Geiger is a read-only command that inventories every AI agent, MCP server, plugin, and AI extension on a machine, reporting in plain language what each can access. It requires no installation, account, or telemetry, and only writes when explicitly asked to output a JSON file.

The tool emerged from concerns about the rapid growth of open-source agent harnesses, which saw over 200,000 GitHub stars and 13,000 plugin repositories in three weeks. These installs can execute commands, read files, and hold credentials, often configured in overlooked dotfiles. Geiger answers the question: what is running on this machine and what can it reach?

A scan output shows findings across ecosystems like Claude Code, MCP servers, and browser extensions, detailing capabilities such as code execution, filesystem access, and credential storage. It also identifies policy wrappers and reports both layers.

Geiger promises read-only operation, no telemetry, and reports secrets only by shape—never revealing values. Usage includes npx commands for scanning, HTML reports, and JSON output.