Kingfisher

7.2easy start · #6 of 23
in Secrets Scanning Software

Free to practise onyes
Free trialnot on record
Well documentedyes
Runs where you workyes

Runs on Linux, Mac, self-hosted, Windows.

Kingfisher is ranked #6 of 23 in secrets scanning software on The Geeks Club. It runs on Linux, macOS, Self-hosted, Windows. There is a free plan.

Kingfisher plans and pricing

All plans

Free and open source Free No separate paid or enterprise tier · Apache-2.0 licensed github.com · 30 Sept 2026

Compared on secrets scanning software

Free plan: Yes
Supported VCS: Local Git, GitHub, GitLab, Azure Repos, Bitbucket, Gitea, Hugging Face
CI/CD scanning: Yes
Pre-commit scanning: Yes
Pull-request scanning: Yes
Push protection: Yes
Custom detection rules: Yes

Best Kingfisher alternatives

See all 12

GitGuardian 0 of 4 in the starter kit Lesson 17.9 ggshield 0 of 4 in the starter kit Lesson 27.8 Vooda AI 0 of 4 in the starter kit Lesson 37.5 Semgrep Code 0 of 4 in the starter kit Lesson 47.4 Augustus 0 of 4 in the starter kit Lesson 57.2 TruffleHog 0 of 4 in the starter kit Lesson 77.2

The record

Purpose: Kingfisher scans for leaked secrets, checks which credentials are live, maps their blast radius, and supports revocation for supported credentials.
Scan targets: It can scan files, directories, Git repositories and history, archives, SQLite databases, Python bytecode, Docker images, cloud storage, and developer platforms.
Integrations: Documented platform integrations include GitHub, GitLab, Azure Repos, Bitbucket, Gitea, Hugging Face, AWS S3, Google Cloud Storage, Docker, Jira, Confluence, Slack, Microsoft Teams, and Postman.
Detection: The project describes a multithreaded Vectorscan scanning engine and support for Betterleaks TOML and Kingfisher YAML rule formats.
Reports: It supports human-readable output and TOON, JSON, JSONL, SARIF, BSON, and HTML report formats.
Triage: A local report viewer can combine and deduplicate Kingfisher, SARIF, Gitleaks, and TruffleHog reports; the README also links to a hosted viewer.
Credential containment: Revocation is opt-in and available only for credentials with a supported provider workflow.
API access behavior: Live validation and blast-radius mapping make requests to provider APIs, and the project says to use them only when authorized to inspect the target account.
Release security: The installation guide says every release ships SLSA v1 build-provenance attestations using Sigstore keyless OIDC.
Installation: The project documents prebuilt releases, Homebrew, mise, Linux and macOS installers, a Windows installer, PyPI wheels, Docker, and source builds.
Developer workflow: Kingfisher provides pre-commit hooks that scan staged changes and can block commits when findings cause a non-zero exit code.
License: The repository states that Kingfisher is licensed under Apache License 2.0.
Maker: MongoDB says it was founded in 2007 and lists its corporate headquarters in New York City.
Founded: 2007
Price from: Free

Where it ranks on The Geeks Club

Best Secrets Scanning Software in 2026#6 of 23

Is Kingfisher yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Kingfisher

Sources

github.com/mongodb/kingfisher· checked 30 Sept 2026
github.com/mongodb/kingfisher/blob/main/docs/INTEG· checked 30 Sept 2026
github.com/mongodb/kingfisher/blob/main/docs/INSTA· checked 30 Sept 2026
mongodb.com/company/our-story· checked 30 Sept 2026