# kingfisher: MongoDB's Secret Scanner That Validates and Revokes

> Kingfisher is a Rust secret scanner from MongoDB that goes past discovery. It finds leaked credentials across code, git history, container images, archives and SaaS platforms, checks which of them are still live, maps what each one can reach, and can revoke supported secrets from the same tool. It is Apache-2.0 licensed and ships as a CLI, a Rust library and a Python module.

**mongodb/kingfisher** — Detect secrets + live validation. Map blast radius. Revoke fast. Use the CLI or embed in Rust and Python.

- Repository: https://github.com/mongodb/kingfisher
- Website: https://mongodb.github.io/kingfisher/
- Stars: 1,272 · Forks: 122
- Language: Rust
- License: Apache-2.0
- Published: 2026-10-19 · Updated: 2026-10-19 · Language: en
- Canonical page: https://hysenlabs.com/projects/mongodb-kingfisher

## A Workflow, Not a Finding List

The README opens with the sentence that defines the project: find leaked secrets, validate what is live, map the blast radius, revoke fast.

That is four jobs, and the tool is organised around them as a defender workflow, Detect, Validate, Map, Triage, Revoke, with an end-to-end guide in the documentation for exactly that sequence.

The difference from a conventional secret scanner is in the second and last steps. A conventional scanner reports strings that match a pattern, and the human then has to work out whether the key is real, what it opens and how to turn it off. Kingfisher does the first two of those automatically, which is the expensive part in practice, because checking whether a credential is live means calling the service it belongs to, and mapping what it can reach means enumerating its permissions.

The triage step is the human part, and it has two shapes. You can work through the findings in a browser, or you can take the output as SARIF, JSON or TOON, which is what you want if the findings are going into an existing pipeline rather than a review session.

Revocation is the last step and the one that distinguishes the project from most of its comparison set. The README states that of the popular secret scanning tools it compares, only Kingfisher and Betterleaks 2.0 offer built-in credential revocation, and that it is all open source with no paid edition required.

## Hundreds of Rules on a Vectorscan Engine

The detection engine is the part that determines how fast a scan can run, and the README is specific about it: a blazingly fast, multithreaded Vectorscan regex engine, with the built-in rules documented on the project's own rules page.

Vectorscan is a vectorised regular expression engine, which is what makes the difference between a scanner that keeps up with a CI job and one that does not. The performance claim is stated as a benchmark result rather than a slogan: the multithreaded Vectorscan engine recorded the lowest runtime on every repository in the published benchmark suite, from small projects through the Linux kernel and the GitLab monorepo.

The dependency list shows the pieces. The workspace pins kingfisher-vectorscan at an exact version, with a comment that cache compatibility includes the exact binding and native crate build identity, and the Makefile carries a Zig version for building the engine, so the scanner brings a native component that is compiled from source rather than a prebuilt binary. The rest of the workspace is ordinary Rust: regex and regex-syntax for the pattern layer, ignore and walkdir for traversing a tree, sha1, sha2, sha3 and hmac for the fingerprinting and signing work, base32, base64 and hex for encodings, zeroize for secret handling, tiktoken-rs for tokenising, and smallvec and rustc-hash for allocation control on the hot path.

The rules are data rather than code, and the repository has a tools/rule-bundle crate, a data/ directory, and a rule format that the examples directory ships, with an smtp.yml example included in the Python source distribution.

## Where It Scans: From Git History to Cloud Storage

The list of scan targets is the widest part of the tool, and it is arranged as a matrix of sources and platforms.

On the developer machine it handles local files and directories, local Git repositories including their history, compressed and office-document archives, SQLite databases and Python bytecode. The last two matter more than they sound. A database file or a compiled artefact is where a credential often survives after it has been removed from the source, and a scanner that cannot open them will not find it.

On the platform side it works with GitHub, GitLab, Azure Repos, Bitbucket, Gitea and Hugging Face, with Docker images, and with the collaboration and API tools where credentials hide in practice: Jira, Confluence, Slack, Microsoft Teams and Postman. And it reaches cloud object storage in AWS S3 and Google Cloud Storage.

The README says to use the platform integration guide for target-specific commands, authentication, scope and pagination behaviour, which tells you that the platform integrations are real API clients with their own authentication needs, not a scrape of a web page.

A working example of that sits in the repository, examples/embedded_application.rs, which is an application that embeds the scanner rather than shelling out to it.

## Validation Is the Step That Costs You the Most

Finding a credential pattern is cheap. Proving that the credential still works is not, and that is the step Kingfisher takes on.

The validation stage checks which credentials are active, and the deployment documentation includes validation results and network-request counts alongside the test environment, which is the detail that tells you the cost. Every validation is an outbound request to the service the credential belongs to, so a scan of a large surface with many findings generates a lot of traffic.

That has two consequences worth planning for. The first is that validation has to be opt-in or scoped, because a scan that validates everything by default is a scan that hits every API you have a key for. The second is that a validation result is a point in time, and the window between the scan and the response is where a revoked credential can still be live.

The blast radius mapping is the next stage, and it answers a different question. Instead of asking whether the key works, it asks what the key can do, mapping a leaked secret's identity, its permissions and the resources it can reach. For a key with broad access, that turns a line in a log into a list of systems at risk, which is the input a responder needs to decide what to shut down first.

