Show HN：Geiger——查看机器上的所有 AI Agent 及其可访问范围

面向 AI Agent 的盖革计数器。

一条只读命令即可清点机器上的每一个 AI Agent、运行框架、MCP 服务器、插件和 AI 扩展，并用通俗语言说明每一个组件能够访问什么。

无需安装，无需账号，无遥测。它读取配置和目录，不写入任何内容（除非你指定 --json yourfile.json）。

2026 年 8 月，一个开源 Agent 运行框架在三周内从零增长到超过 20 万个 GitHub Star。其插件生态系统也在同期突破 13,000 个仓库。它发布当天便出现了一键安装的桌面客户端。如今，Instagram 轮播帖甚至开始教办公室员工安装全套工具。

每一项安装都是一个可执行命令、读取文件并持有凭据的程序——它们配置在没人会仔细查看第二次的 dotfile 中。问问自己这个工具所回答的问题：这台机器上实际运行着什么，它们能够触及什么？ 大多数人无法回答。现在，只需一条命令。

  GEIGER  ·  a Geiger counter for AI agents
  machine dev-laptop  ·  2026-09-06 12:24 UTC  ·  read-only · no telemetry
  ──────────────────────────────────────────────────────────────

  9 findings across 3 ecosystems  ·  7 can execute code  ·  1 credential in config files

  claude-code  (6)
    Claude Code  agent
      [EXECUTES] [BROAD-FILESYSTEM] [NETWORK]
      origin: registry · @anthropic-ai/claude-code
    magic (Claude Code · global)  MCP server
      [EXECUTES] [HOLDS-SECRETS] [BROAD-FILESYSTEM]
      origin: registry · @21st-dev/magic@latest
      credential: "API_KEY" — opaque value under a credential-named key · ~/.claude.json
      note: wrapped by a policy agent (domainguard-agent.exe) — enforcement layer in front of the server
    hooks: UserPromptSubmit, PreToolUse  hook
      [EXECUTES]
      note: hooks execute without a prompt each time their event fires
  ...

来自真实机器的真实输出（数值已脱敏，见下文）。

每个发现项都会说明：它是什么、来自哪里（注册表、应用商店、git、本地脚本、远程服务器，或者 UNKNOWN-ORIGIN）、它能做什么（EXECUTES、HOLDS-SECRETS、BROAD-FILESYSTEM、BROAD-WEB、NETWORK），以及便于你手动验证的证据路径。

Geiger 还能够识别策略包装器（即在 MCP 服务器前设置强制执行层的 Agent），并同时报告这两个层级，而不是让包装器掩盖真实服务器。

1. 只读。 geiger 唯一会执行的写入操作，是你明确指定的 --json 文件。

2. 无遥测。 没有任何内容会离开你的机器。没有可向其发送任何数据的端点。（这也意味着我们不知道有多少人在使用它——这是我们乐于接受的取舍。）

3. 仅按形态识别密钥。 当在配置中发现看似凭据的值时，geiger 会报告键名、文件及其看起来属于哪种密钥——绝不报告值的任何部分。所有输出都会经过脱敏处理，作为纵深防御措施；测试套件也会强制执行这一点。

   npx geiger-scan scan, print the report npx geiger-scan --html report.html self-contained HTML report with per-finding "what to do" remediation guidance npx geiger-scan --json out.json machine-readable findings (schemaVersion 1) npx geiger-scan --path D:\repo1 --path E:\repo2 also scan these project directories for project-level agent and MCP configs npx geiger-scan --home C:\Users\other scan a different home root (another user profile, a mounted image) npx geiger-scan --strict exit 2 if anything can execute code or holds secrets npx geiger-scan --diff baseline.json compare against an earlier --json snapshot: what appeared, disappeared, or escalated since then

漂移告警：在审查过一台机器后，保存一份基线（--json baseline.json），并将 geiger-scan --strict --diff baseline.json 放进 cron 或 CI。只有当有新的组件能够执行代码或持有密钥时，它才会以退出码 2 结束——持续存在且已审查的清单将保持安静。其心智模型与 lockfile 相同：接受当前已有内容，对变更发出告警。

