Kingfisher

Kingfisher — Free Download. Secret scanning

Kingfisher is a high-speed secret scanner and live validation tool. It scans code, Git history, developer platforms, cloud storage, collaboration tools, and containers, then verifies exposed credentials, maps their blast radius across identities, permissions, and reachable resources, and revokes supported secrets directly from the CLI. The program combines detection, validation, and remediation in a single workflow, reducing the time between discovery and containment of leaked credentials.

★★★★★
5.0(1 ratings)
Download Kingfisher (Official links)
File size: 15.8 MB
The latest version of Kingfisher is: 2.0.0
Operating system: Windows, Mac OS, Linux
Languages: English
Developer: MongoDB, Inc.
Price: $0.00 USD (Open Source (Apache-2.0))
  • Candidate Detection Engine. The scanner uses Vectorscan for all candidate detection, eliminating unconditional whole-blob regex fallbacks for large generic credential patterns. Path and finding-filter regex helpers are also compiled once with Vectorscan instead of being rebuilt per path or finding, which improves throughput on large repositories and reduces CPU consumption during scans.
  • Live Credential Validation. Kingfisher performs live validation of exposed credentials against the corresponding service providers. For PostgreSQL, MySQL/MariaDB, and MongoDB URIs, the tool dispatches captured credentials to typed validators and feeds validated results into blast-radius mapping. Unsupported URI schemes remain detected while validation is not attempted. JDBC strings containing a credential-bearing PostgreSQL or MySQL URI are handled through that inner URI.
  • Blast Radius Mapping. After a credential is validated, the scanner maps its blast radius across identities, permissions, and reachable resources. This analysis shows which systems, roles, and data an attacker could access with the leaked secret, enabling prioritization of remediation based on actual exposure rather than pattern matches alone.
  • Credential Revocation. Supported secrets can be revoked directly from the CLI. This allows security teams to immediately invalidate a leaked token, key, or password without switching to a separate console or API client, shortening the window of exposure for critical credentials.
  • SSRF Protection Gate. The MongoDB, MySQL, Postgres, and JDBC validators enforce the same SSRF gate as the HTTP, gRPC, and JWT validators. Every host in a Postgres multi-host URL and every MongoDB seed, including hosts resolved via mongodb+srv:// SRV records, is checked. Blocked targets report a constant message instead of the driver connection error, and the `--allow-internal-ips` flag allows operators to opt back in when scanning trusted internal networks.
  • Rule Alias Compatibility. Kingfisher 1.x rule selectors continue to work. `--rule`, `--exclude-rule`, and `rules.disabled` entries naming `kingfisher.*` IDs now resolve to their 2.x replacements through an alias table. A one-time deprecation warning names the selector to migrate to instead of failing the scan. Exact `kingfisher.*` IDs still win when the 1.x catalog is loaded via `--rules-path`, and an unknown `kingfisher.*` selector remains an error.
  • Repository-Aware Baselines. The tool supports v2 baselines with safe multi-repository updates, atomic writes, and automatic migration from legacy baselines. Baselines allow teams to suppress known findings and focus on newly introduced secrets, while preserving a consistent state across multiple repositories and CI runs.
  • Webhook Finding Filters. Configurable webhook finding filters, empty-alert suppression, dry-run previews, and access-map impact summaries give teams control over alert delivery. The alert payload field `summary.filtered_total` was removed; read `summary.total` as the per-sink filtered count and the new `summary.unfiltered_total` for the whole-scan count.
  • Built-In Detection Rules. The catalog includes Qwen, Solana, and Starknet detection rules, plus Databricks OAuth client-secret and Kubernetes ServiceAccount token rules. MongoDB Atlas API key detection is tightened, and the Databricks workspace-host rule no longer matches azurewebsites.net. Google API-key attribution and validation are fixed, including YouTube handling and Gemini header authentication.
  • Betterleaks Catalog Integration. Kingfisher fetches and parses the Betterleaks catalog and selected Veles source files at build time. The Kingfisher 1.x YAML custom-rule format remains supported for custom rules. The candidate detector catalog moved to the Betterleaks rule format, with selected Veles detectors filling gaps, giving the community a shared format and a common place to develop generally useful rules.
  • TLS Mode Per Rule. Restored per-rule `tls_mode` for built-in rules. The imported-rule capability overlay now accepts `tls_mode: strict | lax | off`, and `betterleaks.mongodb-connection-string` and `betterleaks.jwt` declare `lax` so self-managed clusters and self-hosted IdPs presenting private-CA or self-signed certificates validate again. The build rejects an unknown `tls_mode` value or a `tls_mode` on a rule with no validator.
  • Rule-Coverage Drift Guard. A rule-coverage drift guard uses a YAML file mapping migrated Kingfisher 1.x families with known 2.x replacements. A test asserts each alias target still resolves against the built-in catalog, so an upstream release that drops a replacement fails the build instead of silently breaking that compatibility path.

Kingfisher began development in 2023 as an internal tool for high-volume secret scanning and live validation. The initial release focused on scanning Git repositories and validating a limited set of cloud provider credentials. Over time, the scanner expanded to include developer platforms, cloud storage, collaboration tools, and containers. The project moved to a rule format based on the Betterleaks catalog in version 2.x, while retaining compatibility with Kingfisher 1.x YAML custom rules through an alias table. The core engine is written in Rust, with Vectorscan used for high-performance pattern matching.