AI, Can! for VS Code

Security and misconfiguration diagnostics for ai-can Terraform configurations and application code — checked against the files in your workspace, and optionally against what's actually deployed in Azure, without leaving the editor.

This is an early release: one command, AI, Can!: Scan Workspace. It's still useful on its own — catching the exact misconfigurations the ai-can team has hit for real, in both your local config and (optionally) your live deployment — but it's the first piece of a larger planned extension, not the finished product. See Learn more for what's next.

Table of Contents

• What it does
• Requirements
• Commands
• Walkthrough and expected output
• The six local rules
• The three live Azure rules (optional)
• Security and privacy
• Troubleshooting
• License
• Learn more

What it does

AI, Can!: Scan Workspace does two things, the second one optional:

1. Local scan (always runs). Walks every .tf/.tfvars/.py/.js/.ts/.cs file, plus a root .env and .gitignore, in your open workspace and reports misconfigurations — plaintext credentials, publicly exposed resources, the App Service Free-tier quota trap, and three more. Findings appear as standard VS Code diagnostics: squiggles in the editor, entries in the Problems panel.
2. Live Azure check (optional). After the local scan, you're asked whether to also check the actual deployed Managed Application in Azure — by Resource Group name. If you provide one, it checks whether your .tfvars intent (public network access off, managed identity only, no Free-tier SKUs) matches what's actually live, which config drift can silently break. This step is entirely optional — leave the prompt empty and nothing about the local scan changes.

Requirements

• VS Code 1.100.0 or later.

• Azure CLI — only needed for the optional live check; the local scan needs nothing beyond VS Code itself.

  Platform	Install
  Windows 11	winget install Microsoft.AzureCLI, or the MSI installer
  macOS	brew install azure-cli, or the official guide
  Linux	curl -sL https://aka.ms/InstallAzureCLIDeb \| sudo bash (Debian/Ubuntu), or your distro's package per the official guide

  You don't need to sign in ahead of time — the command prompts you to sign in the first time you provide a resource group, if you aren't already.

Commands

There's one command, contributed to the Command Palette (Cmd+Shift+P / Ctrl+Shift+P):

It activates on demand — you don't need a .tf/.tfvars file open first, though opening one also triggers activation.

Walkthrough and expected output

1. Run the command. Cmd+Shift+P / Ctrl+Shift+P → AI, Can!: Scan Workspace.

2. Local scan result — a notification appears immediately:

AI, Can!: no misconfigurations found.

or

AI, Can!: 3 finding(s) — see the Problems panel.

Open the Problems panel (Cmd+Shift+M / Ctrl+Shift+M) to see each finding: grouped by file, with severity (Error/Warning), the exact line, the rule that fired (e.g. ai-can.free-tier-in-prod), and a message explaining the fix. Diagnostics are fully replaced on every run, so fixing an issue and re-running clears it — nothing stale lingers.

3. The live-check prompt appears right after, whether or not the local scan found anything:

Also check the live Managed Application? Enter its Azure Resource Group, or leave empty to skip

Press Esc or Enter on an empty box to stop here — the command is done, exactly as if the live check didn't exist. Type a resource group name (e.g. contoso-prod-spoke-rg) to continue.

4. Sign-in, if needed. If the Azure CLI isn't installed, you'll see an error with an Install Guide button. If it's installed but you're not signed in:

AI, Can!: you are not signed in to the Azure CLI. Sign in to check the live resource group, or skip to keep this scan local-only.

Choosing Sign In opens an integrated terminal running az login — complete whatever it asks for (usually a browser window, sometimes a device code), then click I've Signed In in the follow-up prompt. If you're already signed in, this whole step is skipped silently.

5. Live scan runs, with a progress notification (AI, Can!: checking contoso-prod-spoke-rg in <your subscription>…), then a result notification:

AI, Can!: no live misconfigurations found in contoso-prod-spoke-rg.

or

AI, Can!: 2 live finding(s) in contoso-prod-spoke-rg — see the "AI, Can! — Live Azure Scan" output channel.

6. Live findings show in their own Output channel (Output panel → channel dropdown → "AI, Can! — Live Azure Scan"), which opens automatically when there's something to show:

AI, Can! — live scan of resource group "contoso-prod-spoke-rg"
Run at 2026-08-10T17:12:01.112Z

[ERROR] contoso-ai-foundry (Microsoft.CognitiveServices/accounts)
  ai-can.live-public-network-access
  contoso-ai-foundry (Microsoft.CognitiveServices/accounts) has publicNetworkAccess = Enabled. AI, Can!'s
  zero-trust profile reaches this resource over a private endpoint — this deployed resource is reachable
  from the public internet right now.

[ERROR] contoso-ai-foundry (Microsoft.CognitiveServices/accounts)
  ai-can.live-foundry-local-auth
  contoso-ai-foundry still accepts API keys alongside Entra ID (disableLocalAuth is not true). This is the
  live account, not the tfvars intent — set disable_local_auth = true and re-apply to force managed identity.

(That's a real example shape — the underlying logic was verified against a real deployed ai-can resource group while this feature was built.)

The six local rules

The three live Azure rules (optional)

Same intent as three of the rules above, checked against what's actually deployed instead of what a .tfvars file says — config drift shows up here even if your source of truth looks correct.

Only these five resource types are checked; anything else in the resource group (networking, DNS, monitoring, etc.) is intentionally out of scope for this command.

Security and privacy

• The local scan makes zero network calls. It reads files already present in your open workspace and nothing else.
• The live check is opt-in and read-only. It only runs if you type in a resource group; it calls az resource list / az resource show (read-only Azure Resource Manager calls) and nothing else.
• No credential storage, ever. The extension never touches, reads, or stores a token, key, or secret — sign-in is entirely az login's own credential cache, which the extension only ever asks whether you're signed in to (az account show), never how. For the local scan, secret-shaped strings already in your files are only detected, never handled.
• Nothing is written back automatically. Every finding, local or live, is read-only reporting — there's no auto-fix or resource modification in this version.

Troubleshooting

License

Proprietary — © Artemis Industries. See LICENSE for the full terms. Installing and using this extension (via the Marketplace or a .vsix) is permitted for working with ai-can; the source itself is not open for redistribution or reuse.

Learn more

This command is the first piece of a larger planned extension — a full deploy walkthrough, terraform.tfvars IntelliSense, a live cost panel, an architecture tree view, and more. Building it yourself, running its tests, or reading the full roadmap? See CONTRIBUTING.md in the source repository.