Kingfisher
Kingfisher: A broad, free scanner for exposed credentials across code, cloud, containers, and developer platforms. Ranked #3 of 24 in Secrets Scanning Software by our editors (9.1/10); pricing: Free plan; best for broad open-source scanning across code and cloud.
At a glance
- Editor score9.1 / 10
- PricingFree plan
- Best forBroad open-source scanning across code and cloud
- Free planYes
- Paid fromFree
- CI/CD scanningYes
- Founded2007 · New York, NY, USA
- Facts checked22 Sep 2026
Where it wins
- Scans code, history, files, archives, cloud storage, and containers
- Validates credentials and maps permissions, resources, and blast radius
- Supports CI, pull requests, pre-commit hooks, and custom rules
Where it doesn't
- Revocation workflows apply only to supported credential providers
- Command-line workflows may require security and developer expertise
- No separate paid or enterprise tier for centralized commercial support
Our verdict on Kingfisher
Kingfisher is an Apache-2.0 open-source secret scanner from MongoDB for developers, security engineers, and incident responders. It scans source code, Git history, local files, archives, cloud storage, container images, and supported developer platforms for exposed credentials. Windows, macOS, and Linux are supported, with local and hosted browser report viewers for filtering, deduplication, and export. Its scope suits teams that want one scanning tool across repositories, developer workflows, cloud storage, and incident response.
Breadth is the main differentiator. Kingfisher supports GitHub, GitLab, Azure Repos, Bitbucket, Gitea, Hugging Face, Jira, Confluence, Slack, Microsoft Teams, Postman, AWS S3, Google Cloud Storage, and Docker. It combines Betterleaks- and Veles-based detection rules with credential validation, identity and permission mapping, reachable-resource analysis, and blast-radius views. Security teams can also use provider-specific revocation workflows, while custom TOML, YAML, and YML rules extend detection for internal credential formats.
The published model is free and open source, with no separate paid or enterprise tier. Teams can run scans locally, in CI, against branch diffs or pull requests, and through Git pre-commit hooks that block commits containing new secrets. That makes Kingfisher a strong fit for organizations comfortable operating command-line and CI workflows, especially when broad coverage matters more than a tiered SaaS experience. Teams seeking a paid enterprise tier or revocation coverage beyond supported providers should consider a different product.
Your product? Our editors can test Kingfisher in depth and publish a review, labelled as paid · from $149/mo →
Kingfisher pricing
Kingfisher fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Supported VCS | Local Git, GitHub, GitLab, Azure Repos, Bitbucket, Gitea, Hugging Face |
| CI/CD scanning | Yes |
| Pre-commit scanning | Yes |
| Pull-request scanning | Yes |
| Push protection | Yes |
| Custom detection rules | Yes |
| Repository limit | Not verified |
| Deployment | Self-hosted |
| Platforms | Windows, macOS, Linux |
| Support | Community, Docs |
| Built for | Solo, Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 14 integrations: GitHub, GitLab, Azure Repos, Bitbucket, Gitea, Hugging Face … See all → |
| Pricing | Free plan |
| Website | github.com |
| Facts checked | 22 Sep 2026 |
Kingfisher integrations
Kingfisher lists 14 integrations on its own site.
- GitHub
- GitLab
- Azure Repos
- Bitbucket
- Gitea
- Hugging Face
- AWS S3
- Google Cloud Storage
- Docker
- Jira
- Confluence
- Slack
- Microsoft Teams
- Postman
See all Kingfisher integrations →
Alternatives to Kingfisher
- GitGuardianBroad secrets scanning with developer workflow controls, remediation, and enterprise deployment options.9.3
- TruffleHogDeep secret detection and credential verification for development and security teams.9.2
- ggshieldA broad, developer-focused scanner with a free workspace plan and extensive CI coverage.9.0
See all Kingfisher alternatives →
Kingfisher vs the competition
- Kingfisher vs GitGuardian
- Kingfisher vs TruffleHog
- Kingfisher vs ggshield
- Kingfisher vs Datadog Secret Scanning
- Kingfisher vs Vooda AI
- Kingfisher vs Arnica Secrets Security
Compare Kingfisher with any tool side by side →
Also Ranked In
Kingfisher is ranked in 2 of our directories.
Used Kingfisher? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Kingfisher for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Kingfisher is listed in our Secrets Scanning Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/kingfisher/"><img src="https://www.itechguides.com/best/badge/kingfisher.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update