Open source · MIT · free forever

A Geiger counter for AI agents.

One read-only command inventories every AI agent, harness, MCP server, plugin, and AI extension on a machine — and tells you, in plain language, what each one can touch. Zero dependencies. No account. No telemetry.

$ npx geiger-scan
Read the source on GitHub ↗ npm: geiger-scan ↗
Observed: real scan output, values redacted by design · full example →
Coverage

What is actually running on this machine?

Agents live in dotfiles nobody reads twice. Geiger reads them all — configs and directories only, never executing anything it finds:

01 · Agents

Coding agents, IDEs & apps

Claude Code, Codex (CLI and desktop app), Gemini CLI, Kilo CLI, Grok Build, Copilot CLI, Aider, Goose, DeepSeek Harness, and more — plus agentic IDEs (Cursor, Windsurf) and chat apps (Claude Desktop, ChatGPT Desktop) by presence, so an install with nothing configured yet still shows up. Hooks from Claude Code, Cursor, Codex and Gemini CLI are listed with their commands: they run with no prompt. So are git hooks and merge drivers, which git runs itself on commit, checkout and merge — increasingly where agent tooling installs itself.

02 · MCP

MCP servers, everywhere

Claude Desktop, Cursor, Windsurf, VS Code, Cline, Roo Code, Continue, Zed, Kilo, JetBrains — global and per-project, including wrapped and remote servers, with each one's origin traced.

03 · Plugins

Plugins, skills & extensions

Agent plugins, AI extensions in VS Code and Cursor, AI settings in JetBrains IDEs, and AI browser extensions across Chrome, Edge, Brave, Vivaldi, Arc and Firefox — with their actual granted permissions. AI-first browsers (Comet, Dia, ChatGPT Atlas) are findings in their own right: there, the browser is the agent. Skills are read, not just counted: a skill is instructions your agent follows, so geiger reports what the text says and flags instructions that try to override the agent or hide work from you.

04 · Origin

Where it came from

Registry, store, git, local script, or remote server — and an honest UNKNOWN-ORIGIN flag when the answer is "we can't tell".

05 · Secrets

Credentials in configs

API keys sitting in plaintext config files, reported by shape and key name only — the value itself is never printed. Enforced by test.

06 · Fix

What to do about it

Every finding that warrants action carries plain-language remediation — in the terminal, and as "What to do" blocks in the HTML report.

Exposure labels

Plain language, not scores.

No CVSS theater. Each finding gets the labels its position earns:

EXECUTEScan run commands on this machine HOLDS-SECRETSa credential sits in its config BROAD-FILESYSTEMcan read far beyond one project BROAD-WEBsees every site you visit NETWORKtalks to remote services UNKNOWN-ORIGINinstalled from no recognizable source
The three promises

A scanner you can read in one sitting.

Zero runtime dependencies, no build step — the source you read is the code that runs.

01 — Read-only

The only write Geiger ever performs is the report file you explicitly name. It reads configs and directories; it never executes what it finds.

02 — No telemetry

Nothing leaves your machine. There is no endpoint to send anything to — which also means we can't count our own users. A trade we're happy with.

03 — Secrets by shape

Credential-shaped values are reported by key name, file, and shape — never any part of the value. A redaction pass runs on all output, and the test suite enforces it.

Questions

Geiger, answered.

What do I need installed? +
Node.js 18 or newer — nothing else. Node ships npx, Geiger has zero dependencies, and it needs no global install, no admin rights and no account. If Node isn't there yet, it's one command with the package manager you already have (winget, brew, apt) — the README lists them.
Is this a security audit? +
No. It's an inventory with honest exposure labels — the thing you need before any audit means anything. It reads configuration, not runtime behavior, and it cannot judge whether a package is malicious — only where it came from and what it can reach.
Why is a security company giving this away? +
Because the question it answers — "what agents are on this machine, and what can they touch?" — should cost nothing to ask. Individually, you act on the findings yourself. At a company, enforcing policy across that surface is a different product: that's DomainGuard. Geiger stays free and standalone either way.
Why should I trust it? +
Don't — read it. It's a few hundred lines of dependency-free JavaScript under MIT, and what's published is what runs. The limitations are stated up front, because a scanner you overtrust is worse than no scanner.
Can I run it across a fleet? +
Yes — run npx geiger-scan --json per machine, collect the files, and diff over time. Diff mode is built in: --diff baseline.json --strict exits non-zero only when something new can execute code or hold secrets — a drift alarm for cron or CI, same mental model as a lockfile. The JSON schema is versioned and stable. MSPs and IT teams: this pairs naturally with Access Review & Evidence for the "prove it" half.

One command. No excuses.

You cannot secure a surface you haven't inventoried. Run it now — it reads, it reports, it leaves.

npx geiger-scan · MIT · zero dependencies · no telemetry
View on GitHub ↗ npm: geiger-scan ↗