Geiger inventories every AI agent, MCP server and plugin on your machine in one read-only command

One command inventories the whole agent stack

A new open-source tool called Geiger, built by security company Atomburst, appeared on Hacker News's front page this week with a narrow pitch: a single read-only command, npx geiger-scan, that finds every AI agent, harness, MCP server, plugin and AI extension installed on a machine and explains in plain language what each one can touch. According to the project's GitHub README, there is nothing to install, no account to create and no telemetry — the tool reads configuration files and directories and writes nothing unless you explicitly request a JSON export.

The stated motivation is the speed at which agent tooling spread in August 2026. The README says one open-source agent harness went from zero to more than 200,000 GitHub stars in three weeks, with a plugin ecosystem that passed 13,000 repositories in the same window. One-click desktop clients appeared on launch day, and social-media tutorials now walk office workers through installing the whole stack. Every one of those installs is a program that can execute commands, read files and hold credentials, configured in dotfiles that almost nobody inspects.

What a scan covers

A sample scan in the README, described as real output from a real machine with values redacted, reports nine findings across three ecosystems: seven can execute code and one config file holds a credential. Detection spans Claude Code's global and per-project MCP servers, hooks, plugins, skills and subagents; MCP hosts including Claude Desktop, Cursor, Windsurf, VS Code, Cline, Roo Code, Continue and Zed; agent CLIs such as Codex CLI, Gemini CLI, Aider, OpenCode, Qwen Code, GitHub Copilot CLI, Goose, Open Interpreter, LM Studio and Ollama; AI extensions in editors; agent packages in global npm roots, read directly without executing npm; and browser extensions in Chrome, Edge and Brave profiles along with their manifest permissions.

Each finding records what the component is, where it came from — registry, store, git, local script, remote server or UNKNOWN-ORIGIN — and capability flags such as EXECUTES, HOLDS-SECRETS, BROAD-FILESYSTEM, BROAD-WEB and NETWORK, plus the evidence path so results can be verified by hand. Geiger also recognises policy wrappers that put an enforcement layer in front of MCP servers and reports both layers rather than hiding the real server behind the wrapper.

Baselines, drift and fleet use

The tool ships with --html and -- output modes — the HTML report includes per-finding remediation guidance — plus --path for extra project directories, --home for scanning another user profile, and --strict, which exits with code 2 if anything found can execute code or hold secrets. The README suggests a lockfile-style workflow: save a reviewed inventory with --, then run --strict --diff against it in cron or CI so that only new, elevated findings trigger alarms while the already-reviewed inventory stays quiet. For MSPs and IT teams, JSON snapshots can be collected per machine on a schedule and diffed against per-machine baselines; the schema is versioned.

Three guarantees are spelled out: the only write is the JSON file you name, there is no endpoint to send telemetry to, and credentials are reported by shape only — key name, file and secret type, never any part of the value — with a redaction pass enforced by the test suite.

Stated limitations

The README is blunt about limits. Geiger reads known config locations, so agents installed in nonstandard paths, other user accounts, containers or WSL are invisible to it. It reads configuration, not runtime behaviour, so it cannot say what a plugin actually did — only what its position allows. And it cannot judge whether a package is malicious; origin is not trustworthiness. The FAQ positions the tool as an inventory with exposure labels, the prerequisite before any audit means anything, rather than a security audit itself.

On trust, the project notes it is a few hundred lines of dependency-free JavaScript with no build step, and releases are published from GitHub Actions with npm provenance linking each version to a public commit. Atomburst sells a separate commercial product, DomainGuard, for organisational policy enforcement; Geiger itself stays free and standalone.

Why it matters

Agent adoption has outrun visibility. A typical developer machine now accumulates multiple harnesses, MCP servers, plugins and browser extensions, each holding credentials and filesystem access, with no standard place to review the whole picture at once. Geiger turns an unanswerable question — what is actually running here, and what can it reach — into a single command, and its baseline-diff pattern gives teams a way to notice when that answer changes. A config scanner cannot catch runtime abuse or judge intent, as the project itself acknowledges, but a credible, read-only inventory is the missing first step for anyone managing this fast-moving surface.