Repolode
Submit
mongodb

mongodb/kingfisher

A Rust-based secret scanner that detects leaked credentials, validates which are live, maps their access, and supports revocation.

View on GitHubWebsite
Stars
1,271
Forks
122
Open issues
13
Last commit
2 days ago

What is it?

Kingfisher scans source code, Git history, archives, container images, cloud object storage, and developer platforms such as GitHub, GitLab, Jira, Confluence, Slack and Postman for leaked secrets. It uses hundreds of built-in detection rules, including Betterleaks TOML and Kingfisher YAML formats, and checks with live provider APIs whether a discovered credential is still active.

For supported providers, the blast-radius mode maps what a live credential can reach, such as AWS roles, GCP service-account impersonation, and affected resource scopes. Revocation is opt-in and limited to provider-specific workflows. Results can be exported as JSON, SARIF, HTML or BSON, or reviewed in a local or hosted browser viewer that also imports Gitleaks and TruffleHog reports.

Kingfisher ships as a CLI installable via Homebrew, PyPI or Docker, and can also be embedded in Rust applications through the kingfisher-scanner crate or in Python through the kingfisher_sdk module.

Key features

  • 01Detects secrets with hundreds of built-in rules and supports custom rules in TOML or YAML.
  • 02Validates whether discovered credentials are live using provider APIs.
  • 03Maps identity, permissions and reachable resources for supported credentials with --blast-radius.
  • 04Scans Git history, staged changes, archives, SQLite databases and Python bytecode.
  • 05Connects to GitHub, GitLab, Azure Repos, S3, GCS, Azure Blob, Docker and collaboration tools.
  • 06Outputs JSON, SARIF, HTML and other formats, with a built-in report viewer.

Use cases

  • Scanning a repository or its history for leaked keys before committing or in CI.
  • Auditing cloud storage buckets or container images for exposed credentials.
  • Triaging a large set of findings and determining which credentials are still active.
  • Responding to an incident by revoking a supported leaked token and checking its reach.

Quick start

  1. 1

    Install the Kingfisher CLI using the install method in the README

  2. 2

    Scan a local directory or repository, including its Git history, and output JSON

    kingfisher scan /path/to/code --format json

Things to know

  • Revocation and blast-radius analysis only cover supported providers and credentials.
  • Scanning many remote platforms requires API tokens for each service.

Topics

#secret-scanning#security#sast#credentials#devsecops#static-analysis#rust#pre-commit#dynamic-analysis#husky

FAQ

What is kingfisher?
A Rust-based secret scanner that detects leaked credentials, validates which are live, maps their access, and supports revocation. Kingfisher scans source code, Git history, archives, container images, cloud object storage, and developer platforms such as GitHub, GitLab, Jira, Confluence, Slack and Postman for leaked secrets. It uses hundreds of built-in detection rules, including Betterleaks TOML and Kingfisher YAML formats, and checks with live provider APIs whether a discovered credential is still active.
Is kingfisher free to use? What license does it have?
kingfisher is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is kingfisher still maintained?
Actively maintained. The last commit to kingfisher was on Oct 20, 2026.
What can I use kingfisher for?
Scanning a repository or its history for leaked keys before committing or in CI. Auditing cloud storage buckets or container images for exposed credentials. Triaging a large set of findings and determining which credentials are still active. Responding to an incident by revoking a supported leaked token and checking its reach.
How do I install kingfisher?
Install the Kingfisher CLI using the install method in the README Scan a local directory or repository, including its Git history, and output JSON: kingfisher scan /path/to/code --format json
Where can I get kingfisher?
The source code and installation instructions are on GitHub: https://github.com/mongodb/kingfisher

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects