GitHub - Atomburstofficial/geiger: A Geiger counter for AI agents — one read-only command that inventories every agent, MCP server, plugin, and AI extension on a machine · GitHub

Skip to content

Navigation MenuSign inAppearance settingsPlatformAI CODE CREATIONGitHub CopilotWrite better code with AIGitHub Copilot appDirect agents from issue to mergeMCP RegistryIntegrate external toolsDEVELOPER WORKFLOWSActionsAutomate any workflowCodespacesInstant dev environmentsIssuesPlan and track workCode ReviewManage code changesCode QualityEnforce quality at mergeAPPLICATION SECURITYGitHub Advanced SecurityFind and fix vulnerabilitiesCode securitySecure your code as you buildSecret protectionStop leaks before they startEXPLOREWhy GitHubDocumentationBlogChangelogMarketplaceView all featuresSolutionsBY COMPANY SIZEEnterprisesSmall and medium teamsStartupsNonprofitsBY USE CASEApp ModernizationDevSecOpsDevOpsCI/CDView all use casesBY INDUSTRYHealthcareFinancial servicesManufacturingGovernmentView all industriesView all solutionsResourcesEXPLORE BY TOPICAISoftware DevelopmentDevOpsSecurityView all topicsEXPLORE BY TYPECustomer storiesEvents & webinarsEbooks & reportsBusiness insightsGitHub SkillsSUPPORT & SERVICESDocumentationCustomer supportCommunity forumTrust centerPartnersView all resourcesOpen SourceCOMMUNITYGitHub SponsorsFund open source developersPROGRAMSSecurity LabMaintainer CommunityGitHub StarsArchive ProgramREPOSITORIESTopicsTrendingCollectionsEnterpriseENTERPRISE SOLUTIONSEnterprise platformAI-powered developer platformAVAILABLE ADD-ONSGitHub Advanced SecurityEnterprise-grade security featuresCopilot for BusinessEnterprise-grade AI featuresPremium SupportEnterprise-grade 24/7 supportPricingSearch/Sign inSign upAppearance settings

You signed in with another tab or window. Reload to refresh your session.
You signed out in another tab or window. Reload to refresh your session.
You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

Uh oh!

There was an error while loading. Please reload this page.

Atomburstofficial

/

geiger

Public

Notifications
You must be signed in to change notification settings

Fork
1

Star
19

Code

Issues
0

Pull requests
0

Actions

Projects

Security and quality
0

Insights

Additional navigation options

Code

Issues

Pull requests

Actions

Projects

Security and quality

Insights

mainBranchesTagsGo to fileCodeOpen more actions menuLatest commit History10 Commits10 CommitsFolders and filesNameNameLast commit messageLast commit date.github.github  binbin  datadata  docsdocs  srcsrc  testtest  .gitattributes.gitattributes  .gitignore.gitignore  CONTRIBUTING.mdCONTRIBUTING.md  LICENSELICENSE  README.mdREADME.md  SECURITY.mdSECURITY.md  package.jsonpackage.json  View all filesRepository files navigationREADMEContributingMIT licenseSecurityMore itemsgeiger

A Geiger counter for AI agents.
One read-only command that inventories every AI agent, harness, MCP server,
plugin, and AI extension on a machine — and tells you, in plain language,
what each one can touch.
npx geiger-scan

No install. No account. No telemetry. Reads configs and directories, writes
nothing (unless you ask for --json yourfile.json).

Why this exists
In August 2026, an open-source agent harness went from zero to 200,000+
GitHub stars in three weeks. Its plugin ecosystem passed 13,000 repositories
in the same window. One-click desktop clients appeared the same day it
launched. Instagram carousels now teach office workers to install all of it.
Every one of those installs is a program that can execute commands, read
files, and hold credentials — configured in dotfiles nobody looks at twice.
Ask yourself the question this tool answers: what is actually running on
this machine, and what can it reach? Most people cannot answer it. Now
it's one command.
What a scan looks like
GEIGER · a Geiger counter for AI agents
machine dev-laptop · 2026-09-06 12:24 UTC · read-only · no telemetry
──────────────────────────────────────────────────────────────

9 findings across 3 ecosystems · 7 can execute code · 1 credential in config files

claude-code (6)
Claude Code agent
[EXECUTES] [BROAD-FILESYSTEM] [NETWORK]
origin: registry · @anthropic-ai/claude-code
magic (Claude Code · global) MCP server
[EXECUTES] [HOLDS-SECRETS] [BROAD-FILESYSTEM]
origin: registry · @21st-dev/magic@latest
credential: "API_KEY" — opaque value under a credential-named key · ~/.claude.json
note: wrapped by a policy agent (domainguard-agent.exe) — enforcement layer in front of the server
hooks: UserPromptSubmit, PreToolUse hook
[EXECUTES]
note: hooks execute without a prompt each time their event fires
...

