FREEDOM251

Freedom251 › Plugins & Extensions Software

Kingfisher

Free plan LinuxMacSelf-hostedWindows

Visit Kingfisher Alternatives Pricing

Kingfisher's own site

What Kingfisher is

Kingfisher is a free, Apache-2.0-licensed tool for finding leaked secrets and assessing possible exposure. It scans files, directories, Git repositories and history, archives, SQLite databases, Python bytecode, Docker images, cloud storage, and developer platforms. Documented integrations include GitHub, GitLab, Azure Repos, Bitbucket, Gitea, Hugging Face, AWS S3, Google Cloud Storage, Docker, Jira, Confluence, Slack, Microsoft Teams, and Postman. The project describes a multithreaded Vectorscan engine and supports Betterleaks TOML and Kingfisher YAML rules. Reports can be human-readable or exported as TOON, JSON, JSONL, SARIF, BSON, and HTML. A local viewer can combine and deduplicate reports from Kingfisher, SARIF, Gitleaks, and TruffleHog. It can validate whether credentials are live, map their blast radius, and support revocation for credentials with a supported provider workflow. Live validation and blast-radius checks call provider APIs, and the project says to use them only when authorized. Installation options include prebuilt releases, package managers, installers, Docker, and source builds.

Who it suits

Kingfisher suits developers and teams who need secret scanning across repositories, files, cloud storage, or connected developer platforms. Its provider checks and revocation workflows are relevant when users have authorization to inspect the target account.

What it does well

  • Scans files, Git history, archives, databases, and cloud storage
  • Supports many developer-platform integrations
  • Exports reports in JSON, SARIF, HTML, and other formats
  • Pre-commit hooks can scan staged changes
  • Free and Apache-2.0 licensed

What to know first

  • Live validation and blast-radius checks make provider API requests
  • Revocation is opt-in and limited to supported provider workflows
  • Provider checks should only be used with authorization

Limits

The free plan is the only listed plan. Revocation applies only to credentials with a supported provider workflow, and live validation and blast-radius mapping make provider API requests that should be used only with authorization.

Plans

PlanBilled and limitsPrice
Free and open sourceNo separate paid or enterprise tier · Apache-2.0 licensedFree

As github.com lists them, read 30 Sept 2026. The maker's own page has the final word.

Getting started

  1. Open the Kingfisher project website on GitHub.
  2. Choose a documented installation route: prebuilt release, Homebrew, mise, installer, PyPI, Docker, or source build.
  3. Install the version for Linux, macOS, or Windows, or use a self-hosted setup.
  4. Run scans against the files, repositories, or other supported targets you need to inspect.
  5. Use the available hooks or CI/CD, pull-request, and push-protection workflows as needed.

Verdict

Kingfisher combines broad secret scanning with report formats, pre-commit hooks, and optional credential-response features. Provider API checks require authorization, and revocation is limited to supported workflows.

Questions

How much does Kingfisher cost?

The listed Free and open source plan costs nothing. No separate paid or enterprise tier is listed.

Is Kingfisher open source?

Yes. The repository states that Kingfisher is licensed under Apache License 2.0.

Which platforms does it support?

Linux, macOS, Windows, and self-hosted use are listed.

What can Kingfisher scan?

It scans files, directories, Git repositories and history, archives, SQLite databases, Python bytecode, Docker images, cloud storage, and developer platforms.

Can Kingfisher validate or revoke credentials?

It can check whether credentials are live and map their blast radius through provider APIs. Revocation is optional and available only for credentials with a supported provider workflow.

Who makes Kingfisher?

Kingfisher is a MongoDB project. MongoDB says it was founded in 2007 and lists its headquarters in New York City.

Facts from Kingfisher's own pages

API access behavior
Live validation and blast-radius mapping make requests to provider APIs, and the project says to use them only when authorized to inspect the target account. · github.com, 30 Sept 2026
Credential containment
Revocation is opt-in and available only for credentials with a supported provider workflow. · github.com, 30 Sept 2026
Detection
The project describes a multithreaded Vectorscan scanning engine and support for Betterleaks TOML and Kingfisher YAML rule formats. · github.com, 30 Sept 2026
Developer workflow
Kingfisher provides pre-commit hooks that scan staged changes and can block commits when findings cause a non-zero exit code. · github.com, 30 Sept 2026
Founded
2007 · github.com, 28 Sept 2026
Headquarters
New York, NY, USA · github.com, 28 Sept 2026
Installation
The project documents prebuilt releases, Homebrew, mise, Linux and macOS installers, a Windows installer, PyPI wheels, Docker, and source builds. · github.com, 30 Sept 2026
Integrations
Documented platform integrations include GitHub, GitLab, Azure Repos, Bitbucket, Gitea, Hugging Face, AWS S3, Google Cloud Storage, Docker, Jira, Confluence, Slack, Microsoft Teams, and Postman. · github.com, 30 Sept 2026
License
The repository states that Kingfisher is licensed under Apache License 2.0. · github.com, 30 Sept 2026
Maker
MongoDB says it was founded in 2007 and lists its corporate headquarters in New York City. · mongodb.com, 30 Sept 2026
Purpose
Kingfisher scans for leaked secrets, checks which credentials are live, maps their blast radius, and supports revocation for supported credentials. · github.com, 30 Sept 2026
Release security
The installation guide says every release ships SLSA v1 build-provenance attestations using Sigstore keyless OIDC. · github.com, 30 Sept 2026
Reports
It supports human-readable output and TOON, JSON, JSONL, SARIF, BSON, and HTML report formats. · github.com, 30 Sept 2026
Scan targets
It can scan files, directories, Git repositories and history, archives, SQLite databases, Python bytecode, Docker images, cloud storage, and developer platforms. · github.com, 30 Sept 2026
Triage
A local report viewer can combine and deduplicate Kingfisher, SARIF, Gitleaks, and TruffleHog reports; the README also links to a hosted viewer. · github.com, 30 Sept 2026

Where Kingfisher stands on Freedom251

Look at these too