{"slug": "geiger-see-every-ai-agent-on-your-machine-and-what-it-can-touch", "title": "Geiger – See every AI agent on your machine and what it can touch", "summary": "Geiger, a new open-source command-line tool, lets users inventory every AI agent, MCP server, plugin, and AI extension on their machine with a single read-only command, reporting what each can access. The tool, run via `npx geiger-scan`, scans configs and directories across ecosystems like Claude Code, VS Code, and browser extensions, flagging capabilities such as code execution, secret holding, and broad filesystem access, while ensuring no telemetry and redacting credential values. It was created in response to the rapid growth of AI agent harnesses, including one that gained 200,000+ GitHub stars in three weeks in August 2026.", "body_md": "**A Geiger counter for AI agents.**\n\nOne read-only command that inventories every AI agent, harness, MCP server, plugin, and AI extension on a machine — and tells you, in plain language, what each one can touch.\n\n```\nnpx geiger-scan\n```\n\nNo install. No account. No telemetry. Reads configs and directories, writes\nnothing (unless you ask for `--json yourfile.json`).\n\nIn August 2026, an open-source agent harness went from zero to 200,000+ GitHub stars in three weeks. Its plugin ecosystem passed 13,000 repositories in the same window. One-click desktop clients appeared the same day it launched. Instagram carousels now teach office workers to install all of it.\n\nEvery one of those installs is a program that can execute commands, read\nfiles, and hold credentials — configured in dotfiles nobody looks at twice.\nAsk yourself the question this tool answers: **what is actually running on\nthis machine, and what can it reach?** Most people cannot answer it. Now\nit's one command.\n\n```\n  GEIGER  ·  a Geiger counter for AI agents\n  machine dev-laptop  ·  2026-09-06 12:24 UTC  ·  read-only · no telemetry\n  ──────────────────────────────────────────────────────────────\n\n  9 findings across 3 ecosystems  ·  7 can execute code  ·  1 credential in config files\n\n  claude-code  (6)\n    Claude Code  agent\n      [EXECUTES] [BROAD-FILESYSTEM] [NETWORK]\n      origin: registry · @anthropic-ai/claude-code\n    magic (Claude Code · global)  MCP server\n      [EXECUTES] [HOLDS-SECRETS] [BROAD-FILESYSTEM]\n      origin: registry · @21st-dev/magic@latest\n      credential: \"API_KEY\" — opaque value under a credential-named key · ~/.claude.json\n      note: wrapped by a policy agent (domainguard-agent.exe) — enforcement layer in front of the server\n    hooks: UserPromptSubmit, PreToolUse  hook\n      [EXECUTES]\n      note: hooks execute without a prompt each time their event fires\n  ...\n```\n\nReal output from a real machine (values redacted — see below).\n\n| Ecosystem | What geiger reads | \n|---|---|\n| **Claude Code** | global + per-project MCP servers, hooks, plugins, skills, subagents, `apiKeyHelper` | \n| **MCP hosts** | Claude Desktop, Cursor, Windsurf, VS Code (user + project), Cline, Roo Code, Continue, Zed | \n| **Other agents** | Codex CLI, Gemini CLI, Aider, OpenCode, Qwen Code, DeepSeek Harness, Continue, GitHub Copilot CLI, Goose, Open Interpreter, LM Studio, Ollama | \n| **Editor extensions** | AI extensions in VS Code / Insiders / Cursor | \n| **Global CLIs** | agent packages in global npm roots (read directly — npm is never executed) | \n| **Browser extensions** | AI extensions in Chrome / Edge / Brave profiles, with their manifest permissions | \n\nEvery finding gets: what it is, where it came from (registry, store, git,\nlocal script, remote server — or **UNKNOWN-ORIGIN**), what it can do\n(**EXECUTES**, **HOLDS-SECRETS**, **BROAD-FILESYSTEM**, **BROAD-WEB**,\n**NETWORK**), and the evidence path so you can verify by hand.\n\nGeiger also recognizes **policy wrappers** (agents that put an enforcement\nlayer in front of MCP servers) and reports both layers instead of hiding the\nreal server behind the wrapper.\n\n1. **Read-only.** The only write geiger ever performs is the`--json` file\nyou explicitly name.\n2. **No telemetry.** Nothing leaves your machine. There is no endpoint to\nsend anything to. (This also means we have no idea how many people use\nthis — a trade we're happy with.)\n3. **Secrets by shape only.** When a credential-shaped value is found in a\nconfig, geiger reports the key name, the file, and what kind of secret it\nlooks like — never any part of the value. A redaction pass runs on all\noutput as defense-in-depth, and the test suite enforces it.