From zero to AI hero
Superpowers PackGet superpowers
From zero to AI hero

Must-haves for…

Start in 10 minutes

Plain-word guides and superpowers for Claude Code, Codex and Gemini.

CommandInstalls cleanly

See every AI tool on your computer

geiger

One read-only command that lists every AI agent, MCP server, plugin and hook on your computer and explains in plain words what each one can reach.

Works with
Any agent
Good for
Security testing, Everyone

What it does

Every AI assistant, connector (MCP server), plugin and hook you install is a small program that may run commands, read files or hold passwords. After a few weeks most people no longer know what is installed. geiger answers that question with one command.

It looks in the usual places where Claude Code, Codex, Gemini CLI, Cursor, Claude Desktop and many other tools keep their settings. For each item it shows where it came from and labels what it can do, for example run code, hold secrets, read many files or use the network.

The tool promises to be read-only, to send nothing over the internet, and to show secrets by their type only, never the actual value. It needs Node.js 18 or newer. It is an inventory, not a full security audit, but it is a good first step before you clean up.

Example prompts

  • "Run npx geiger-scan and explain the results to me in plain words"
  • "Which of my MCP servers can run code or hold secrets?"
  • "Help me remove the tools from the geiger report that I no longer use"
  • "Save a baseline with --json and tell me how to check for new tools next month"

How to install

npx geiger-scan

How to use it

Run npx geiger-scan in your terminal. Add --html report.html to get a report with what-to-do advice for each finding.

Check it works

Run npx geiger-scan; it prints a report headed GEIGER with the number of findings. npx geiger-scan --html report.html writes a report file you can open in a browser (commands from the README).

Common problems

  • npx not found — no exact text in the README — install Node.js (for example winget install OpenJS.NodeJS.LTS on Windows or brew install node on Mac), then open a new terminal — https://github.com/Atomburstofficial/geiger
  • An agent installed in an unusual folder is missing — no error text — geiger only reads known config locations; use --path to add a project folder — same README

What to watch out for

  • Reads agent config files in your home folder; the README says it writes nothing unless you ask and sends nothing
  • npx downloads the package from npm when you run it
  • The report shows names of secrets it finds (never the values); keep the report private anyway

Licence and author

Licence
MIT
Author
Atomburstofficial
Source code
github.com/Atomburstofficial/geiger

How we tested it

We installed it on an empty test computer on 13 Oct 2026. Installed and started in a clean test system. Not yet used in a real AI session.

Test level

Not yet used on real work.

Technical details of the test
Date
13 Oct 2026
Method
Intake sandbox run on 2026-10-13 in a clean container with no account: cloned the repository and checked its skill, agent and plugin files, ran "npx -y geiger-scan --help".

Checked again on 13 Oct 2026

Alternatives

  • Snyk Agent Scan — also checks MCP servers and skills for known attacks, but needs a Snyk token and contacts Snyk's API
  • CC Safety Net — blocks dangerous commands live instead of listing what is installed

FAQ

  • Q: Does it change anything? A: No. The README says the only file it writes is a report you ask for.
  • Q: Does it need an account? A: No account and no API key.
  • Q: Is it a full security check? A: No, it is an inventory with exposure labels; the README says so.

Sources