You need Node.js 18 or above on the PC. Run npx geiger-scan to scan, and add --html report.html, --json baseline.json or --diff baseline.json for other reports.

Does Geiger show my API keys?

No. When it finds credential-like values in a config file, it reports only the key name, the config file and the credential type, not the API key itself.

What did people on Hacker News say about Geiger?

Some said it could be useful for corporate use to grasp hidden AI inside an organization. Others said an environment where such tools can count AI agent capabilities is not safe, and backups or sandboxes should be prepared.

Large Language ModelsAI Coding AssistantsGIGAZINE AI2m agoOct 12, 2026, 19:01 JST

Geiger scans your PC for hidden AI agents and MCP servers

Send on LINE

3 Key Points

What happened
Atomburstofficial published Geiger, a free read-only command, npx geiger-scan, listing AI agents like Claude Code and Codex plus MCP servers, Hooks and AI extensions in Cursor or VS Code.
Why it matters
Anyone who has installed several AI agents and extensions may no longer know what is configured on their machine, and Geiger lays that out in one report, according to its Hacker News discussion.

Not sure about something? Ask the AI

Questions and answers are published on this page.

Summaries like this, in your inbox every morning.

Get news like this every morning, free

Context & Analysis

Geiger arrives as a small command-line tool aimed at a problem that builds up quietly: after trying one agent after another, old MCP servers, plugins and AI extensions stay on the machine, and their locations and settings become hard to track. According to the project's GitHub listing, one read-only command inventories every agent, MCP server, plugin and AI extension on a machine, and the scan output covers not only agents such as Claude Code and Codex but also MCP servers, Hooks and AI extensions registered in Cursor and VS Code.

Beyond the plain list, Geiger also assembles a report when the --html option is used, producing a self-contained HTML file that can be opened in a browser to check each item's access scope, config file and recommended action. For credential-like values found in config files, Geiger reports only the key name, the config file and the kind of credential, not the API key itself, so the report can be shared without exposing secrets.

It also supports comparison over time: --json saves the current state as baseline.json, and --diff compares that file with the current state to show what changed. On the social news site Hacker News, the tool drew mixed reactions — some saw it as useful for corporate use to grasp hidden AI inside an organization, while others argued that an environment where such a tool can count AI agent capabilities is not safe and that backups or sandboxes should be prepared.

FAQ

How do I run Geiger?: You need Node.js 18 or above on the PC. Run npx geiger-scan to scan, and add --html report.html, --json baseline.json or --diff baseline.json for other reports.
Does Geiger show my API keys?: No. When it finds credential-like values in a config file, it reports only the key name, the config file and the credential type, not the API key itself.
What did people on Hacker News say about Geiger?: Some said it could be useful for corporate use to grasp hidden AI inside an organization. Others said an environment where such tools can count AI agent capabilities is not safe, and backups or sandboxes should be prepared.

GIGAZINE AIRead Original Article

Send on LINE

AI news that matters for your work, delivered every morning.

Pick your industry and the AI tools you use, and get news related to your work every day.

Get it free

Free · 30 seconds with Google · unsubscribe anytimeWhat is AIToday? →

Ask AI

Ask AI anything about this article. The AI reads this article, earlier AIToday articles, and Wikipedia, and cites its sources. Q&As are published on this page for other readers too.