Geiger inventories every AI agent and MCP server on a machine

What happened

Atomburst, a security company, released Geiger, a free command-line tool that inventories every AI agent, coding harness, MCP server, plugin and browser AI extension installed on a machine. The npm package, geiger-scan, runs with npx geiger-scan, needs no install or account, and reached version 0.2.1 on 9 September 2026 after three point releases in one day. A Show HN post for the tool drew 44 points and 21 comments.

Geiger is a read-only scanner that answers one question: what AI software is actually running on this machine, and what can it reach. It reads configuration files across editors, CLIs and browsers, then prints each finding with a plain-language exposure label such as EXECUTES, HOLDS-SECRETS or BROAD-FILESYSTEM, instead of a numeric risk score.

What changed

• The scanner covers six detector families as of v0.1.0: Claude Code (global and per-project MCP servers, hooks, plugins, skills, subagents, apiKeyHelper), MCP hosts (Claude Desktop, Cursor, Windsurf, VS Code, Cline, Roo Code, Continue, Zed), other coding agents (Codex CLI, Gemini CLI, Aider, Goose, Copilot CLI, DeepSeek Harness, Open Interpreter, LM Studio, Ollama), VS Code AI extensions, global npm agent CLIs, and browser AI extensions with their manifest permissions.
• Every finding lists where it came from (registry, store, git, local script, remote server, or an explicit UNKNOWN-ORIGIN flag) and what it can do, using the labels EXECUTES, HOLDS-SECRETS, BROAD-FILESYSTEM, BROAD-WEB, NETWORK and UNKNOWN-ORIGIN.
• Credentials found in config files are reported by key name, file path and shape only; the value itself is never printed, and a redaction pass runs on all output with test-suite enforcement.
• v0.2.0 added --diff baseline.json, which compares a fresh scan against an earlier --json snapshot and reports what appeared, disappeared or escalated. A drift-gated --strict flag then exits 2 only on new findings that execute code or hold secrets, so a reviewed inventory stays quiet and only changes trip the alarm.
• v0.2.1 added four more ecosystems on top of that: Kilo CLI (including JSONC-commented config parsing), Grok Build's ~/.grok home and config.toml, Firefox extension permissions, and JetBrains AI Assistant and MCP settings detection, plus the Junie agent's home directory.
• Geiger also detects policy wrappers, agents that sit in front of an MCP server to enforce rules, and reports both the wrapper and the real server behind it rather than letting the wrapper hide it.
• The tool has zero runtime dependencies, ships under MIT, runs CI across Linux, macOS and Windows on Node 18, 20 and 22, and publishes with npm provenance so each release links to the exact commit it was built from.

Why it matters for agent builders

Anyone shipping an agent, an MCP server or a skill is also, usually without noticing, accumulating a second inventory: the other agents, servers and extensions already sitting on their own machine with access to files, credentials and the network. Geiger turns that into a single command instead of a manual audit of a dozen config formats, which matters more as harnesses add their own plugin and skill ecosystems that install more of this surface with less visibility. The --diff and --strict flags in particular make it usable in CI or a login script: a team can accept its current inventory as a baseline and get a nonzero exit code only when something new shows up that can run code or hold a secret, which is the same drift-alarm pattern teams already use for dependency lockfiles.

What to watch

Geiger reads known config locations and static files, not runtime behavior, so it cannot tell whether an already-installed plugin misbehaves, only what its position allows it to reach, and it explicitly does not judge whether a package is malicious. Atomburst also sells DomainGuard, a paid policy-enforcement layer for the same surface Geiger inventories for free, so watch whether Geiger's detector coverage keeps pace with an ecosystem the maintainers themselves describe as changing weekly, and whether that free-scanner-to-paid-policy pattern holds as more ecosystems get added.

Key takeaways

• Geiger is a free, MIT-licensed, dependency-free npx command from Atomburst that inventories AI agents, MCP servers, plugins and browser extensions on one machine.
• It reached v0.2.1 on 9 September 2026, covering Claude Code, eight MCP hosts, over a dozen other coding agents, JetBrains IDEs, Firefox and Chromium browser extensions, and global npm CLIs.
• Findings carry plain-language exposure labels (EXECUTES, HOLDS-SECRETS, BROAD-FILESYSTEM, BROAD-WEB, NETWORK, UNKNOWN-ORIGIN) instead of a numeric score.
• Credentials are reported by key name and shape only, never by value, and a test suite enforces the redaction.
• The v0.2.0 --diff and --strict flags let a team baseline a reviewed inventory and alarm only on new, risky changes, the same model as a dependency lockfile.

FAQ

What does Geiger actually scan?

It reads known configuration files and directories for Claude Code, eight MCP hosts (Claude Desktop, Cursor, Windsurf, VS Code, Cline, Roo Code, Continue, Zed), more than a dozen other coding agents and CLIs, JetBrains IDE AI settings, Chromium and Firefox AI extensions, and global npm packages. It never executes anything it finds.

Does Geiger send any data anywhere?

No. Atomburst states Geiger has no telemetry and nothing leaves the machine it runs on; the only write it performs is a report file the user explicitly names with --json or --html.

Is a Geiger scan the same as a security audit?

No. Atomburst describes it as an inventory with honest exposure labels, the step that has to happen before an audit means anything. It reads configuration, not runtime behavior, and cannot judge whether a package is malicious, only where it came from and what it can reach.

Source: Geiger on GitHub Discussion: Hacker News

Machines already carry more of this surface than most teams have counted; browse the MCP servers already reviewed on AI Agents Listing before adding another one to the pile.