Kingfisher

The Batteries-Included Open Source Secret Scanner

Find exposed credentials, verify which are active, map what they can reach, triage findings visually, and revoke supported secrets.

  1. Detect
  2. Validate
  3. Map
  4. Triage
  5. Revoke

The end-to-end defender workflow in one Apache-2.0-licensed Rust tool, built by MongoDB.

Get Started View on GitHub
485 Detection Rules
43 Blast Radius Providers
15+ Scan Targets
34 Rules with Revocation

From Exposure to Containment

Go beyond matching patterns. Kingfisher connects detection, verification, impact analysis, investigation, and supported remediation in one workflow.

Detect Across Your Estate

Files, Git repos, GitHub, GitLab, Azure Repos, Bitbucket, Gitea, Hugging Face, Docker images, AWS S3, Google Cloud Storage, Jira, Confluence, Slack, and Microsoft Teams.

Live Validation

Automatically validate discovered credentials against provider APIs. Eliminate false positives by confirming which secrets are actually live and active.

Blast Radius Mapping

Map leaked keys to their identities, permissions, and exposed resources. All 43 providers—including AWS and GCP—ship in the open-source release, with scan-integrated and standalone workflows.

Visual Triage

Investigate, filter, deduplicate, and export findings in a browser-based report viewer. Import common report formats to enrich an existing scanning workflow with Kingfisher's validation and remediation data.

Direct Revocation

Contain compromised credentials from the CLI across 34 rules and 15 provider families—even when the original owner is unknown or has left the company.

Batteries Included

Validation, advanced AWS and GCP blast-radius analysis, visual triage, and supported revocation ship in the Apache-2.0 release instead of a separate commercial tier.

Built for Accuracy

Lightweight parser-based context verification across 16 supported languages reduces false positives at the detection layer. Combined with entropy filtering, checksum verification, and live validation, Kingfisher delivers high-signal results you can act on.

Built for AI

Detects and validates tokens for 35+ AI/ML providers including OpenAI, Anthropic, Google Gemini, Mistral, Cohere, and more. Purpose-built TOON output format for token-efficient LLM and agent workflows.

Built for Speed

Rust-powered with Intel Hyperscan SIMD-accelerated regex. Multithreaded scanning handles massive codebases while making minimal network requests through intelligent validation.

Performance

Kingfisher scans the Linux kernel in 205 seconds and the GitLab monorepo with just 17 HTTP validation requests. Intelligent validation means fewer API calls and faster results at scale.

Kingfisher Runtime Comparison across major open source repositories

See full benchmark methodology and results

Scan Targets

Files Files / Dirs
Git Local Git
GitHub GitHub
GitLab GitLab
Azure Repos Azure Repos
Bitbucket Bitbucket
Gitea Gitea
Hugging Face Hugging Face
Docker Docker
Jira Jira
Confluence Confluence
Slack Slack
Microsoft Teams Teams
AWS S3 AWS S3
Google Cloud Storage Cloud Storage

Install in Seconds

Homebrew

brew install kingfisher

PyPI

uv tool install kingfisher-bin

Docker

docker run --rm -v "$PWD":/src ghcr.io/mongodb/kingfisher:latest scan /src

Script

curl -sSL https://raw.githubusercontent.com/mongodb/kingfisher/main/scripts/install-kingfisher.sh | bash
Full Installation Guide