Geiger

What is actually running on this machine, and what can it reach? geiger answers that for AI tooling with one read-only command, npx geiger-scan, which inventories the agents, harnesses, MCP servers, plugins, hooks and AI extensions installed across Claude Code, Cursor, VS Code, Codex CLI, Gemini CLI, AI browsers and more. Every finding is labelled with what it can do (executes code, holds secrets, broad filesystem or web access, network), where it came from, and the file that proves it.

Credentials are reported by shape only: the key name, the file and the kind of secret, never any part of the value. There is no install, no account and no telemetry, and nothing is written unless you name a --json file. It needs Node.js 18 or newer and has zero dependencies. For CI, --strict exits with code 2 when anything can execute code or hold secrets, and --diff compares a scan against an earlier snapshot.