NotHoly models for offensive security work, inside your editor. Chat in the sidebar, review a file or your uncommitted changes for security issues, look up a CVE, and turn a selection into a regression test or a detection rule.
Findings show up in the Problems panel. A suggested fix opens as a diff, and nothing in your files changes until you accept it.
Getting started
In Cursor, Windsurf or VSCodium, search for NotHoly.com in the Extensions panel. In VS Code, download the .vsix file and run code --install-extension notholy-vscode-latest.vsix.
Run NotHoly: Sign in from the Command Palette (Ctrl+Shift+P / Cmd+Shift+P). Your browser opens to confirm a short code.
Open the NotHoly view in the activity bar and start a chat.
The API key is stored in VS Code's secret storage, never in your settings or workspace files. You need a NotHoly account with credit; see models and prices.
Commands
Command
What it does
NotHoly: Sign in / Sign out
Connect or disconnect your account.
NotHoly: Choose model
Lists the models from the live catalog.
NotHoly: Explain selection
Explains the selected code.
NotHoly: Review this file
Reviews the open file for security issues; findings go to Problems.
NotHoly: Review changes (git diff)
Reviews your uncommitted changes.
NotHoly: Investigate a CVE
CVSS, EPSS, KEV status and references for a CVE id.
NotHoly: Write a regression test for the selection
A test that fails while the issue exists.
NotHoly: Write a detection rule for the selection
A detection rule for the selected behavior.
NotHoly: Apply suggested fix
Opens the fix as a diff to confirm.
Settings
Setting
Default
notholy.model
empty
Model for chat and reviews. Empty uses the catalog’s default model.
notholy.codeLens
on
A review link above lines that usually need a second look.
notholy.apiBase
https://api.notholy.com/v1
API base URL.
notholy.appUrl
https://notholy.com
Web app URL, used for sign-in.
Workspace trust
In an untrusted workspace the extension only offers chat and CVE lookups. It does not read your files or run git there.
Languages
The interface follows VS Code's display language: English, Português (Brasil) and Español.