\n\n```\nnpx geiger-scan                        scan, print the report\nnpx geiger-scan --html report.html     self-contained HTML report with per-finding\n                                       \"what to do\" remediation guidance\nnpx geiger-scan --json out.json        machine-readable findings (schemaVersion 1)\nnpx geiger-scan --path D:\\repo1 --path E:\\repo2\n                                       also scan these project directories for\n                                       project-level agent and MCP configs\nnpx geiger-scan --home C:\\Users\\other  scan a different home root (another user\n                                       profile, a mounted image)\nnpx geiger-scan --strict               exit 2 if anything can execute code or\n                                       holds secrets\nnpx geiger-scan --diff baseline.json   compare against an earlier --json\n                                       snapshot: what appeared, disappeared,\n                                       or escalated since then\n```\n\n**Drift alarm:** once you've reviewed a machine, save a baseline\n(`--json baseline.json`) and put `geiger-scan --strict --diff baseline.json`\nin cron or CI. It exits 2 only when something **new** can execute code or\nhold secrets — the standing, already-reviewed inventory stays quiet. Same\nmental model as a lockfile: accept what's there, alarm on change.\n\nNo npm? `npx github:Atomburstofficial/geiger` runs straight from the repo.\n\nBefore running anything, see exactly what you'd get: a\n[sample HTML report](/Atomburstofficial/geiger/blob/main/docs/sample-report.html) and a\n[sample JSON output](/Atomburstofficial/geiger/blob/main/docs/sample-report.json) live in this repo, generated\nfrom the test fixture — synthetic data, generic paths, credentials shown by\nshape only (as always). The HTML report:\n\nEvery finding that warrants action carries plain-language remediation — as\n`fix:` lines in the terminal and \"What to do\" blocks in the HTML report.\n\nFleet pattern (MSPs, IT): run with `--json` per machine on a schedule (an\nRMM task or login script writing `%COMPUTERNAME%.json` to a share), keep\neach machine's baseline, and let `--diff` report per-machine drift. The\nschema is versioned and stable. Geiger never phones home — the JSON files\ntravel only where you put them.\n\nStated up front, because a scanner you overtrust is worse than no scanner:\n\n- Geiger reads **known config locations** . Agents installed in nonstandard\npaths, other user accounts, containers, or WSL (from the Windows side)\nare not seen.\n- It reads **configuration, not runtime behavior** . It cannot tell you what\na plugin actually did — only what its position allows.\n- It cannot judge whether a package is malicious — only where it came from and what it can reach. Origin ≠ trustworthiness.\n- Partially-parseable formats (TOML configs) are scanned by shape and flagged with reduced confidence rather than skipped.\n- The ecosystem this tool audits changes weekly. Detectors are data-driven\nand small on purpose — see [CONTRIBUTING.md](/Atomburstofficial/geiger/blob/main/CONTRIBUTING.md) to add one.\n\n**Is this a security audit?** No. It's an inventory with honest exposure\nlabels — the thing you need *before* any audit means anything.\n\n**Why should I trust a security company's free scanner?** Read it. It's a\nfew hundred lines of dependency-free JavaScript, and what's published is\nwhat runs — releases are published from GitHub Actions with [npm\nprovenance](https://docs.npmjs.com/generating-provenance-statements), so the\nnpm page carries a signed link to the exact public commit each version was\nbuilt from.\n\n**What do I do about what it finds?** Individually: remove what you don't\nrecognize, rotate credentials that shouldn't be sitting in configs. At a\ncompany: that's policy enforcement, which is a different product —\n[DomainGuard](https://atomburst.io/domainguard) is how organizations put a\npolicy layer in front of this surface. Geiger stays free and standalone\neither way.\n\n[MIT](/Atomburstofficial/geiger/blob/main/LICENSE) · built by\n[Atomburst](https://atomburst.io/geiger?utm_source=github&utm_medium=readme) ·\nzero runtime dependencies, no build step — the source you read is the code\nthat runs.", "url": "https://wpnews.pro/news/geiger-see-every-ai-agent-on-your-machine-and-what-it-can-touch", "canonical_source": "https://github.com/Atomburstofficial/geiger", "published_at": "2026-09-09 14:54:49+00:00", "updated_at": "2026-09-09 15:19:34.694423+00:00", "lang": "en", "topics": ["ai-tools", "ai-safety", "ai-agents"], "entities": ["Geiger", "Claude Code", "MCP", "VS Code", "Cursor", "Windsurf", "GitHub", "Anthropic"], "alternates": {"html": "https://wpnews.pro/news/geiger-see-every-ai-agent-on-your-machine-and-what-it-can-touch", "markdown": "https://wpnews.pro/news/geiger-see-every-ai-agent-on-your-machine-and-what-it-can-touch.md", "text": "https://wpnews.pro/news/geiger-see-every-ai-agent-on-your-machine-and-what-it-can-touch.txt", "jsonld": "https://wpnews.pro/news/geiger-see-every-ai-agent-on-your-machine-and-what-it-can-touch.jsonld"}}