## Revocation, and the Comparison With the Other Scanners

The README publishes a capability table comparing Kingfisher with Betterleaks 2.0, TruffleHog OSS and Gitleaks, across four capabilities: secret discovery, live credential verification, identity and permission analysis, and credential revocation.

All four find secrets. Gitleaks alone lacks live credential verification and identity and permission analysis, and only Kingfisher and Betterleaks 2.0 support revocation. The licences differ too, with Kingfisher under Apache-2.0, Betterleaks 2.0 under MIT, TruffleHog OSS under AGPL-3.0 and Gitleaks under MIT.

So the honest summary is that the discovery stage is commoditised and the later stages are not. If your requirement is a pre-commit hook that stops a key from being committed, several tools do that and Kingfisher's advantage does not matter. If your requirement is that a leaked key is rotated within minutes of being found, the revocation support is the differentiator, and the README's claim is that only two of the four do it, both without a paid edition.

The packaging is also part of the argument. Despite the broad feature set, Kingfisher ships as a compact static binary, and the published macOS arm64 comparison measures Kingfisher 2.1.0 at 25.3 MiB, which the README connects to distributing it in CI jobs and container images. The comparison and deployment documents carry the validation results, network request counts, test environment and binary size numbers.

## Embedding It as a Rust Library or a Python Module

The tool can also be a library, and the README stresses that everything runs in-process with no CLI subprocess required.

For Python, the package is kingfisher-secret-scanner, installed with uv add kingfisher-secret-scanner, and the SDK is imported as kingfisher_sdk. The packaging is done with maturin, so the Python module wraps a native extension, with the module name configured as kingfisher_sdk._native, and the Python source living in a python/ directory. There is a guide in the documentation and runnable examples for scanning, validation, rule inspection and explicit revocation.

For Rust, the crate is kingfisher-scanner, with its own guide and runnable examples in the crates/kingfisher-scanner/examples directory, covering scanning and validation, and revocation through the same crate.

The workspace structure explains the layering. The crates/ directory holds kingfisher-core, kingfisher-rules, kingfisher-scanner and kingfisher-python, and the root package is kingfisher-bin at version 2.13.0. The Python bindings require Python 3.10 or newer, and the crate workspace is edition 2024 with rust-version 1.99.

The repository also carries the pieces a security tool needs to be trusted with credentials: a SECURITY.md, a fuzz/ directory, a .clusterfuzzlite/ configuration for continuous fuzzing, a testdata/ directory, a .pre-commit-hooks.yaml so the scanner can be wired into your own commits, and a Makefile that handles the release targets for each platform, including Windows and arm64.

## Conclusion

kingfisher fits a security team that has secrets in its history and in its SaaS tools, and that wants one tool to find a credential, prove it is still live, see what it can reach and pull it, rather than a scanner that only reports a string that looks like a key. It is a poor fit if you only need static pattern matching and want the smallest possible tool, since the README notes that even with the broad feature set it ships as a compact static binary at 25.3 MiB on macOS arm64, and it is a poor fit for air-gapped environments, since validation and revocation both need network access. Before adopting it, check which of your platforms are in the integration list and whether the credentials you care about are among the supported revocation targets. The project is Apache-2.0 licensed, the newest release is v2.13.0 from 2026-10-13, and the last push was on 2026-10-13.

## FAQ

### What does Kingfisher do beyond finding secrets?

It validates which credentials are actually live, maps a leaked secret's identity, permissions and reachable resources, lets you triage findings in a browser or export them as SARIF, JSON or TOON, and revokes supported secrets, which the README says only Kingfisher and Betterleaks 2.0 offer among the tools it compares.

### Where can Kingfisher scan?

Local files and directories, local Git repositories and their history, compressed and office-document archives, SQLite databases, Python bytecode, Docker images, GitHub, GitLab, Azure Repos, Bitbucket, Gitea, Hugging Face, Jira, Confluence, Slack, Microsoft Teams, Postman, AWS S3 and Google Cloud Storage.

### How do I embed Kingfisher in a Python or Rust application?

In Python, install with `uv add kingfisher-secret-scanner` and import kingfisher_sdk, with the guide in the Python SDK documentation. In Rust, use the kingfisher-scanner crate, which has its own library guide and runnable examples. Both run in-process with no CLI subprocess required.

### How does Kingfisher compare with Gitleaks and TruffleHog?

All of the tools do secret discovery, and TruffleHog OSS also does live verification and permission analysis. Neither TruffleHog OSS nor Gitleaks supports credential revocation, and the licences differ: Apache-2.0 for Kingfisher, AGPL-3.0 for TruffleHog OSS and MIT for Gitleaks and Betterleaks 2.0.

### How fast is Kingfisher and how big is the binary?

The README says the multithreaded Vectorscan engine recorded the lowest runtime on every repository in the published benchmark suite, from small projects through the Linux kernel and the GitLab monorepo, and that the published macOS arm64 comparison measures Kingfisher 2.1.0 at 25.3 MiB, which is intended to make it easy to distribute in CI jobs and container images.

## Sources

- [License: Apache-2.0](https://github.com/mongodb/kingfisher/blob/main/LICENSE)
- [mongodb/kingfisher on GitHub](https://github.com/mongodb/kingfisher)
- [Project website](https://mongodb.github.io/kingfisher/)
- [README](https://github.com/mongodb/kingfisher/blob/main/README.md)
- [Releases](https://github.com/mongodb/kingfisher/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/mongodb-kingfisher