# mongodb/kingfisher

Detect leaked secrets + live validation. Map blast radius across your stack. Revoke fast. Hundreds of rules.

Repository: https://github.com/mongodb/kingfisher
Canonical: https://ross.abutalabs.com/products/mongodb-kingfisher
Homepage: https://mongodb.github.io/kingfisher/
Language: Rust
License: Apache-2.0
License Family: permissive
Topics: credentials, devsecops, scanning, secrets, secrets-management, security
Last push: 2026-08-25T02:43:15+00:00

## Health v2 (maintenance only)
Score: 82/100 (v2, computed 2026-09-03T02:39:23.370411+00:00)
- activity 99, release rhythm 87, longevity 34
- inputs: {"age_days": 482, "days_push": 8, "days_rel": 10, "gap_med": 3, "n_releases_24m": 104}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1214, forks 117 (observed 2026-08-28T04:04:00.935655+00:00)

## What it is
Kingfisher is an open-source, Rust-based secret scanner that detects leaked credentials in code, Git history, cloud storage, and developer platforms using SIMD-accelerated regex and language-aware parsing. It validates findings against provider APIs to confirm live secrets, maps blast radius, and supports direct revocation from the CLI.

## Use cases
- scan git repositories for leaked api keys and tokens
- validate discovered credentials against provider apis to filter false positives
- find exposed secrets in aws s3 buckets and docker images
- detect leaked tokens in slack, jira, and confluence
- map the blast radius of a leaked cloud credential
- revoke compromised secrets directly from the cli
- run secret scanning in ci pipelines with sarif output
- triage gitleaks and trufflehog findings in a browser report viewer

## When to choose
- you need high-accuracy secret detection with live validation to cut false positives
- you want to scan beyond code - chat, docs, cloud storage, and ci platforms
- you need blast radius mapping or direct revocation of leaked credentials
- you need fast, multithreaded scanning of large codebases
- you want an open-source, no-telemetry alternative to commercial secret scanners

## When to avoid
- you only need simple git history scanning and prefer a lighter tool like gitleaks
- you need a managed SaaS scanning service rather than a self-run CLI
- your secrets are custom and not covered by the built-in detection rule catalog

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, vulnerability-scanning, secrets-management, developer-tools, cli
- domain: security, developer-tools
- platform: cli, cross-platform, windows
- tags: secret-scanning, live-validation, credential-detection, blast-radius, revocation, sarif, devsecops, rust, vectorscan, false-positive-reduction, devops, command-line, docker, linux, macos

## Member repositories
- mongodb/kingfisher (main) score 82

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:00.935655+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:17:30.148258+00:00, confidence not recorded.
  - readme: https://github.com/mongodb/kingfisher (fetched 2026-08-28T04:04:00.935655+00:00, sha 05ab5c6e0386)
  - homepage: https://mongodb.github.io/kingfisher/ (fetched 2026-08-29T12:25:22.862897+00:00, sha 3179bda11513)
- Data as of 2026-08-30T08:39:29.467469+00:00.