Browse / Agent tools
mongodb/kingfisher
Detect secrets + live validation. Map blast radius. Revoke fast. Use the CLI or embed in Rust and Python.
- secrets
- CLI
Works.Tested on 2026-10-28. From the README alone, on Linux with Haiku.
What we checked
Does it run from the README?Yes. Running in 10:06 on a clean Linux box.The run
Tested Oct 28, 2026, rev 5794966.
Does it do what the README says?2 of 2 claims held up.Evidence
“Scanning a directory with --format json reports the leaked GitHub token and exits 200 when findings are present”
Expected JSON output containing the github-pat finding, exit code 200. Got github-pat.
“The --output option writes the JSON report to a file”
Expected findings.json file containing the github-pat finding. Got github-pat.
Which setups did we try?Works with Haiku. Unverified with Luna.Setups
Linux / Haiku: works, Oct 28, rev 5794966. Linux / Luna: unverified, Oct 28, rev 5794966.
Needs keys, a login or a browser?No.Details
None seen
Is it safe to run?Made outbound HTTPS connections: yes (hosts not recorded) by <guest-path>, <guest-path>What we saw
Review signals across current setups: connection review. 397 listed items (named-host connections, static matches, dependency advisories) are below and do not change this verdict. 182 static matches retained as context.
Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 10 distinct locations. 2 findings. 25 attributed processes.
Source contains download and execute; review its purpose. 2 distinct locations. 3 findings.
Gitleaks found a possible hardcoded secret; value withheld. 47 distinct locations. 164 findings.
OSV reports a known vulnerability in this dependency version. 19 distinct locations. 29 findings.
Reviewed as expected for a test run: attempted writes that failed, so nothing was written.
Reviewed as expected for a test run: wrote only to its own open file handles.
Full event, path and process lists for each observed setup:
A quiet run is not a safety guarantee.
Is it maintained?Maintained · 199 commits in 90 days · 41 merged PRs in 90 days · 6 open issues · 7 open PRsActivity
actively maintained: last commit 0 days ago; 199 commits and 41 merged PRs in 90 days; 6 open issues, 7 open PRs; 22 of 23 recent threads got a maintainer reply, median first reply 22.9h; latest release 2026-10-28
Can I show this on my README?Copy the badge.Badge
The run
Oct 28 · rev 5794966Independent test, not endorsed by the project.