Real output from a real machine (values redacted — see below).
What it detects

Ecosystem
What geiger reads

Claude Code
global + per-project MCP servers, hooks, plugins, skills, subagents, apiKeyHelper

MCP hosts
Claude Desktop, Cursor, Windsurf, VS Code (user + project), Cline, Roo Code, Continue, Zed

Other agents
Codex CLI, Gemini CLI, Aider, OpenCode, Qwen Code, DeepSeek Harness, Continue, GitHub Copilot CLI, Goose, Open Interpreter, LM Studio, Ollama

Editor extensions
AI extensions in VS Code / Insiders / Cursor

Global CLIs
agent packages in global npm roots (read directly — npm is never executed)

Browser extensions
AI extensions in Chrome / Edge / Brave profiles, with their manifest permissions

Every finding gets: what it is, where it came from (registry, store, git,
local script, remote server — or UNKNOWN-ORIGIN), what it can do
(EXECUTES, HOLDS-SECRETS, BROAD-FILESYSTEM, BROAD-WEB,
NETWORK), and the evidence path so you can verify by hand.
Geiger also recognizes policy wrappers (agents that put an enforcement
layer in front of MCP servers) and reports both layers instead of hiding the
real server behind the wrapper.
The three promises

Read-only. The only write geiger ever performs is the --json file
you explicitly name.
No telemetry. Nothing leaves your machine. There is no endpoint to
send anything to. (This also means we have no idea how many people use
this — a trade we're happy with.)
Secrets by shape only. When a credential-shaped value is found in a
config, geiger reports the key name, the file, and what kind of secret it
looks like — never any part of the value. A redaction pass runs on all
output as defense-in-depth, and the test suite enforces it.

Usage
npx geiger-scan scan, print the report
npx geiger-scan --html report.html self-contained HTML report with per-finding
"what to do" remediation guidance
npx geiger-scan --json out.json machine-readable findings (schemaVersion 1)
npx geiger-scan --path D:\repo1 --path E:\repo2
also scan these project directories for
project-level agent and MCP configs
npx geiger-scan --home C:\Users\other scan a different home root (another user
profile, a mounted image)
npx geiger-scan --strict exit 2 if anything can execute code or
holds secrets
npx geiger-scan --diff baseline.json compare against an earlier --json
snapshot: what appeared, disappeared,
or escalated since then

Drift alarm: once you've reviewed a machine, save a baseline
(--json baseline.json) and put geiger-scan --strict --diff baseline.json
in cron or CI. It exits 2 only when something new can execute code or
hold secrets — the standing, already-reviewed inventory stays quiet. Same
mental model as a lockfile: accept what's there, alarm on change.
No npm? npx github:Atomburstofficial/geiger runs straight from the repo.
What the reports look like
Before running anything, see exactly what you'd get: a
sample HTML report and a
sample JSON output live in this repo, generated
from the test fixture — synthetic data, generic paths, credentials shown by
shape only (as always). The HTML report:

Every finding that warrants action carries plain-language remediation — as
fix: lines in the terminal and "What to do" blocks in the HTML report.
Fleet pattern (MSPs, IT): run with --json per machine on a schedule (an
RMM task or login script writing %COMPUTERNAME%.json to a share), keep
each machine's baseline, and let --diff report per-machine drift. The
schema is versioned and stable. Geiger never phones home — the JSON files
travel only where you put them.
Limitations
Stated up front, because a scanner you overtrust is worse than no scanner:

Geiger reads known config locations. Agents installed in nonstandard
paths, other user accounts, containers, or WSL (from the Windows side)
are not seen.
It reads configuration, not runtime behavior. It cannot tell you what
a plugin actually did — only what its position allows.
It cannot judge whether a package is malicious — only where it came from
and what it can reach. Origin ≠ trustworthiness.
Partially-parseable formats (TOML configs) are scanned by shape and
flagged with reduced confidence rather than skipped.
The ecosystem this tool audits changes weekly. Detectors are data-driven
and small on purpose — see CONTRIBUTING.md to add one.

