Geiger is a read-only Node.js CLI tool that scans a machine and produces a plain-language inventory of every AI agent, MCP server, plugin, and editor extension, annotating what each one can reach (code execution, filesystem access, network, secrets). You run `npx geiger-scan` once, get a report showing 9 findings across 3 ecosystems, what capabilities each has, where it came from, and exact config file paths for manual verification. It's designed for the real problem: people install dozens of AI tools via one-click installers and dotfiles without knowing what's actually on their machine or what those tools can touch. The tool promises read-only operation (except explicit `--json` export), zero telemetry, and reports credentials by shape only, never value. It has a drift-detection mode (`--diff` against a baseline) suitable for scheduled scans or fleet monitoring. Limitations are stated: it reads known config paths only, sees configuration not runtime behavior, and cannot judge maliciousness. Output formats include terminal, HTML with remediation guidance, and machine-readable JSON with a versioned schema. One practical question: the source describes detecting policy wrappers (like "domainguard-agent.exe" enforcing constraints), but doesn't specify whether geiger can verify the wrapper is actually enforcing, or just that it exists.