MongoDB Kingfisher

The kingfisher-core crate serves as the foundational layer for the Kingfisher secret scanning ecosystem. It provides the stable base types and utilities used by kingfisher-rules and kingfisher-scanner.

Key capabilities include:

• Blob and Content Abstractions: Standardized ways to handle raw data and content during scanning.
• Source Location and Origin Modeling: Tools for tracking where secrets are found and their origin within a file or stream.
• Shared Utilities: Common error handling and entropy calculation helpers used across the ecosystem.

Kingfisher includes a comprehensive set of pre-configured detection rules designed to identify secrets across various services. The rule set consists of:

• 1,051 total detection rules
• 612 providers
• 914 detectors and 137 dependent rules

Key capabilities within this rule set include:

• Live Validation: 516 rules support live validation to verify if a detected secret is still active.
• Direct Revocation: 52 rules support direct revocation to help mitigate the impact of a leak.

The kingfisher-rules crate is the central component for managing secret detection logic in Kingfisher. It provides the syntax and model types for defining rules, handles YAML parsing for rule files, and includes a set of embedded builtin rules.

Developers can use RulesDatabase to compile rules into a format optimized for scanning engines. To build a complete scanning workflow, integrate this crate with kingfisher-core and kingfisher-scanner.

The kingfisher-scanner crate is a high-level library designed for detecting secrets within bytes, files, and blobs. It provides ergonomic APIs for scanning and returns finding models that include metadata about the location and the captured secret.

To build a complete scanning solution, you should use kingfisher-scanner in conjunction with:

• kingfisher-rules: To compile the detection rules.
• kingfisher-core: For shared primitives used across the ecosystem.

Kingfisher includes 1,051 built-in secret detection rules. These rules can be filtered and searched based on the following criteria:

• Provider: The source or type of secret being detected.
• Confidence Level: The certainty with which the rule identifies a secret.
• Validation Support: Whether the rule supports live validation to reduce false positives.

Kingfisher includes 1,051 built-in rules covering a wide range of categories, including:

• Cloud Providers: AWS, GCP, Azure, Alibaba Cloud, DigitalOcean, etc.
• AI & ML: OpenAI, Anthropic, Google Gemini, Cohere, Mistral, etc.
• Dev & CI/CD: GitHub, GitLab, Docker Hub, npm, Vercel, etc.
• Databases: PostgreSQL, MySQL, MongoDB, Redis, etc.
• Security & Identity: Snyk, Auth0, Okta, 1Password, etc.
• Crypto Material: Private keys (PEM, PGP/GPG, SSH), JWTs, etc.

Rules support checksum-aware matching, which allows for offline structural verification of credentials (like modern PATs) to eliminate false positives without making external API calls.

The --access-map feature performs active authentication against a provider to determine the identity and permissions associated with a detected secret. This helps identify the 'blast radius' (e.g., which S3 buckets or EC2 instances are exposed).

Warning: Only use this feature when authorized to inspect the target account, as Kingfisher will issue network requests to the provider to validate access.

To generate an access map during a scan, use the --access-map flag. You can then view the results using the view command.

# Generate access map during scan
kingfisher scan /path/to/code --access-map --view-report

# View access-map reports locally
kingfisher view kingfisher.json
kingfisher view kingfisher.sarif

Every finding line in detail mode (and every record in the Generic JSON payload) includes a stable fingerprint. This unique identifier allows downstream automation (like SIEM/SOAR, Jira, or custom deduplication tools) to:

• Suppress repeat alerts: Avoid noise when the same secret reappears in subsequent runs.
• Correlate data: Match a chat alert to a specific finding in a baseline file or SARIF report using the kingfisher.fingerprint key.
• Manage triage: Build per-finding tickets or threads keyed by the fingerprint.