GoKawiilNew CLI tool 'geiger' audits every AI agent and MCP server on a computer
A developer released geiger, a free command-line utility that scans a machine for installed AI agents, harnesses, MCP servers, plugins and extensions, then reports in plain language what each one can access. It runs via npx with no installation or account required, only reads configuration files and directories, and writes nothing to disk unless a JSON export is explicitly requested.
GoKawiil's interpretation of the reporting above, not reported fact.
AI coding agents and plugin ecosystems have exploded in popularity, often installed casually through one-click clients or social media tutorials, yet these tools can execute commands, read files and store credentials in dotfiles that most users never inspect. A simple, transparent auditing tool addresses a growing blind spot in personal and enterprise security as AI agent sprawl accelerates faster than most people's awareness of what permissions they've granted.
- Geiger scans a machine and lists every AI agent, MCP server, hook and plugin along with its capabilities.
- It flags risky properties like code execution, broad filesystem access, network access and stored credentials.
- The tool requires no installation, account or telemetry, and only performs read-only operations by default.
YubiKey 5C NFC Security Key — If a scan like Geiger's makes you realize how many AI agents and plugins are holding your credentials, a hardware security key is the natural next step. The YubiKey 5C NFC adds a physical touch requirement for logins on GitHub, Google, and password managers, so a rogue script on your machine can't quietly authenticate as you. It's pocket-sized, works over USB-C and NFC, and needs no batteries.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: github.com, 2026-09-09
Published there as: “Show HN: Geiger – See every AI agent on your machine and what it can touch”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.