Why it mattersA developer or a security lead who does not know what agents are wired up on their laptop, and what those agents can touch, can now get an answer in one read-only command instead of walking through six or seven configuration files by hand.
Geiger, a JavaScript tool published under MIT by Atomburstofficial, offers a single command that walks a developer machine's known configuration paths and lists every AI agent, harness, MCP server, plugin, and AI extension it finds. The README describes it as "a Geiger counter for AI agents". The repository was created on 2026-09-06 and posted to Show HN on 2026-09-09, where it has 32 points and 18 comments at time of writing.
What it looks at
The scanner reads config in known locations for Claude Code, both the global install and per-project MCP servers, and for MCP hosts including Claude Desktop, Cursor, Windsurf, VS Code, Cline, Continue, and Zed. It also inventories other coding agents, listed as Codex CLI, Gemini CLI, Aider, GitHub Copilot CLI, Open Interpreter, LM Studio, and Ollama, plus editor extensions in JetBrains IDEs, packages installed under global npm roots, and browser extensions across Chrome, Edge, Brave, and Firefox.
For each thing it finds, Geiger prints a line with an exposure label. The set of labels is [EXECUTES] for anything that can run code, [HOLDS-SECRETS] for anything storing credentials, [BROAD-FILESYSTEM] for broad file access, [BROAD-WEB] for a plugin that can hit arbitrary URLs, and [NETWORK] for network capability more generally.
What it does not do
The README states that the tool is read-only by default: "the only write geiger ever performs is the --json file you explicitly name". There are no dependencies, no build step, and the project reports no telemetry. Running it is a plain npx geiger-scan, so a developer who wants to check a laptop before wiring up another agent can do it without installing anything permanent.
Why it exists
The Hacker News thread is mostly about the security question the tool exposes rather than the tool itself. Commenters point out that many teams have quietly accumulated a set of coding agents, MCP servers, and IDE plugins that each carry some combination of shell access, source code, browser sessions, and cloud credentials, and that few developers can name every one of them off the top of their head. A read-only inventory is what stops a routine "just install this plugin" request from becoming a supply chain incident nobody notices for a month.
The traction is small. 48 stars on GitHub and 32 Hacker News points is a first weekend rather than a proven project, so this is a tool worth knowing about rather than one that has settled in as anyone's default. But nothing on the list of coding agents Geiger walks does the same thing for its neighbours, and the shape of the problem, so many places to install an agent that no single team can watch them all, is one that has been growing quickly.
Source
- GitHub: Atomburstofficial/geiger
- Show HN discussion: Geiger, see every AI agent on your machine and what it can touch
Source: GitHub
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually shipping with them. Short, and only when there is something worth reading.
