kingfisher-bin

What it is and what it does

Kingfisher is a Rust-based command-line tool that scans for exposed secrets—API keys, tokens, and credentials—across multiple sources including local files, Git repositories, GitHub, GitLab, Azure Repos, Bitbucket, Gitea, Hugging Face, Docker, Jira, Confluence, Slack, Microsoft Teams, Postman, AWS S3, and Google Cloud Storage. It uses an Intel SIMD-accelerated regex engine (Hyperscan) combined with language-aware parsing to achieve high accuracy at scale.

Beyond detection, Kingfisher validates discovered secrets by checking them against provider APIs to reduce false positives, and supports direct revocation for many platforms. It generates output in JSON, SARIF, TOON, and HTML formats, sends alerts to Slack, Microsoft Teams, Discord, Mattermost, Google Chat, or custom webhooks, and includes a browser-based report viewer that can visualize and triage findings from Kingfisher, SARIF, Gitleaks, and TruffleHog reports. The tool is designed for both offensive security engineers and blue-team defenders scanning repositories, cloud storage, chat systems, and CI pipelines.

Use it for:

• Scan Git repositories and commit history for accidentally committed API keys and tokens before they reach production
• Validate discovered credentials against provider APIs to confirm they are live and reduce false-positive alerts
• Generate compliance-ready audit reports with scan metadata and validation results for security and regulatory reviews
• Integrate secret scanning into CI/CD pipelines with JSON, SARIF, or webhook alerts to Slack or Microsoft Teams
• Triage and deduplicate findings from multiple scanning tools (Gitleaks, TruffleHog) in a unified browser-based viewer
• Map blast radius of leaked credentials to identify which cloud resources and identities are exposed across 43 providers

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Kingfisher is a command-line secret scanner that detects, validates, and triages leaked API keys, tokens, and credentials across code repositories, cloud storage, chat platforms, and CI pipelines using 1,089 built-in rules and live validation against provider APIs.

Yes. Kingfisher is actively maintained, has no runtime dependencies, supports modern Python versions, carries a permissive Apache-2.0 license, and offers comprehensive secret detection with live validation across 1,089 rules and many platforms. It is well-suited for developers, security teams, and compliance workflows. Install via Homebrew, PyPI, or Docker depending on your environment.

Install

kingfisher-bin on PyPI

pip install kingfisher-bin

uv add kingfisher-bin

poetry add kingfisher-bin

Installing kingfisher-bin

Before you install

Medium install friction due to platform-specific binary wheels (macOS, Linux, Windows, ARM support). The package is actively maintained with a recent release, no runtime dependencies, and clear installation paths via Homebrew, PyPI, or Docker.

License in practice

Apache-2.0 permissive license allows commercial and private use with minimal restrictions, making it suitable for enterprise and compliance-focused workflows.

Quickstart

# Install via PyPI
uv tool install kingfisher-bin

# Scan a directory for secrets
kingfisher scan /path/to/code

# Scan and view results in browser
kingfisher scan /path/to/code --view-report

Requires Python 3.8 or later. Platform-specific binary wheels are provided for macOS (Intel and ARM), Linux (x86_64 and aarch64), and Windows (AMD64 and ARM64).

Verify before relying

• Whether the 1,089 built-in rules cover all major secret types your organization uses
• Performance characteristics on very large codebases or repositories with extensive history
• Accuracy of live validation against provider APIs and false-positive rates in practice
• Whether custom YAML rules are sufficient for proprietary or non-standard secret formats

Package facts

Evidence: kingfisher_bin-1.112.0-py3-none-macosx_10_9_x86_64.whl; kingfisher_bin-1.112.0-py3-none-macosx_11_0_arm64.whl; kingfisher_bin-1.112.0-py3-none-manylinux_2_17_aarch64.musllinux_1_2_aarch64.whl; kingfisher_bin-1.112.0-py3-none-manylinux_2_17_x86_64.musllinux_1_2_x86_64.whl; kingfisher_bin-1.112.0-py3-none-win_amd64.whl; kingfisher_bin-1.112.0-py3-none-win_arm64.whl

Tags

More Security packages