AccuKnox Code Security

Find and fix security issues in your editor — SAST, SCA, secrets, IaC, container/SBOM, and ML model scans — with AI remediation and chat.

Findings stay local. Scans do not upload results to AccuKnox. You sign in with an AccuKnox Access Key only to authorize use of the extension.

Features

Multi-engine scans — SAST, SCA, secrets, IaC, ML-static, container / SBOM from one place
Full or changed-files — scan the whole workspace or only git-changed files
Findings sidebar — group by severity, scan type, or file; suppress / restore findings
Inline diagnostics — issues appear in the Problems panel and in the editor
AI remediation — suggest fixes with accept / reject (bring-your-own LLM or AccuKnox SaaS)
AI chat — ask about a finding or your code security questions
Custom scanners — optionally wire any SARIF / Semgrep-JSON-style CLI via settings

Requirements

VS Code 1.85+ (Cursor works identically — it's a VS Code fork)
Python 3.9+ (for installing the scanner CLI)
accuknox-aspm-scanner CLI installed and available on your PATH (or set accuknox.scanner.command to the full path of the binary)

Install the CLI from the aspm-scanner-cli releases — pick the current version tag from that page, then use the asset's download URL (not the release page URL):

python3 -m pip install --user --upgrade "https://github.com/accuknox/aspm-scanner-cli/releases/download/v0.14.7-rc.3/accuknox_aspm_scanner-0.14.7rc3-py3-none-any.whl"

or download the platform binary (accuknox-aspm-scanner / accuknox-aspm-scanner.exe) from the same release page and put it on PATH.

Notes:

pip install accuknox-aspm-scanner alone will not work — the package isn't published to PyPI, only to GitHub Releases. Pointing pip install at a /releases/tag/... page URL instead of a /releases/download/... asset URL also fails (pip downloads the HTML page and can't unpack it). The extension does not bundle the scanner.
Use python3 -m pip install ..., not a bare pip install ... — on some machines a stray old pip on PATH resolves to an outdated Python (e.g. 3.8) that can't satisfy the scanner's dependencies (pydantic==2.11.4 needs a newer interpreter).

Debian / Ubuntu / WSL: if you see error: externally-managed-environment, add --break-system-packages (still --user-scoped, just overrides pip's system-install guard):

python3 -m pip install --user --break-system-packages --upgrade "https://github.com/accuknox/aspm-scanner-cli/releases/download/v0.14.7-rc.3/accuknox_aspm_scanner-0.14.7rc3-py3-none-any.whl"

The extension's own "Install (pip)" button (shown automatically if the scanner isn't found) already handles both of the above — it's only manual terminal installs that need to know this.

Installing the extension

From a .vsix file:

Method	VS Code	Cursor
GUI	Extensions panel → `...` menu → Install from VSIX...	Same
CLI (recommended — more reliable, reports real errors instead of a stuck progress bar)	`code --install-extension accuknox-security.vsix`	`cursor --install-extension accuknox-security.vsix` (first run "Shell Command: Install 'cursor' command in PATH" from the Command Palette if `cursor` isn't found)

If you're on WSL and the GUI installer's progress bar spins forever with no error, that's a known flaky path — use the CLI method instead.

Quick start

Install AccuKnox Code Security — see Installing the extension above.
Install the AccuKnox ASPM scanner CLI (see Requirements) and confirm it runs in a terminal:
```
accuknox-aspm-scanner --help
```
Open a project folder in VS Code.
Sign in: Command Palette → AccuKnox: Log In / Set Access Token Paste an Access Key from the AccuKnox console (Profiles → Access Token).
Run a scan: Command Palette → AccuKnox: Run Scan (Full Directory) or use the play button on the AccuKnox → Findings view.
Review findings in the AccuKnox activity bar (Findings / Suppressed / AI Chat).

Authentication


Why	Scans are blocked until a valid Access Key is set
What to paste	AccuKnox Access Key (JWT from Profiles)
Where it’s stored	OS secret store (not `settings.json`)
Findings upload	Off — IDE scans keep results local

Useful commands:

AccuKnox: Log In / Set Access Token
AccuKnox: Log Out
AccuKnox: Show Authentication Status

Default auth host: https://cspm.demo.accuknox.com
Change host for stage / prod / on-prem with accuknox.auth.endpoint.

Main commands

Command	What it does
Run Scan (Full Directory)	Scan the whole workspace
Run Scan (Changed Files)	Scan git-changed files only
Cancel Scan	Stop the current run
Log In / Set Access Token	Save and validate your Access Key
Log Out	Clear the saved Access Key
Open AI Chat	Open the chat panel
Set LLM API Key	BYO LLM key for remediation / chat
Set AccuKnox SaaS Token	Token for AccuKnox SaaS LLM route (optional)
Open Settings	Jump to AccuKnox settings

Useful settings

Open Settings and search for accuknox, or set in settings.json:

{
  "accuknox.scanner.command": "accuknox-aspm-scanner",
  "accuknox.scanner.executionMode": "local",
  "accuknox.auth.endpoint": "https://cspm.demo.accuknox.com",
  "accuknox.scan.types": {
    "sast": true,
    "sca": true,
    "secret": true,
    "iac": true,
    "ml-scan": false,
    "container": false
  }
}

Setting	Purpose
`accuknox.scanner.command`	Path or name of the ASPM CLI
`accuknox.scanner.executionMode`	`local` or `docker`
`accuknox.auth.endpoint`	AccuKnox CSP base URL (demo / stage / prod / on-prem)
`accuknox.scan.types`	Which scan types to run
`accuknox.scan.secretEngine`	`trufflehog` or `gitleaks`
`accuknox.scan.timeoutMs`	Max time a single scanner may run before it's killed (default `600000` = 10 min). Raise this for large repos, e.g. `1800000` for 30 min.
`accuknox.llm.` / `accuknox.saas.`	AI remediation & chat routing

Secrets (Access Key, LLM key, SaaS token) are never stored in settings files.

Troubleshooting

Problem	What to try
Scan asks you to sign in	Log In with a valid Access Key; check Show Authentication Status
Auth fails / can’t reach AccuKnox	Check network; set `accuknox.auth.endpoint` to your CSP
Scanner not found	Install the CLI; set absolute `accuknox.scanner.command`
No findings / scan errors, or unsure what's happening	Open View → Output, then pick AccuKnox from the dropdown in the panel's top-right corner — this shows the live scanner log, not just a pass/fail toast
Scan on a large repo times out	Raise `accuknox.scan.timeoutMs` (see Useful settings)
`pip install` fails with a `pydantic` version error	Use `python3 -m pip install ...` instead of a bare `pip install ...` (see Requirements)
`pip install` fails with `externally-managed-environment`	Add `--break-system-packages` (Debian/Ubuntu/WSL — see Requirements)
"Install from VSIX" spins forever with no error	Use the CLI install instead: `code --install-extension <path-to-vsix>` (or `cursor --install-extension ...`)
Extensions panel shows "Installing…" forever after a successful install	Stale UI, not a real problem — run Developer: Restart Extension Host from the Command Palette, or fully quit and reopen the editor

Privacy

Access Key is used only to verify your AccuKnox account before a scan.
Scan results stay in the IDE; they are not uploaded to AccuKnox by this extension.

Support

Docs & product: accuknox.com
Issues: report via your AccuKnox support channel or the extension repository