VS Code extension

The extension vulnetix.vulnetix has no scanner of its own. It finds or downloads the Vulnetix CLI, starts vulnetix lsp as a child process, and talks to it over the Language Server Protocol on stdin and stdout. The server evaluates the CLI’s embedded rule set against the files you have open and checks your dependency manifests against the Vulnetix vulnerability database (VDB). Findings arrive as ordinary diagnostics: squiggles in the editor and entries in the Problems panel.

The extension is early. The published builds are 0.2.0 (stable) and 0.3.0 (pre-release) on Open VSX; main is at 0.3.1.

What works today

Area	What you get	Page
Dependencies	One diagnostic per vulnerable package on the line that declares it, a hover card, inline ✓ / → <version> hints, and quick fixes that bump the version in the manifest	Dependencies
Code (SAST)	Rule findings as you type, local only	Code, secrets and infrastructure
Secrets	Rule findings on save	Code, secrets and infrastructure
Infrastructure and containers	Terraform, Kubernetes, Dockerfile and similar rules as you type	Code, secrets and infrastructure
Suppressions	nosec comments, .vulnetix/memory.yaml, and editor-only rules in vulnetix.suppressions	Suppressions
CLI management	Resolve, download and checksum-verify the CLI; mirrors and pinned binaries	The CLI binary
Status bar	Error and warning counts, CLI version, a click opens the log	First run

There are five commands, no keybindings, no sidebar views and no sign-in command. The commands reference lists them, and Not available yet lists what the old docs described that is not built.

How it fits together

editor (extension host)  --LSP over stdio-->  vulnetix lsp  --reads-->  workspace files
                                                   |
                                                   +--HTTPS (package coordinates only)--> api.vdb.vulnetix.com

• The extension declares extensionKind: ["workspace"], so in a remote session (SSH, WSL, Dev Containers, code-server) it and the server run next to the files.
• Code, secret, infrastructure and container rules are evaluated in the server process and never use the network.
• Dependency checks send package name, version and ecosystem to the VDB. Responses are cached on disk.
• The server is the same vulnetix binary you run in CI, so the rules match vulnetix scan.

Find the page for your task

I want to	Read
Install it in VS Code, Cursor, VSCodium or another fork	Install
Pre-install it in a Dev Container, Gitpod or code-server image	Remote workspaces and containers
Use an internally vetted CLI binary or a mirror	The CLI binary
Move a vulnerable dependency to a safe version	Fix a vulnerable dependency
Silence a finding for me only, or for the team	Suppressions
Know what leaves my machine	Privacy and network use
Look up a setting	Settings
Work out why nothing appears	Troubleshooting

Related tools

Belai’s /vulnetix review and the Pix pr-security-reviewer agent review code with the same scanners and VDB. Neither needs the extension, and the extension does not start them. See Related tools, and Architecture for how the extension, the server and the VDB fit together.

Platform IaC

The extension has no config-as-code of its own: it is configured through VS Code settings, and resource-scoped settings can be committed in .vscode/settings.json. The organisation documents the CLI validates with vulnetix config validate are described in Platform IaC, with a page for every kind in the kind catalogue. Validating .vulnetix/config/*.yaml as you type through vulnetix lsp is planned.