CheckOps home

Tools directory

K

CheckOps

Kingfisher

Kingfisher is MongoDB's Apache-2.0 secret scanner and credential response tool in Rust: it detects leaked secrets with hundreds of rules, validates live credentials and maps blast radius.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

Kingfisher is a fast, free, open-source secret scanner and credential response tool built in Rust by MongoDB. Its tagline: find leaked secrets, validate what is live, map the blast radius, revoke fast. It ships hundreds of built-in rules and validates which credentials are active, mapping access for supported credential types.

The source code is at mongodb/kingfisher on GitHub under the Apache-2.0 licence, with about 1,300 stars; the most recent commit was on 9 November 2026.

Features

  1. Hundreds of rules: Built-in detection rules.
  2. Live validation: Checks whether secrets are active.
  3. Blast radius mapping: Shows what supported credentials can access.
  4. Revocation help: Credential response workflow.
  5. Embeddable: Run the CLI or embed in Rust, Python or Node.js.

Pros

  1. Free to use: Open source under Apache-2.0.
  2. Maintained: Commits as recent as 9 November 2026.

Cons

  1. Newer project: Smaller community than TruffleHog or Gitleaks.
  2. Validation sends requests: Live checks contact providers.
kingfisher scan /path/to/repo

See the docs for install options and validation flags.

Resources:

Pricing

Kingfisher is free and open source under the Apache-2.0 licence.

  1. Security teams triaging leaked credentials.
  2. Teams wanting a fast Rust scanner with validation.
  3. Not a fit where outbound validation calls are not allowed.

Conclusion

Kingfisher combines fast secret detection with validation and blast-radius mapping.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with Kingfisher side by side.