The Geiger AI agent scanner is a free command-line tool that inventories every AI agent, MCP server, plugin, and browser extension installed on your machine, then tells you in plain language what each one can actually reach. You run one command, it reads your existing config files, and it prints a report — nothing gets installed and nothing gets sent anywhere.
Short answer: Geiger is a free, open-source command that scans your machine and lists every AI agent, MCP server, plugin, and browser extension it finds, tagging each one EXECUTES, HOLDS-SECRETS, BROAD-FILESYSTEM, BROAD-WEB, or NETWORK. Run
npx geiger-scan— no install, no account, no telemetry, and it writes nothing unless you ask for a JSON file.
What you'll need
You need Node.js 18 or newer and a terminal — that's it. Geiger ships as the npm package geiger-scan, and you run it through npx so nothing gets installed on your system beyond a temporary npx cache. It works on Windows, macOS, and Linux, and it only reads files: your Claude Code config, MCP host settings for Cursor, Windsurf, VS Code, and Cline, plus CLI configs for Codex, Gemini CLI, and a dozen other agent runtimes, along with browser extension manifests. There's no account to create and no API key to paste in. If you don't have Node installed, grabbing the current LTS release takes about five minutes; everything downstream of that is a single command.
Step-by-step: running the Geiger AI agent scanner
1. Open a terminal and run the scan
“ npx geiger-scan “
In my test on a Linux box that's been running Claude Code for months, this printed a result in under a few seconds — no prompts, no confirmation dialog, just a report. Geiger checked npm's registry for the latest version, read local config directories, and exited.
2. Read the summary line first
The first real line of output is the one that matters: mine read "3 findings across 2 ecosystems · 2 can execute code · 0 credentials in config files." That's your headline number before you scroll into details — how many things were found, how many can run code on their own, and how many are holding something that looks like a credential.
3. Work through each finding's exposure tags
Every finding gets grouped by ecosystem (claude-code, npm-global, and so on) and carries one or more tags: EXECUTES, HOLDS-SECRETS, BROAD-FILESYSTEM, BROAD-WEB, NETWORK. My scan flagged the Claude Code CLI itself with EXECUTES, BROAD-FILESYSTEM, and NETWORK — accurate, since it's a coding agent that runs shell commands as my user. A locally-installed skill I use for SEO writing showed up too, with no exposure tags, because it's just instructions loaded into the agent, not something that runs on its own.
4. Check the evidence path for anything you don't recognize
Each finding lists exactly where Geiger found it — a file path, a registry reference, a directory. That's deliberate: the tool wants you to verify by hand rather than take its word for it. If a finding names an MCP server you don't remember installing, that evidence path is where you go look.
5. Save a baseline and watch for drift
Once you've reviewed a machine and you're comfortable with what's on it, run npx geiger-scan --json baseline.json to save that state. From then on, npx geiger-scan --strict --diff baseline.json only complains about new things that can execute code or hold secrets, so a scheduled task or cron job stays quiet until something actually changes.
Commands you can copy
These are close to the exact commands I ran while testing:
npx geiger-scan— the default scan, printed straight to the terminal.npx geiger-scan --html report.html— a self-contained HTML report with per-finding "what to do" remediation notes, useful for sharing with someone who won't read a terminal dump.npx geiger-scan --json out.json— machine-readable output. I used this to confirm the tool's own claim that it writes nothing else to disk; it didn't.npx geiger-scan --path /home/me/side-project— also scans a project directory for repo-level agent and MCP configs, not just your home folder.npx geiger-scan --strict— exits with code 2 if anything found can execute code or holds a credential. I confirmed this: my scan, which had two EXECUTES findings, returned exit code 2 exactly as documented.
Common mistakes to avoid
The mistake I'd flag first: treating a clean scan as a security audit. Geiger says this about itself, and it's right — it inventories what's configured, not what a plugin actually did at runtime, and it can't tell a malicious package from a legitimate one just by where it came from. Second, don't ignore a finding just because it has no EXECUTES tag; a skill or prompt file with no exposure labels can still steer an agent that does have broad access, which is a big part of why prompt injection against agents holding real permissions is such a live problem. Third, don't skip the evidence path — I nearly did, and it's the only way to tell a stale, harmless leftover config from something you should actually rotate credentials over. Fourth, running --strict in CI without a baseline first will fail on your very first commit, since anything with EXECUTES trips it; save a baseline before you wire it into automation. Fifth, remember Geiger only reads known config locations — agents installed in nonstandard paths, other user accounts, or containers won't show up, so a clean report on one machine says nothing about the others.
