Geiger: Inventorying AI Agents and MCP Servers for Machine Security

Geiger provides a single-command inventory of every AI agent, Model Context Protocol (MCP) server, plugin, and AI extension installed on a machine. It identifies what these tools can access—such as the filesystem, network, or stored credentials—allowing users to understand their machine's attack surface in an era of rapidly proliferating AI agent harnesses.

Core Functionality and Security Model

Geiger operates as a read-only scanner that identifies AI tools by analyzing known configuration locations and directories. It does not execute the agents it finds, nor does it monitor their runtime behavior; instead, it maps the potential capabilities granted to them based on their configuration.

The Three Security Promises

To ensure the tool does not become a security risk itself, Geiger adheres to three strict constraints:

  1. Read-only Operation: The tool never writes to the disk unless the user explicitly requests a JSON or HTML report via flags.
  2. Zero Telemetry: No data leaves the machine. The tool has no external endpoints and does not track usage statistics.
  3. Secrets Protection: Geiger identifies the presence of credentials by "shape" (e.g., recognizing a key named API_KEY), but it never outputs the actual value of the secret.

Detection Capabilities

Geiger scans across multiple ecosystems to provide a comprehensive view of the AI footprint on a system. Each finding is labeled with its origin (registry, git, local script, etc.) and its exposure level.

Supported Ecosystems

  • Claude Code & MCP Hosts: Detects global and project-level MCP servers, hooks, and plugins for Claude Desktop, Cursor, Windsurf, VS Code, Cline, Roo Code, Continue, and Zed.
  • General AI Agents: Identifies installations of Aider, Open Interpreter, GitHub Copilot CLI, Goose, LM Studio, Ollama, and various CLI tools from Gemini, Grok, and DeepSeek.
  • Editor & Browser Extensions: Scans for AI extensions in VS Code, Cursor, and major browsers (Chrome, Edge, Brave, Firefox), including their granted permissions.
  • IDE Integrations: Identifies AI Assistant and MCP settings within JetBrains IDEs.

Exposure Labels

Findings are categorized by what the agent is permitted to do, using labels such as:

  • EXECUTES: The agent can execute code on the machine.
  • BROAD-FILESYSTEM: The agent has wide access to the filesystem.
  • HOLDS-SECRETS: The agent's configuration contains credentials.
  • NETWORK / BROAD-WEB: The agent has network or broad web access.

Usage and Fleet Management

Geiger is distributed as a dependency-free JavaScript package that can be run without installation via npx geiger-scan.

Operational Modes

  • Baseline and Drift Detection: Users can save a machine state to a JSON file (--json baseline.json) and use the --diff flag in subsequent scans. When combined with --strict, the tool exits with a code 2 if any new capabilities (like code execution) are introduced, enabling it to function as a "lockfile" for machine security.
  • Reporting: Beyond terminal output, Geiger generates self-contained HTML reports that include plain-language remediation guidance for each finding.
  • Enterprise Deployment: For Managed Service Providers (MSPs) or IT departments, Geiger can be run as a scheduled task to write JSON reports to a central share, allowing for the monitoring of "Shadow AI" across an organization.

Technical Limitations

Geiger is an inventory tool, not a full security audit. Its effectiveness is limited by the following:

  • Known Paths: It only reads known configuration locations; agents in non-standard paths, containers, or WSL (when scanned from Windows) are not detected.
  • Static Analysis: It reads configuration, not runtime behavior. It cannot determine what a plugin actually did, only what it is permitted to do.
  • No Maliciousness Detection: It identifies where a package came from and what it can reach, but it does not judge if the package is malicious.

Community Insights

Users on Hacker News have emphasized the importance of isolation when running AI agents. One contributor noted:

You really want to run these in a way so they cannot touch your system drive/general filesystem that you use to do real work on. Even SOTA models at the end of their context limit behave REALLY illogical and does mistakes frequently.

Other discussions highlighted the potential for Geiger to be used by governance companies to track "Shadow AI"—the unauthorized use of AI tools within corporate environments.

Sources

Related

  • Dispatch
    MakerChecker: Open-Source Security Gateway and Static Scanner for AI Agents

    MakerChecker provides a security layer for AI agents featuring static risk scanning, role-based access control (RBAC), and cryptographically signed audit logs to prevent agents from approving their own work.

  • Project
    NVIDIA/SkillSpector

    SkillSpector is an open‑source NVIDIA tool that scans AI‑agent skills (plugins, prompts, code) for security problems. It supports static analysis of 71 known vulnerability patterns, optional LLM‑based semantic checks, live CVE look‑ups, baseline suppression, and multiple output formats (terminal, JSON, Markdown, SARIF). It can run as a CLI, Docker container, or MCP server, making it useful for developers, CI pipelines, and production agents.

  • Project
    sickn33/agentic-awesome-skills

    AAS Core (Agentic Awesome Skills) is a preview‑stage, open‑source toolkit that lets LLM agents (Codex, Claude, etc.) search a local catalog of 2 115+ reusable instruction “skills”, pick exact IDs for a project, and produce a validated, immutable manifest (`aas‑stack.json`). The core is read‑only: it validates IDs, does not rank or execute them. A CLI can preview a plan, audit risk, and dry‑run a direct installer that copies selected skill directories into `~/.agents/skills`. Specialized plugins bundle related skills for domains like web‑app building or security. The system is designed for auditability and offline control, with safety warnings that it does not certify semantic suitability and that apply/recovery features are experimental.

  • Project
    thalesgroup-cert/Watcher

    An AI-powered cybersecurity threat detection platform that automates the discovery and monitoring of emerging threats, data leaks, and malicious domains.

  • Project
    cisco-ai-defense/skill-scanner

    A security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code using static analysis, behavioral dataflow, and LLM-based semantic analysis.