没有 npm？npx github:Atomburstofficial/geiger 可直接从仓库运行。

报告是什么样的

在运行任何内容前，先查看你将获得的确切结果：本仓库中提供了一个示例 HTML 报告和一个示例 JSON 输出。它们由测试夹具生成，使用合成数据和通用路径，凭据始终仅按形态展示。HTML 报告如下：

每个需要采取行动的发现项都会附带通俗的修复建议：在终端中显示为 fix: 行，在 HTML 报告中显示为“该怎么做”区块。

设备群模式（MSP、IT）：按计划在每台机器上使用 --json 运行（例如，通过 RMM 任务或登录脚本将 %COMPUTERNAME%.json 写入共享目录），保留每台机器的基线，并让 --diff 报告按机器维度的配置漂移。该 schema 已版本化且保持稳定。Geiger 绝不会向外回传数据——JSON 文件只会传输到你指定的位置。

以下内容提前说明，因为过度信任的扫描器比没有扫描器更糟：

• Geiger 读取的是已知配置位置。安装在非标准路径、其他用户账户、容器中，或从 Windows 侧访问的 WSL 中的 Agent，不会被发现。
• 它读取的是配置，而不是运行时行为。它无法告诉你一个插件实际做了什么——只能告诉你其所处位置允许它做什么。
• 它无法判断软件包是否恶意——只能说明它来自哪里，以及它能够触及什么。来源 ≠ 可信度。
• 对于只能部分解析的格式（TOML 配置），它会按形态扫描，并以较低置信度标记，而不会跳过。
• 本工具审计的生态系统每周都在变化。检测器以数据驱动，并且有意保持小巧——参见 CONTRIBUTING.md 以添加检测器。

这是一项安全审计吗？ 不是。这是一份带有诚实暴露标签的清单——在任何审计具有意义之前，你需要先拥有它。

为什么我应该信任一家安全公司的免费扫描器？ 阅读它。它只有几百行零依赖 JavaScript，发布出来的内容就是实际运行的内容——版本通过 GitHub Actions 发布，并带有 npm provenance，因此 npm 页面会为每个版本附上指向其构建所用确切公开提交的签名链接。

我该如何处理它发现的内容？ 对个人而言：删除你不认识的内容，轮换不应放在配置中的凭据。对企业而言：那属于策略执行，是另一种产品——DomainGuard 可让组织在这一攻击面前设置策略层。无论如何，Geiger 都保持免费且独立。

MIT · 由 Atomburst 构建 · 零运行时依赖，无构建步骤——你读到的源代码就是实际运行的代码。

A Geiger counter for AI agents.

One read-only command that inventories every AI agent, harness, MCP server, plugin, and AI extension on a machine — and tells you, in plain language, what each one can touch.

No install. No account. No telemetry. Reads configs and directories, writes nothing (unless you ask for --json yourfile.json).

In August 2026, an open-source agent harness went from zero to 200,000+ GitHub stars in three weeks. Its plugin ecosystem passed 13,000 repositories in the same window. One-click desktop clients appeared the same day it launched. Instagram carousels now teach office workers to install all of it.

Every one of those installs is a program that can execute commands, read files, and hold credentials — configured in dotfiles nobody looks at twice. Ask yourself the question this tool answers: what is actually running on this machine, and what can it reach? Most people cannot answer it. Now it's one command.

  GEIGER  ·  a Geiger counter for AI agents
  machine dev-laptop  ·  2026-09-06 12:24 UTC  ·  read-only · no telemetry
  ──────────────────────────────────────────────────────────────

  9 findings across 3 ecosystems  ·  7 can execute code  ·  1 credential in config files

  claude-code  (6)
    Claude Code  agent
      [EXECUTES] [BROAD-FILESYSTEM] [NETWORK]
      origin: registry · @anthropic-ai/claude-code
    magic (Claude Code · global)  MCP server
      [EXECUTES] [HOLDS-SECRETS] [BROAD-FILESYSTEM]
      origin: registry · @21st-dev/magic@latest
      credential: "API_KEY" — opaque value under a credential-named key · ~/.claude.json
      note: wrapped by a policy agent (domainguard-agent.exe) — enforcement layer in front of the server
    hooks: UserPromptSubmit, PreToolUse  hook
      [EXECUTES]
      note: hooks execute without a prompt each time their event fires
  ...

