# Install kingfisher with Homebrew MongoDB's blazingly fast secret scanning and validation tool. Version 1.105.0 via Homebrew; verified 2026-06-29. ## Install ```sh sudo av install brew:kingfisher ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install kingfisher ``` Evidence: local Homebrew formula metadata ## Package facts - **Package key:** brew:kingfisher - **Package manager:** Homebrew - **Package manager page:** - **Version:** 1.105.0 - **Source summary:** MongoDB's blazingly fast secret scanning and validation tool - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** Apache-2.0 - **Source archive:** - **Last updated:** 2026-06-29T07:59:07Z - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - kingfisher (cli) - kingfisher (alias) ## Build dependencies - boost - cmake - pkgconf - rust ## Uses from macOS - bzip2 ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 1.105.0 - Package-manager updated: 2026-06-29 - Local data: ok - Upstream repository: https://github.com/mongodb/kingfisher - Upstream latest detected: v1.105.0 (current) ## Project history and usage Kingfisher is MongoDB's open source secret scanning and live validation tool, written in Rust for high-throughput scans of repositories, files, archives, cloud storage, collaboration systems, and CI workflows. ### Project history MongoDB presented Kingfisher publicly in June 2025 after describing it as a project that began as an internal effort to detect and verify exposed credentials. The project couples fast pattern matching with validation checks so security teams can distinguish inactive-looking findings from active credentials that require urgent rotation or revocation. The repository history and release stream show a fast-moving post-release project. GitHub releases list Kingfisher v1.12.0, v1.13.0, and v1.14.0 on June 25-26, 2025, and v1.103.0 through v1.105.0 during June 16-29, 2026. ### Adoption history MongoDB's announcement framed Kingfisher as a core part of MongoDB's internal security workflows before its public release. Homebrew packaging made the CLI installable for macOS and Linux users through the same channel many security engineers use for scanners and developer tools. ### How it is used Kingfisher is used to scan source trees, Git history, platform integrations, archives, and storage targets for leaked API keys, tokens, and credentials. Its CLI can emit JSON, SARIF, TOON, and HTML reports, validate supported secrets against provider APIs, revoke selected secret types, and open a local or hosted report viewer. ### Why package nerds care For package collectors, Kingfisher sits in the modern secret-scanner lineage with Gitleaks, TruffleHog, and Nosey Parker, but its package identity is shaped by Rust, Hyperscan/Vectorscan-style performance work, validation, SARIF output, and a report viewer bundled with the CLI. ### Timeline - 2025-06: MongoDB announced Kingfisher as an open source secret scanner with live validation. - 2025-06-25: GitHub release v1.12.0 was published. - 2025-06-26: GitHub releases v1.13.0 and v1.14.0 were published. - 2026-06-29: GitHub release v1.105.0 was published. ### Related projects - Kingfisher imports and triages reports from Gitleaks and TruffleHog, references Nosey Parker as part of its scanner lineage, and outputs SARIF for integration with code-scanning workflows. ### Sources - - - - - ## Security Notes No matching local secret-handling manifest was found for kingfisher. Nucleus package metadata is still published here so future coverage has a stable package URL. ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** kingfisher - **Version Scheme:** 0 - **Revision:** 0 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## Related links - [Source-control packages](https://www.automicvault.com/pkg/source-control-tools/) - Belongs to a source-control command family. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Security and crypto packages](https://www.automicvault.com/pkg/security-crypto-tools/) - Matched security, identity, cryptography, password, signing, or certificate metadata. - [cmake](https://www.automicvault.com/pkg/brew/cmake/) - Build dependency declared by Homebrew. - [pkgconf](https://www.automicvault.com/pkg/brew/pkgconf/) - Build dependency declared by Homebrew. - [rust](https://www.automicvault.com/pkg/brew/rust/) - Build dependency declared by Homebrew. - [detect-secrets](https://www.automicvault.com/pkg/brew/detect-secrets/) - Shares av.db curated category or tags: cli, secret-scanning, security. - [git-hound](https://www.automicvault.com/pkg/brew/git-hound/) - Shares av.db curated category or tags: cli, secret-scanning, security. - [git-secrets](https://www.automicvault.com/pkg/brew/git-secrets/) - Shares av.db curated category or tags: cli, secret-scanning, security. - [gitleaks](https://www.automicvault.com/pkg/brew/gitleaks/) - Shares av.db curated category or tags: cli, secret-scanning, security. - [mantra](https://www.automicvault.com/pkg/brew/mantra/) - Shares av.db curated category or tags: cli, secret-scanning, security. - [squealer](https://www.automicvault.com/pkg/brew/squealer/) - Shares av.db curated category or tags: cli, secret-scanning, security. - [tartufo](https://www.automicvault.com/pkg/brew/tartufo/) - Shares av.db curated category or tags: cli, secret-scanning, security. - [aide](https://www.automicvault.com/pkg/brew/aide/) - Shares av.db curated category or tags: cli, security. ## Combined YAML source View the package source record on GitHub. [combined/kingfisher.yml](https://github.com/automic-vault/db/blob/main/combined/kingfisher.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - cross-ecosystem install command graph