---
id: kingfisher-bin
version: "1.112.0"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# kingfisher-bin — Kingfisher secret scanning CLI (packaged binary)

License: permissive · Maintenance: active · Downloads: 74.6K/mo

## What it is and what it does

Kingfisher is a Rust-based command-line tool that scans for exposed secrets—API keys, tokens, and credentials—across multiple sources including local files, Git repositories, GitHub, GitLab, Azure Repos, Bitbucket, Gitea, Hugging Face, Docker, Jira, Confluence, Slack, Microsoft Teams, Postman, AWS S3, and Google Cloud Storage. It uses an Intel SIMD-accelerated regex engine (Hyperscan) combined with language-aware parsing to achieve high accuracy at scale.

Beyond detection, Kingfisher validates discovered secrets by checking them against provider APIs to reduce false positives, and supports direct revocation for many platforms. It generates output in JSON, SARIF, TOON, and HTML formats, sends alerts to Slack, Microsoft Teams, Discord, Mattermost, Google Chat, or custom webhooks, and includes a browser-based report viewer that can visualize and triage findings from Kingfisher, SARIF, Gitleaks, and TruffleHog reports. The tool is designed for both offensive security engineers and blue-team defenders scanning repositories, cloud storage, chat systems, and CI pipelines.

Use it for:

- Scan Git repositories and commit history for accidentally committed API keys and tokens before they reach production
- Validate discovered credentials against provider APIs to confirm they are live and reduce false-positive alerts
- Generate compliance-ready audit reports with scan metadata and validation results for security and regulatory reviews
- Integrate secret scanning into CI/CD pipelines with JSON, SARIF, or webhook alerts to Slack or Microsoft Teams
- Triage and deduplicate findings from multiple scanning tools (Gitleaks, TruffleHog) in a unified browser-based viewer
- Map blast radius of leaked credentials to identify which cloud resources and identities are exposed across 43 providers

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Kingfisher is a command-line secret scanner that detects, validates, and triages leaked API keys, tokens, and credentials across code repositories, cloud storage, chat platforms, and CI pipelines using 1,089 built-in rules and live validation against provider APIs.

Yes. Kingfisher is actively maintained, has no runtime dependencies, supports modern Python versions, carries a permissive Apache-2.0 license, and offers comprehensive secret detection with live validation across 1,089 rules and many platforms. It is well-suited for developers, security teams, and compliance workflows. Install via Homebrew, PyPI, or Docker depending on your environment.

## Install

pip install kingfisher-bin
uv add kingfisher-bin
poetry add kingfisher-bin

## Installing kingfisher-bin

Before you install: Medium install friction due to platform-specific binary wheels (macOS, Linux, Windows, ARM support). The package is actively maintained with a recent release, no runtime dependencies, and clear installation paths via Homebrew, PyPI, or Docker.

License in practice: Apache-2.0 permissive license allows commercial and private use with minimal restrictions, making it suitable for enterprise and compliance-focused workflows.

Quickstart:

# Install via PyPI
uv tool install kingfisher-bin

# Scan a directory for secrets
kingfisher scan /path/to/code

# Scan and view results in browser
kingfisher scan /path/to/code --view-report

Requires Python 3.8 or later. Platform-specific binary wheels are provided for macOS (Intel and ARM), Linux (x86_64 and aarch64), and Windows (AMD64 and ARM64).

Verify before relying:

- Whether the 1,089 built-in rules cover all major secret types your organization uses
- Performance characteristics on very large codebases or repositories with extensive history
- Accuracy of live validation against provider APIs and false-positive rates in practice
- Whether custom YAML rules are sufficient for proprietary or non-standard secret formats

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: medium
- Maintenance: active
- Downloads: 74.6K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

secret scanner for source code, API key and token detection, credential leak detection, git secrets scanner, secret validation tool, exposed credentials finder, compliance secret scanning, secret-detection, credential-scanning, compliance

[View on SkillFed](https://skillfed.io/packages/kingfisher-bin) · [View on PyPI](https://pypi.org/project/kingfisher-bin/)