Real output from a real machine (values redacted — see below).

Every finding gets: what it is, where it came from (registry, store, git, local script, remote server — or UNKNOWN-ORIGIN), what it can do (EXECUTES , HOLDS-SECRETS , BROAD-FILESYSTEM , BROAD-WEB , NETWORK), and the evidence path so you can verify by hand.

Geiger also recognizes policy wrappers (agents that put an enforcement layer in front of MCP servers) and reports both layers instead of hiding the real server behind the wrapper.

1. Read-only. The only write geiger ever performs is the --json file you explicitly name.
2. No telemetry. Nothing leaves your machine. There is no endpoint to send anything to. (This also means we have no idea how many people use this — a trade we're happy with.)
3. Secrets by shape only. When a credential-shaped value is found in a config, geiger reports the key name, the file, and what kind of secret it looks like — never any part of the value. A redaction pass runs on all output as defense-in-depth, and the test suite enforces it.

npx geiger-scan                        scan, print the report
npx geiger-scan --html report.html     self-contained HTML report with per-finding
                                       "what to do" remediation guidance
npx geiger-scan --json out.json        machine-readable findings (schemaVersion 1)
npx geiger-scan --path D:\repo1 --path E:\repo2
                                       also scan these project directories for
                                       project-level agent and MCP configs
npx geiger-scan --home C:\Users\other  scan a different home root (another user
                                       profile, a mounted image)
npx geiger-scan --strict               exit 2 if anything can execute code or
                                       holds secrets
npx geiger-scan --diff baseline.json   compare against an earlier --json
                                       snapshot: what appeared, disappeared,
                                       or escalated since then

Drift alarm: once you've reviewed a machine, save a baseline (--json baseline.json) and put geiger-scan --strict --diff baseline.json in cron or CI. It exits 2 only when something new can execute code or hold secrets — the standing, already-reviewed inventory stays quiet. Same mental model as a lockfile: accept what's there, alarm on change.

No npm? npx github:Atomburstofficial/geiger runs straight from the repo.

What the reports look like

Before running anything, see exactly what you'd get: a sample HTML report and a sample JSON output live in this repo, generated from the test fixture — synthetic data, generic paths, credentials shown by shape only (as always). The HTML report:

Every finding that warrants action carries plain-language remediation — as fix: lines in the terminal and "What to do" blocks in the HTML report.

Fleet pattern (MSPs, IT): run with --json per machine on a schedule (an RMM task or login script writing %COMPUTERNAME%.json to a share), keep each machine's baseline, and let --diff report per-machine drift. The schema is versioned and stable. Geiger never phones home — the JSON files travel only where you put them.

Stated up front, because a scanner you overtrust is worse than no scanner:

• Geiger reads known config locations. Agents installed in nonstandard paths, other user accounts, containers, or WSL (from the Windows side) are not seen.
• It reads configuration, not runtime behavior. It cannot tell you what a plugin actually did — only what its position allows.
• It cannot judge whether a package is malicious — only where it came from and what it can reach. Origin ≠ trustworthiness.
• Partially-parseable formats (TOML configs) are scanned by shape and flagged with reduced confidence rather than skipped.
• The ecosystem this tool audits changes weekly. Detectors are data-driven and small on purpose — see CONTRIBUTING.md to add one.

Is this a security audit? No. It's an inventory with honest exposure labels — the thing you need before any audit means anything.

Why should I trust a security company's free scanner? Read it. It's a few hundred lines of dependency-free JavaScript, and what's published is what runs — releases are published from GitHub Actions with npm provenance, so the npm page carries a signed link to the exact public commit each version was built from.

What do I do about what it finds? Individually: remove what you don't recognize, rotate credentials that shouldn't be sitting in configs. At a company: that's policy enforcement, which is a different product — DomainGuard is how organizations put a policy layer in front of this surface. Geiger stays free and standalone either way.

MIT · built by Atomburst · zero runtime dependencies, no build step — the source you read is the code that runs.