FAQ
Is this a security audit? No. It's an inventory with honest exposure
labels — the thing you need before any audit means anything.
Why should I trust a security company's free scanner? Read it. It's a
few hundred lines of dependency-free JavaScript, and what's published is
what runs — releases are published from GitHub Actions with npm
provenance, so the
npm page carries a signed link to the exact public commit each version was
built from.
What do I do about what it finds? Individually: remove what you don't
recognize, rotate credentials that shouldn't be sitting in configs. At a
company: that's policy enforcement, which is a different product —
DomainGuard is how organizations put a
policy layer in front of this surface. Geiger stays free and standalone
either way.
License
MIT · built by
Atomburst ·
zero runtime dependencies, no build step — the source you read is the code
that runs.
AboutA Geiger counter for AI agents — one read-only command that inventories every agent, MCP server, plugin, and AI extension on a machineatomburst.io/geigerTopicsai-agentsai-governanceai-safetyai-securityclaude-codegovernancemcpmcp-servernpxscannersecurity-toolsResourcesReadmeMIT licenseContributingContributingSecurity policySecurity policyActivityCustom propertiesStars19 starsWatchers0 watchingForks1 forkReport repositoryReleasesPackagesContributorsLanguages

Footer

© 2026 GitHub, Inc.

Footer navigation

Terms

Privacy

Security

Status

Community

Docs

Contact

Manage cookies

Do not share my personal information

You can’t perform that action at this time.

The Geiger counter is presented as a read-only command-line tool designed to inventory the components of an AI agent environment on a machine, specifically focusing on every AI agent, harness, MCP server, plugin, and AI extension installed. The primary goal of this tool is to provide a clear, plain-language understanding of what resides on the system and what capabilities each component possesses, effectively answering the question of what is actually running and what it can reach.

The tool is invoked via the command npx geiger-scan, requiring no installation or account setup and generating no telemetry. It achieves this by reading configurations and directories without writing any data unless explicitly requested via the --json flag. This existence is motivated by the rapid proliferation of open-source agent harnesses and their expansive plugin ecosystems, which have led to countless installations of programs capable of executing commands, reading files, and holding credentials within dotfiles. The Geiger counter aims to mitigate the difficulty users face in discerning the full scope of these installed programs and their potential access.

The scan output details findings across various ecosystems, such as Claude Code and multiple MCP hosts, and tracks various components like agents, MCP servers, hooks, and AI extensions. For each finding, the tool specifies what was detected, its origin (registry, git, local script, etc.), and its potential actions, such as executing code, holding secrets, accessing the filesystem, or using the network. A notable feature is the recognition of policy wrappers, such as agents that place an enforcement layer in front of an MCP server, reporting both the wrapper and the underlying server.

Several usage options are provided for the tool, including generating a standard HTML report with remediation guidance, producing machine-readable findings in JSON format, and scanning specific project directories simultaneously. Furthermore, strict operational modes exist, allowing users to exit with an error code if any component is found capable of executing code or holding secrets. A drift alarm mechanism is also introduced, enabling users to establish a baseline inventory and subsequently monitor for changes in the system, aligning with a mental model similar to file lockfiles where changes trigger an alarm.

The tool operates with three core promises: it is read-only, performing no writes unless explicitly commanded; it generates no telemetry, ensuring privacy; and it manages secrets by shape, reporting the location and type of credential without exposing the actual sensitive values, reinforced by a redaction pass. It is positioned not as a full security audit, but as an honest inventory with explicit exposure labels that are necessary prerequisites for any meaningful security assessment.

Despite its utility, the tool has defined limitations. It only reads known configuration locations, thus missing agents installed in nonstandard paths, other user accounts, containers, or environments like WSL. It scans configurations rather than runtime behavior; it cannot determine the actual actions of a plugin, only the permissions its position allows toward. The tool cannot judge the maliciousness of a package, as origin does not inherently equate to trustworthiness. It also handles partially-parseable formats like TOML configurations by flagging them with reduced confidence. The understanding of the audited ecosystem is dynamic, requiring continuous updates to its detectors. For organizational application, the tool serves as an inventory layer, with broader policy enforcement mechanisms, such as DomainGuard, being necessary to implement actual organizational policy layers.