# AI use cases for Geiger (Atomburstofficial/geiger)

Repo: [Atomburstofficial/geiger](https://github.com/Atomburstofficial/geiger) | Use cases: 5 | Page: https://dedupedai.com/use-cases/atomburstofficial-geiger/

Geiger is a read-only, dependency-free command that inventories the AI agents, MCP servers, plugins, and AI extensions on a machine and labels what each one can execute, read, or reach.

This file holds every use case of this repo. Each one starts with a "## " heading and ends with its URL.

- See every AI agent and MCP server on a machine: https://dedupedai.com/use-cases/atomburstofficial-geiger/inventory-ai-agents-on-my-machine/
- Turn a scan into an HTML report with fix steps: https://dedupedai.com/use-cases/atomburstofficial-geiger/share-a-remediation-html-report/
- Alert when a new executing or secret-holding agent appears: https://dedupedai.com/use-cases/atomburstofficial-geiger/alert-on-new-risky-agent-installs/
- Find agent and MCP configs inside project folders: https://dedupedai.com/use-cases/atomburstofficial-geiger/scan-project-folders-for-agent-configs/
- Track AI tool drift across a fleet of machines: https://dedupedai.com/use-cases/atomburstofficial-geiger/run-scheduled-fleet-inventory-for-machines/

## How to see every AI agent and MCP server on a machine with Geiger

Repo: [Atomburstofficial/geiger](https://github.com/Atomburstofficial/geiger) | Difficulty: Beginner | Time: 15 minutes | Basis: From the README

Run one read-only scan to list each agent, MCP server, and AI extension and what it can reach.

**Who it is for:** A developer or office worker who has installed several AI tools and cannot say what is running on their computer.

**The problem:** AI agents, MCP servers, and plugins are configured in dotfiles and app settings that most people never open, so their reach is unknown.

**The outcome:** A terminal report that names each agent or server, its origin, and labels such as EXECUTES, HOLDS-SECRETS, BROAD-FILESYSTEM, BROAD-WEB, and NETWORK, with the evidence path for checking by hand.

### Steps

1. Install Node.js 18 or newer, then open a new terminal so npx is on the path.
2. Run `npx geiger-scan` to print the report to the terminal.
3. Read the findings grouped by ecosystem and note any line marked EXECUTES or HOLDS-SECRETS.
4. Open the evidence path shown for an unfamiliar entry and decide whether to keep it.
5. Follow the fix: lines for anything you do not recognize, such as removing it from the config file.

### Prompt to paste into your agent

```text
Run `npx geiger-scan` in the terminal on the machine <machine name> and return the list of findings with their capability labels and evidence paths. Verify that the output reports zero write operations other than any file you named, and that no credential values appear in the output.
```

### Caveat

Geiger only reads known config locations, so agents installed in nonstandard paths, other user accounts, containers, or WSL are not seen.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/atomburstofficial-geiger/inventory-ai-agents-on-my-machine/

## How to turn a scan into an HTML report with fix steps with Geiger

Repo: [Atomburstofficial/geiger](https://github.com/Atomburstofficial/geiger) | Difficulty: Beginner | Time: 15 minutes | Basis: From the README

Generate a self-contained HTML report with plain-language remediation for each finding.

**Who it is for:** A team lead or IT reviewer who needs to walk a colleague through what was found on their machine.

**The problem:** A terminal list is hard to review with other people and does not explain what to do about each finding.

**The outcome:** A single HTML file with per-finding What to do guidance that can be opened in a browser and shared.

### Steps

1. Run `npx geiger-scan --html report.html` in the folder where you want the report saved.
2. Open report.html in a web browser.
3. Review each finding that has a What to do block.
4. Share the file only after confirming it shows credentials by shape and not by value.

### Prompt to paste into your agent

```text
Run `npx geiger-scan --html report.html` on <machine name> and confirm that report.html was created as a self-contained file. Return the count of findings that include a What to do block and verify that no credential value appears in the file.
```

### Caveat

Remediation text is guidance for a human to check, and the README says a flagged line means open it by hand, not that it is malicious.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/atomburstofficial-geiger/share-a-remediation-html-report/

## How to alert when a new executing or secret-holding agent appears with Geiger

Repo: [Atomburstofficial/geiger](https://github.com/Atomburstofficial/geiger) | Difficulty: Intermediate | Time: 30 minutes | Basis: From the README

Save a baseline after review, then fail a scheduled check only when something new can run code or hold secrets.

