Mini Ora for VS Code

Your code never leaves your machine. Mini Ora runs inside VS Code and flags the risky patterns that turn one careless line into code execution or a leaked secret, then confirms the fix and remembers it so a regression cannot sneak back in.

Mini Ora is the private, local-first security assistant for VS Code. This README reflects the current 1.0.7 package and documents the editor workflow, local scan behavior, and the release-ready marketplace metadata for the extension.

Mini Ora supports Mac, Windows, and Linux.

Private security checks that stay with your code.

Mini Ora helps developers find risky patterns, trace supported code paths, review fix guidance, verify supported changes, and keep a local history. Returning findings are flagged when you scan again.

Find → Trace → Fix → Verify → Remember.

Watch the demo �� Mini Ora website �� Support

Current release

As of 13 September 2026, the latest published development preview is 1.1.0-rc.3, pairing scanner 1.1.0 with VS Code extension 1.1.1. Downloads are hosted on Hetzner and require no GitHub account.

The normal website download remains Mini Ora 1.0.2, bundled with extension 1.0.7. Use the explicit RC.3 links below for the newer preview. Scanner/package and extension versions are separate; RC.3 is a preview milestone, not a final 2.0 release.

Install or upgrade the RC.3 preview

The extension provides the editor interface. The local scanner and activation are also required. Each full RC.3 bundle includes extension 1.1.1.

Full installation instructions �� SHA-256 checksums �� Release validation

1. Install VS Code 1.90 or newer and download the bundle for your operating system. Verify its checksum using the download instructions; each artifact also has a .sha256 sidecar.
2. On macOS: open the package, then complete Mini Ora Setup with an explicit project folder and your beta activation token.
3. On Linux: use Debian 12+ or Ubuntu 24.04+, glibc 2.36+, Git, systemd user services, and an unlocked desktop Secret Service keyring. Extract the archive and run ./install.sh /absolute/path/to/project as your normal desktop user. First installation prompts privately for your activation token; upgrades attempt to reuse activation.
4. Open the authorized project in VS Code and run Developer: Reload Window. Confirm extension 1.1.1 is installed. If necessary, use Extensions: Install from VSIX... with the bundled or standalone VSIX.
5. Run SPR{K3: Scan Current File or SPR{K3: Scan Workspace. Save edited files when prompted so Mini Ora checks the saved source.

When upgrading from RC.1 or RC.2, install the full RC.3 package or archive to receive the rebuilt scanners. Updating the VSIX alone does not update the scanner. The scanner and Mac package receipt report 1.1.0; identify RC.3 by its download filename and checksum.

Find, trace, fix, verify, remember

Scans run when you choose Scan Current File, Scan Changed Files, or Scan Workspace. Findings appear in the editor, the Problems panel, and the SPR{K3 sidebar.

Mini Ora checks supported patterns in six detection categories:

• Unsafe deserialization
• Unsafe model loading
• Remote model code
• Dynamic execution
• Shell injection
• Hard-coded secrets

Use the finding actions to Show Source to Sink Trace, review remediation guidance, Mark Fix Pending Verification, and Verify Fix. Extension 1.1.1 offers Save and Verify for edited files. Verification is tied to the analyzed source snapshot; unsupported or ambiguous changes remain inconclusive.

Current scan results and remembered findings serve different purposes. A fresh scan updates the current results while preserving previous findings, decisions, and verification records. Use Refresh Remembered Findings and Show Finding History to review that history. A warning disappearing from a scan does not by itself verify a fix.

Project review previews

The RC.3 scanner and extension pair also provide:

• Change review: inspect security impact in saved working changes, staged changes, or an unapplied AI-generated patch. Patch review does not apply or execute the patch.
• Project evidence: explore a security graph and supported questions with links to code evidence. RC.3 expands Python helper-call and return tracing, argument binding, and function-local imports; ambiguous paths remain unresolved.
• Build and dependency review: inspect supported GitHub Actions permissions, dependency/build configuration, lockfiles, and container configuration.
• Defend connection preview: prepare monitor-only behavior proposals and review supplied runtime observations. Production runtime collection and enforcement are still pending.

Git-based reviews require a local Git repository. These features have bounded coverage and remain development previews. A clean scan or supported verified fix does not certify whole-project safety.

Privacy

Source scans run locally within your authorized project folder. The extension communicates with an authenticated local agent at 127.0.0.1; source code is not uploaded during scans. Findings, decisions, and review history are stored locally.

Activation requires an internet connection for an entitlement check and device public-key registration. Keep activation tokens and local-agent tokens private.

Optional local AI advice is disabled by default. When enabled, Mini Ora sends only limited control/capability metadata to a loopback model endpoint; source text, snippets, secrets, paths, and project history are excluded. Model advice cannot verify a fix or grant runtime permissions.

Preview acceptance

RC.3 passed packaged feature checks on all four Mac/Linux architectures and paired editor workflows on ARM Mac, Intel Mac, and ARM Linux. Native ARM Linux fresh-install and upgrade checks passed. Intel runtime checks used Rosetta emulation.

Clean-machine macOS installation, live customer activation, normal customer editor workflows, and native Intel Linux desktop acceptance remain open. See the release validation record for the exact checks and limitations.

Repository and development

This repository owns the VS Code interface, extension tests, branding, and VSIX packaging. The separate Mini Ora scanner repository owns detection, encrypted rules, activation, the local agent, and platform installers. The extension identifier remains NLTC.sprk3-argus.

The download versions above describe published artifacts. The main branch currently declares extension 1.0.8 in package.json; the 1.1.1 preview was built from a later development commit. Building main does not reproduce that newer preview. Use the supplied VSIX to install it. This README update does not indicate a Marketplace release.

For extension development, use Node.js 22+ and the repository lockfile:

npm ci --include=dev
npm run check
npm test

The extension does not bundle the scanner or detection rules. See repository provenance and the security policy.

Built in collaboration with Oren and Nautilus. Questions or beta feedback: support@sprk3.com.