mongodb/kingfisher
Detect leaked secrets + live validation. Map blast radius across your stack. Revoke fast. Hundreds of rules. observed · 2026-08-28
Health v2 · maintenance only
82/100
- Activity 99
- Release rhythm 87
- Longevity 34
How is this computed?
round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-03. Adoption (stars, forks) is never an input.
- gap_med: 3
- age_days: 482
- days_rel: 10
- days_push: 8
- n_releases_24m: 104
Adoption not part of the score
1214 stars · 117 forks observed · 2026-08-28
What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded
Kingfisher is an open-source, Rust-based secret scanner that detects leaked credentials in code, Git history, cloud storage, and developer platforms using SIMD-accelerated regex and language-aware parsing. It validates findings against provider APIs to confirm live secrets, maps blast radius, and supports direct revocation from the CLI.
Use cases
- scan git repositories for leaked api keys and tokens
- validate discovered credentials against provider apis to filter false positives
- find exposed secrets in aws s3 buckets and docker images
- detect leaked tokens in slack, jira, and confluence
- map the blast radius of a leaked cloud credential
- revoke compromised secrets directly from the cli
- run secret scanning in ci pipelines with sarif output
- triage gitleaks and trufflehog findings in a browser report viewer
When to choose
- you need high-accuracy secret detection with live validation to cut false positives
- you want to scan beyond code - chat, docs, cloud storage, and ci platforms
- you need blast radius mapping or direct revocation of leaked credentials
- you need fast, multithreaded scanning of large codebases
- you want an open-source, no-telemetry alternative to commercial secret scanners
When to avoid
- you only need simple git history scanning and prefer a lighter tool like gitleaks
- you need a managed SaaS scanning service rather than a self-run CLI
- your secrets are custom and not covered by the built-in detection rule catalog
Facets
cli-tool · maturity active
security vulnerability-scanning secrets-management developer-tools cli security developer-tools cli cross-platform windows secret-scanning live-validation credential-detection blast-radius revocation sarif devsecops rust vectorscan false-positive-reduction devops command-line docker linux macos
2 sources
- readme: https://github.com/mongodb/kingfisher · fetched 2026-08-28 · 05ab5c6e0386
- homepage: https://mongodb.github.io/kingfisher/ · fetched 2026-08-29 · 3179bda11513
Member repositories
| Repository | Role | Health v2 |
|---|---|---|
| mongodb/kingfisher | main | 82 |
For agents
markdown · JSON · MCP: product_card(name="mongodb/kingfisher")
Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem