OSS
Geiger inventories every AI agent, MCP server and extension on a machine and alarms on capability drift
Geiger runs as `npx geiger-scan`: read-only, no telemetry. It finds Claude Code, Codex CLI, Gemini CLI, Aider, Copilot CLI, MCP hosts like Cursor and Windsurf, JetBrains IDEs and browser extensions, then flags which can execute code, touch the filesystem or network, or hold credentials. It reports credentials by shape, never by value. Version 0.2.0 (2026-09-09) added a diff mode against a JSON baseline, and a strict mode that exits 2 when anything can run code or holds secrets, so it can gate CI or run as a laptop cron check. The repo is small (106 stars, MIT) and the Show HN drew 47 points.
Source
↳ Follow the thread