CodeWatchtower — VS Code Extension

Security scanner for AI-built web apps. Scans your code via Docker and shows findings inline in VS Code.

Requirements

Docker installed and running

Getting Started

Install the extension and a Welcome panel will guide you through setup
Open a project folder in VS Code
Run CodeWatchtower: Scan Workspace from the Command Palette (Ctrl+Shift+P)
Findings appear in the Problems panel with inline squiggly underlines

Tip: You can re-open the welcome guide anytime via Ctrl+Shift+P → CodeWatchtower: Getting Started

Free vs Pro

	Free	Pro ($12.99/mo)
Security score	✅	✅
Top 5 issues	✅	✅
All findings	❌	✅
SCA dependency checks	❌	✅
JSON/Markdown export	❌	✅

After a free scan, VS Code will prompt you to upgrade — or you can enter your key anytime.

License Key

Get a key at codewatchtower.com/pricing
Run CodeWatchtower: Set License Key from the Command Palette (Ctrl+Shift+P)
Your key is stored securely via VS Code's SecretStorage (encrypted, per-user)
Your next scan will show full results

Settings

Setting	Default	Description
`codewatchtower.imageName`	`ghcr.io/refercraft/codewatchtower`	Docker image to use
`codewatchtower.dockerPath`	`docker`	Path to Docker binary

How It Works

The extension mounts your workspace into a Docker container and runs the CodeWatchtower scanner. Results are written to a temp file inside your workspace, read back by the extension, then cleaned up — no stdout parsing issues.

docker run --rm -v <workspace>:/app ghcr.io/refercraft/codewatchtower scan /app --format json --output /app/.cwt-result.json

CodeWatchtower

Codewatchtower