How Geiger compares to other ways to check agent exposure
| Approach | Scope | Cost | What it actually gives you |
|---|---|---|---|
Geiger (geiger-scan) |
One machine, all agents/MCP/plugins on it | Free, MIT license, open source | Read-only inventory with exposure tags and evidence paths |
| Manually checking dotfiles | One machine | Free (your time) | Whatever you personally remember to look for — easy to miss a plugin |
| Fleet-wide agent visibility platforms | Many machines, org-wide | Paid, enterprise pricing | Centralized inventory plus secret-leak monitoring across a whole team |
| Runtime sandboxing (bubblewrap/pasta-style isolation) | One machine, per running agent | Free or bundled with the agent platform | Contains what a running agent can reach; doesn't inventory what's installed |
Geiger and sandboxing solve different problems. Geiger tells you what's sitting on the machine and what it's configured to reach; it doesn't stop anything from happening. If you want the containment side of that equation, my piece on Docker sandboxes for AI agents covers tools that isolate what a running agent can actually touch, which is the natural next step after a Geiger scan tells you what needs isolating.
Tools that make this easier
If Geiger's Claude Code detector turns up MCP servers or hooks you don't remember wiring in, my mission for Claude Code piece explains how CLAUDE.md standing instructions and project-level configs accumulate over time — often the exact source of a stale finding. If you're building or auditing your own MCP servers rather than just consuming them, MCP Builder AI is worth a look before you add one more entry to your next scan. Multi-agent setups get harder to inventory the more agents you run: the self-hosted company OS for Claude Code and Codex agents I tested recently runs several agents in departments, and a tool like Geiger is exactly what I'd point at that box before trusting it with real work. For ongoing visibility into what your agents are doing and spending, not just what's installed, Claude Code usage tracking by LangWatch is the closer analog to a live dashboard. And if you want a concrete example of why any of this matters, read what happened when a security researcher’s own AI agent deleted her emails — the kind of BROAD-FILESYSTEM access Geiger flags in seconds.
My take
Geiger does one narrow thing honestly. The project’s own README explains the motivation plainly: an unnamed open-source agent harness went from zero to more than 200,000 GitHub stars in three weeks in August 2026, its plugin ecosystem passed 13,000 repositories in the same window, and most of those installs are programs that can execute commands and hold credentials, sitting in dotfiles nobody rereads. When someone on the Show HN thread joked about prepping for an AI apocalypse, the author replied: "The radiation was already there — I just built the counter." That's a fair description of what I got when I ran it: not a fix, just an honest count of what's already running and what it can reach. Run it once on any machine where you've installed more than one AI tool. It takes less time than reading this article.
Frequently Asked Questions
Is the Geiger AI agent scanner free?
Yes. It's MIT-licensed and open source, with zero runtime dependencies. There's no paid tier, no account, and no feature gate — npx geiger-scan runs the whole thing.
How long does a scan take?
A few seconds in my test, plus whatever time npx spends fetching the package the first time you run it. There's no crawling or network scanning involved — it only reads local config files and directories.
What is the easiest way to try it?
Open a terminal on any machine where you use Claude Code, Cursor, Copilot, or a similar AI tool, and run npx geiger-scan. Read the summary line first, then work through any finding tagged EXECUTES or HOLDS-SECRETS.
Does a clean Geiger scan mean my setup is safe?
No. Geiger inventories what's configured, not what any plugin does at runtime, and it can't judge whether a package is malicious versus just broadly permissioned. Treat it as the starting inventory before an actual review, not the review itself.
Does Geiger send any data anywhere?
No. The project states it has no telemetry and no endpoint to send data to; the only file it ever writes is one you explicitly name with --json or --html. I confirmed this by running it with --json and checking that no other files appeared.