Mondoo Security for VS Code

Catch security issues while you write code, and verify that the infrastructure you run is configured securely — all without leaving VS Code. The extension brings Mondoo's two security scanners, xgrep and cnspec, into the editor, along with AI assistance that works with the language model you already have in VS Code.

What it does

The extension covers five use cases. Code findings and their details live in the Mondoo Findings tab at the bottom of the window, next to Problems and Terminal. Your dependencies have the Mondoo Dependencies tab and your policies the Mondoo Policies tab. The Mondoo icon in the activity bar opens a short launcher into these tabs, and Mondoo in the status bar shows the live finding count and opens the Mondoo menu.

🔍 Find and fix code vulnerabilities

Powered by xgrep, Mondoo's software development security scanner (documentation).

• Live findings appear in the editor and the Problems panel the moment you open or edit a file, with no account and no configuration. The scanner installs automatically from npm on first use.
• The Mondoo Findings tab lists every finding by file, scans the workspace for you the first time you open it, and filters by severity and fix type, with the selected finding's details alongside.
• Fix the findings you check in one run: xgrep applies its automatic fixes and has AI write the rest (your VS Code language model such as Copilot by default, or Claude Code, Codex or your own command). Every fix is verified by a rescan and written directly, Undo puts every file back, and mondoo.fix.review lets you approve each changed file first. One click opens a pull request.
• Fix or dismiss in the editor with Code Actions: apply the rule's fix, or suppress a false positive with a reason that's recorded in a comment and holds in CI too.
• Workspace and changed-files scans for a full sweep or a quick pre-commit check.

🔑 Find leaked secrets

• xgrep's built-in secret rules flag API keys, tokens and passwords committed in source, such as a GitHub personal access token in a config file, as you type and in every workspace scan.

🧩 Check dependencies for known vulnerabilities

• The Mondoo Dependencies tab shows which packages your code imports, which arrive transitively and which are declared but unused. The analysis runs offline.
• Connect to Mondoo Platform with a registration token or a service account file, and a scan looks up every dependency in Mondoo's vulnerability database. Vulnerable packages come first, with the version that fixes them and links to Mondoo Vulnerability Intelligence.
• Upgrade in one click: vulnerable versions are marked in package.json and requirements.txt with a quick fix, and the Mondoo Findings tab lists them with an upgrade fix next to your code findings.

📦 Inventory your software

• SBOM (software bill of materials) for your source-code dependencies or the packages on a running asset.
• CBOM (cryptography bill of materials) of the algorithms, keys and certificates in your source, alone or merged with the SBOM and AIBOM.
• AIBOM (AI bill of materials) inventorying the AI models and agents in scope.
• Standard formats (CycloneDX, SPDX, JSON) that drop straight into compliance workflows and CI. Project bills are generated fully offline, from the download button on the Mondoo Dependencies tab.

🛡️ Secure your infrastructure

Powered by cnspec, Mondoo's infrastructure security scanner (documentation), using MQL (Mondoo Query Language).

• Run policies and queries against your local machine, SSH hosts, Docker, Kubernetes, and the major clouds (AWS, Azure, GCP), with credentials kept in your OS keychain, never in settings.
• A full policy authoring workbench: tree view, search, pins, and bulk operations for your .mql.yaml bundles.
• MQL language intelligence via the built-in cnspec language server: diagnostics, completion, hover, quickfixes, go-to-definition, find references, and CodeLens "Run Query" actions.
• Lint, format-on-save, and offline validation, so queries compile locally before they ever run against a target.

🤖 AI assistance

• @mondoo chat participant — your conversational entry point to both scanners, running on the language model already configured in VS Code (no Mondoo account needed):

  • Explain & triage findings (the default flow) — ask @mondoo whether an xgrep code finding or cnspec policy-lint finding is actually exploitable here and how to fix it. The answer is enriched with xgrep's code graph (call neighborhood and dataflow), and you can keep asking follow-up questions like "how would an attacker exploit this?" or "show me the fix as a diff."
  • @mondoo /query — generate an MQL query from a natural-language security check.

• One-click explain — the Explain Finding (AI) Code Action on any xgrep or cnspec-lint finding opens the same @mondoo triage chat pre-loaded with that finding.

• Language model tools — #cnspec runs scans and policy commands and #mqlSchema looks up MQL providers, resources, and fields, both available to agent mode and Copilot Chat.

• AI agent skills for Claude Code — bring Mondoo's deeper analysis into your agent:

  • Mondoo Infrastructure Security: Install AI Skills adds the mql and policy-graph skills from the cnspec repo for writing MQL and navigating policy bundles.
  • Mondoo Code Security: Install AI Skills adds the xgrep code-security skills (inspect, triage, remediate, fix, rule authoring, secure coding) from the Mondoo skills repo for working with code findings.

  xgrep's analysis (code graph, symbol inspection, scanning) is also exposed to AI coding agents over MCP — Copilot agent mode discovers it automatically.

Getting started

1. Install the extension from the Visual Studio Marketplace or Open VSX.
2. The Get started with Mondoo page opens on first install. Pick a use case: find and fix code vulnerabilities, find leaked secrets, connect to Mondoo Platform and check your dependencies, inventory your software, or secure your infrastructure. Reopen it any time with Mondoo: Get Started in the Command Palette.
3. Code security works immediately: open a file and findings appear as you type. For infrastructure scanning, the extension detects cnspec and guides you through installation if it's missing.

The extension only runs in trusted workspaces because it executes the cnspec and xgrep binaries against workspace files.

Requirements

• Visual Studio Code 1.101 or later
• cnspec for infrastructure scanning (auto-detected; the extension guides you through installation if it's missing)
• The xgrep code scanner installs automatically — no setup needed

Tools & documentation

The extension drives two scanners. Each has its own documentation, which is where to look for rule references, CLI flags, and anything the extension surfaces but does not explain in full:

• MQL — the query language behind cnspec policies: mondoo.com/docs/mql
• All Mondoo documentation: mondoo.com/docs

Getting help

• Extension guide: docs/index.md — getting started, code security, infrastructure security, bill of materials, and settings
• Developing this extension: DEVELOPMENT.md — build, run in dev mode, and test
• Install the extension: Visual Studio Marketplace · Open VSX
• Issues: GitHub Issues
• Community: Mondoo Community