Kingfisher
Kingfisher is a free, Apache-2.0-licensed tool for detecting leaked secrets and helping teams assess and contain them.
What Kingfisher is
Kingfisher is a free, Apache-2.0-licensed tool for detecting leaked secrets and helping teams assess and contain them. It scans files, directories, Git repositories and history, archives, SQLite databases, Python bytecode, Docker images, cloud storage, and developer platforms. Documented integrations include GitHub, GitLab, Azure Repos, Bitbucket, Gitea, Hugging Face, AWS S3, Google Cloud Storage, Docker, Jira, Confluence, Slack, Microsoft Teams, and Postman. The project describes a multithreaded Vectorscan engine and accepts Betterleaks TOML and Kingfisher YAML rules. Reports can be human-readable or exported in TOON, JSON, JSONL, SARIF, BSON, and HTML. A local viewer can combine and deduplicate reports from Kingfisher, SARIF, Gitleaks, and TruffleHog. The tool can check whether credentials are live, map their blast radius, and support revocation for credentials with a supported provider workflow. Live validation and blast-radius checks call provider APIs, so use them only when authorized to inspect the target account. Kingfisher runs on Linux, macOS, and Windows, with self-hosted use also listed.
Good
- Scans repositories, archives, databases, and cloud storage.
- Supports custom detection rule formats.
- Exports reports in multiple formats.
- Pre-commit hooks can block commits on findings.
- Free under Apache License 2.0.
Watch out
- Revocation supports only some credential providers.
- Live validation requires authorized provider API access.
Who it suits
Kingfisher suits development and security teams scanning code, repositories, and connected platforms for exposed credentials. Its report formats and pre-commit hooks may fit teams that want scanning in developer workflows.
Verdict
Kingfisher covers a wide range of scan targets and reporting formats, with additional credential checks and response options. Its API-based validation and blast-radius features should be used only with authorization.
Plans and prices
From Kingfisher's own pricing page, checked 30 Sep 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Free and open source | Free | No separate paid or enterprise tier · Apache-2.0 licensed |
The facts
Each one read from Kingfisher's own pages, with the date it was checked.
What it does
- API access behavior
- Live validation and blast-radius mapping make requests to provider APIs, and the project says to use them only when authorized to inspect the target account.checked 30 Sep 2026
- Credential containment
- Revocation is opt-in and available only for credentials with a supported provider workflow.checked 30 Sep 2026
- Detection
- The project describes a multithreaded Vectorscan scanning engine and support for Betterleaks TOML and Kingfisher YAML rule formats.checked 30 Sep 2026
- Developer workflow
- Kingfisher provides pre-commit hooks that scan staged changes and can block commits when findings cause a non-zero exit code.checked 30 Sep 2026
- Installation
- The project documents prebuilt releases, Homebrew, mise, Linux and macOS installers, a Windows installer, PyPI wheels, Docker, and source builds.checked 30 Sep 2026
- Integrations
- Documented platform integrations include GitHub, GitLab, Azure Repos, Bitbucket, Gitea, Hugging Face, AWS S3, Google Cloud Storage, Docker, Jira, Confluence, Slack, Microsoft Teams, and Postman.checked 30 Sep 2026
- License
- The repository states that Kingfisher is licensed under Apache License 2.0.checked 30 Sep 2026
- Purpose
- Kingfisher scans for leaked secrets, checks which credentials are live, maps their blast radius, and supports revocation for supported credentials.checked 30 Sep 2026
- Release security
- The installation guide says every release ships SLSA v1 build-provenance attestations using Sigstore keyless OIDC.checked 30 Sep 2026
- Reports
- It supports human-readable output and TOON, JSON, JSONL, SARIF, BSON, and HTML report formats.checked 30 Sep 2026
- Scan targets
- It can scan files, directories, Git repositories and history, archives, SQLite databases, Python bytecode, Docker images, cloud storage, and developer platforms.checked 30 Sep 2026
- Triage
- A local report viewer can combine and deduplicate Kingfisher, SARIF, Gitleaks, and TruffleHog reports; the README also links to a hosted viewer.checked 30 Sep 2026
The company
- Founded
- 2007checked 28 Sep 2026
- Headquarters
- New York, NY, USAchecked 28 Sep 2026
- Maker
- MongoDB says it was founded in 2007 and lists its corporate headquarters in New York City.checked 30 Sep 2026
Alternatives to Kingfisher
- 1
Backstage
Free planWebAPILinuxmacOS6.8Free plan - 2
tmux
Free planAPILinuxmacOSSelf-hosted6.0Free plan - 3
Chrome Browser Cloud Management
AndroidiOSWebLinux5.3 - 4
dein.vim
LinuxmacOSWindows4.7 - 5
Elpaca
LinuxmacOSWindows4.7 - 6
Jenkins Plugin Installation Manager Tool
LinuxmacOSWindows4.7