Skip to content
SPECIFICTION
Get listed

Kingfisher

github.com

Free plan WindowsmacOSLinuxSelf-hosted
Visit github.com
Spec score 8.0 #2 of 22 in Plugins & Extensions Software

What it is

Kingfisher is a free tool for scanning for leaked secrets, checking whether credentials are live, mapping their blast radius, and supporting revocation for some credentials. It can scan files, directories, Git repositories and history, archives, SQLite databases, Python bytecode, Docker images, cloud storage, and developer platforms. Documented integrations include GitHub, GitLab, Azure Repos, Bitbucket, Gitea, Hugging Face, AWS S3, Google Cloud Storage, Docker, Jira, Confluence, Slack, Microsoft Teams, and Postman. The project describes a multithreaded Vectorscan engine and supports Betterleaks TOML and Kingfisher YAML rules. Reports can be human-readable or exported as TOON, JSON, JSONL, SARIF, BSON, or HTML. A local viewer can combine and deduplicate Kingfisher, SARIF, Gitleaks, and TruffleHog reports. Revocation is opt-in and depends on a supported provider workflow. Live validation and blast-radius mapping make provider API requests, which should only be used when authorized. Kingfisher runs on Linux, macOS, and Windows, and supports self-hosted use.

Spec sheet

Purpose
Kingfisher scans for leaked secrets, checks which credentials are live, maps their blast radius, and supports revocation for supported credentials.Read 30 Sep 2026 · github.com
Integrations
Documented platform integrations include GitHub, GitLab, Azure Repos, Bitbucket, Gitea, Hugging Face, AWS S3, Google Cloud Storage, Docker, Jira, Confluence, Slack, Microsoft Teams, and Postman.Read 30 Sep 2026 · github.com
License
The repository states that Kingfisher is licensed under Apache License 2.0.Read 30 Sep 2026 · github.com
Headquarters
New York, NY, USARead 28 Sep 2026 · github.com
Founded
2007Read 28 Sep 2026 · github.com
Maker
MongoDB says it was founded in 2007 and lists its corporate headquarters in New York City.Read 30 Sep 2026 · mongodb.com
API access behavior
Live validation and blast-radius mapping make requests to provider APIs, and the project says to use them only when authorized to inspect the target account.Read 30 Sep 2026 · github.com
Credential containment
Revocation is opt-in and available only for credentials with a supported provider workflow.Read 30 Sep 2026 · github.com
Detection
The project describes a multithreaded Vectorscan scanning engine and support for Betterleaks TOML and Kingfisher YAML rule formats.Read 30 Sep 2026 · github.com
Developer workflow
Kingfisher provides pre-commit hooks that scan staged changes and can block commits when findings cause a non-zero exit code.Read 30 Sep 2026 · github.com
Installation
The project documents prebuilt releases, Homebrew, mise, Linux and macOS installers, a Windows installer, PyPI wheels, Docker, and source builds.Read 30 Sep 2026 · github.com
Release security
The installation guide says every release ships SLSA v1 build-provenance attestations using Sigstore keyless OIDC.Read 30 Sep 2026 · github.com
Reports
It supports human-readable output and TOON, JSON, JSONL, SARIF, BSON, and HTML report formats.Read 30 Sep 2026 · github.com
Scan targets
It can scan files, directories, Git repositories and history, archives, SQLite databases, Python bytecode, Docker images, cloud storage, and developer platforms.Read 30 Sep 2026 · github.com
Triage
A local report viewer can combine and deduplicate Kingfisher, SARIF, Gitleaks, and TruffleHog reports; the README also links to a hosted viewer.Read 30 Sep 2026 · github.com

Plans and prices

Free and open source Free No separate paid or enterprise tier · Apache-2.0 licensed Read 30 Sep 2026 · github.com

Every Kingfisher plan and price →

Strong points and limits

Strong points

  • Scans Git history, archives, and cloud storage.
  • Supports custom detection rules.
  • Exports reports in JSON, SARIF, and other formats.
  • Provides pre-commit, pull-request, and CI/CD scanning.
  • Free and licensed under Apache License 2.0.

Limits

  • Credential revocation requires a supported provider workflow.
  • Live checks call provider APIs and require authorization.
  • Revocation is opt-in.

Who it suits

Kingfisher suits people responsible for finding and responding to leaked credentials across repositories, files, and connected platforms. Provider API checks are intended for authorized inspection of the target account.

Verdict

Kingfisher combines secret scanning, reporting, and some credential-response workflows. Live validation and blast-radius checks require authorized access to the relevant provider account.

Where Specifiction places it

Alternatives to KingfisherAll alternatives →