave, Firefox — with their actual granted permissions.
04 · Origin
Where it came from
Registry, store, git, local script, or remote server — and an honest UNKNOWN-ORIGIN flag when the answer is "we can't tell".
05 · Secrets
Credentials in configs
API keys sitting in plaintext config files, reported by shape and key name only — the value itself is never printed. Enforced by test.
06 · Fix
What to do about it
Every finding that warrants action carries plain-language remediation — in the terminal, and as "What to do" blocks in the HTML report.
Exposure labels
Plain language, not scores.
No CVSS theater. Each finding gets the labels its position earns:
EXECUTEScan run commands on this machine
HOLDS-SECRETSa credential sits in its config
BROAD-FILESYSTEMcan read far beyond one project
BROAD-WEBsees every site you visit
NETWORKtalks to remote services
UNKNOWN-ORIGINinstalled from no recognizable source
The three promises
A scanner you can read in one sitting.
Zero runtime dependencies, no build step — the source you read is the code that runs.
01 — Read-only
The only write Geiger ever performs is the report file you explicitly name. It reads configs and directories; it never executes what it finds.
02 — No telemetry
Nothing leaves your machine. There is no endpoint to send anything to — which also means we can't count our own users. A trade we're happy with.
03 — Secrets by shape
Credential-shaped values are reported by key name, file, and shape — never any part of the value. A redaction pass runs on all output, and the test suite enforces it.
Questions
Geiger, answered.
Is this a security audit? +
No. It's an inventory with honest exposure labels — the thing you need before any audit means anything. It reads configuration, not runtime behavior, and it cannot judge whether a package is malicious — only where it came from and what it can reach.
Why is a security company giving this away? +
Because the question it answers — "what agents are on this machine, and what can they touch?" — should cost nothing to ask. Individually, you act on the findings yourself. At a company, enforcing policy across that surface is a different product: that's DomainGuard. Geiger stays free and standalone either way.
Why should I trust it? +
Don't — read it. It's a few hundred lines of dependency-free JavaScript under MIT, and what's published is what runs. The limitations are stated up front, because a scanner you overtrust is worse than no scanner.
Can I run it across a fleet? +
Yes — run
npx geiger-scan --json per machine, collect the files, and diff over time. The JSON schema is versioned and stable. MSPs and IT teams: this pairs naturally with Access Review & Evidence for the "prove it" half.One command. No excuses.
You cannot secure a surface you haven't inventoried. Run it now — it reads, it reports, it leaves.
npx geiger-scan · MIT · zero dependencies · no telemetry