Geiger is a read-only scanner that inventories the AI agents, harnesses, MCP servers, plugins, and AI extensions installed on a machine and states in plain language what each one can reach. It reads configuration files and directories only, never executes anything it finds, writes nothing unless asked for a report file, and sends no telemetry.
It covers coding agents and CLIs (Claude Code, Codex, Gemini CLI, Aider, OpenCode, Qwen Code, Goose, Ollama, and others), MCP servers configured in hosts such as Claude Desktop, Cursor, VS Code, Cline, Roo Code, Continue, and Zed, agent hooks and git hooks, skill and subagent text, editor and JetBrains AI settings, global npm agent packages, AI browsers, and AI browser extensions with their granted permissions. Each finding records its origin (registry, store, git, local script, remote server, or unknown), exposure labels such as executes code, holds secrets, broad filesystem, broad web, or network, and the evidence path for manual checking.
Credentials found in configs are reported by key name, file, and type only, never by value. Reports come as terminal output, a self-contained HTML file, or versioned JSON, and a strict mode with a saved baseline turns it into a drift alarm for cron or CI that fires only when something new can execute code or hold secrets. Geiger reads only known config locations and configuration rather than runtime behavior, and it does not judge whether a package is malicious.
Features
- Agent inventory: detects coding agents, CLIs, desktop AI apps, and agentic IDEs, including installs with nothing configured
- MCP server discovery: global and per-project servers across major MCP hosts, including wrapped and remote servers with their origin traced
- Hook listing: agent hooks and git hooks with their commands, since hooks run without a prompt
- Skill text checks: flags instructions that try to override the agent or hide work, hostile command shapes, and credential shapes
- Browser extensions: AI extensions across Chrome, Edge, Brave, Vivaldi, Arc, Firefox, and AI browsers, with granted permissions
- Exposure labels: EXECUTES, HOLDS-SECRETS, BROAD-FILESYSTEM, BROAD-WEB, and NETWORK, with origin and evidence path
- Secret redaction: credentials reported by shape only, with a redaction pass over all output
- Policy wrappers: reports both the enforcement layer and the real MCP server behind it
- Reports: terminal, self-contained HTML with remediation steps, and versioned JSON
- Drift alarm: compares against a saved baseline and exits non-zero only on new executing or secret-holding findings