**Who it is for:** A security-minded developer or IT admin who reviewed a machine once and wants to know when a new risky tool shows up.

**The problem:** Installs happen quickly and often without notice, so a machine that was clean last month can have a new code-executing extension today.

**The outcome:** A scheduled job that exits with code 2 only when a new finding can execute code or hold secrets, and stays quiet for the reviewed inventory.

### Steps

1. After reviewing the machine, run `npx geiger-scan --json baseline.json` to save the reviewed inventory. (inferred, check the README)
2. Confirm that baseline.json is stored somewhere the scheduled job can read.
3. Add `npx geiger-scan --strict --diff baseline.json` to cron or CI. (inferred, check the README)
4. Treat exit code 2 from the job as a signal to open the new finding and review it.

### Prompt to paste into your agent

```text
On <machine name>, save a baseline with `npx geiger-scan --json baseline.json`, then run `npx geiger-scan --strict --diff baseline.json` and report the exit code and any new findings. Verify that the job exits with code 2 only when a new finding can execute code or hold secrets.
```

### Caveat

The alarm only covers what Geiger can see in known config locations, so it will not catch installs in nonstandard paths.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/atomburstofficial-geiger/alert-on-new-risky-agent-installs/

## How to find agent and MCP configs inside project folders with Geiger

Repo: [Atomburstofficial/geiger](https://github.com/Atomburstofficial/geiger) | Difficulty: Intermediate | Time: 15 minutes | Basis: From the README

Add project directories to the scan to catch project-level agent and MCP configuration.

**Who it is for:** A developer who keeps several repositories and wants to know which ones carry agent or MCP settings.

**The problem:** Project-level agent and MCP configs live inside repositories, so a home-level scan misses them.

**The outcome:** A report that includes project-level agent and MCP configs and git hooks from the directories you named.

### Steps

1. List the project directories you want included, such as D:\repo1 and E:\repo2.
2. Run `npx geiger-scan --path D:\repo1 --path E:\repo2` with your own paths in place of the examples.
3. Check the git hook findings for any hook you did not install.
4. Open the evidence path for each project-level finding.

### Prompt to paste into your agent

```text
Run `npx geiger-scan --path <project path>` for each project folder <project path> and return the project-level agent and MCP findings with their evidence paths. Verify that git hooks are reported only for the directories you passed in.
```

### Caveat

Git hooks are read only for the current directory and any --path directories, not for every repository on the machine.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/atomburstofficial-geiger/scan-project-folders-for-agent-configs/

## How to track AI tool drift across a fleet of machines with Geiger

Repo: [Atomburstofficial/geiger](https://github.com/Atomburstofficial/geiger) | Difficulty: Advanced | Time: 60 minutes | Basis: From the README

Write per-machine JSON on a schedule and let --diff report drift for each machine.

**Who it is for:** An MSP or IT administrator who manages many employee laptops and needs to know when AI tools change on each one.

**The problem:** Managing AI agent sprawl across many machines is hard to do by hand, and no per-machine record exists by default.

**The outcome:** A share holding one JSON file per machine, with a baseline per machine and drift reports from --diff.

### Steps

1. Pick a shared location and create a baseline JSON file for each machine after review.
2. Schedule an RMM task or login script that runs `npx geiger-scan --json %COMPUTERNAME%.json` and writes the file to the share. (inferred, check the README)
3. Run `npx geiger-scan --strict --diff baseline.json` on each machine, or compare the saved files, to report drift. (inferred, check the README)
4. Review each machine's drift report and update that machine's baseline after approval.

### Prompt to paste into your agent

```text
For each machine in <machine list>, run `npx geiger-scan --json <machine name>.json` and compare it with that machine's saved baseline using `npx geiger-scan --diff <baseline file>`. Return a table of machines with new executing or secret-holding findings, and verify that each JSON file has schemaVersion 1.
```

### Caveat

Each machine must be scanned under its own user profile or with --home, and Geiger does not see other user accounts or containers unless you point it there.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/atomburstofficial-geiger/run-scheduled-fleet-inventory-for-machines/