SecureCode AI - Security Scanner for VS Code and Compatible Editors

SecureCode AI is a security scanner for AI-generated and developer-written code. Install it in Visual Studio Code or a compatible VS Code-based editor, including Cursor, Windsurf, and Google Antigravity, then scan, investigate, and fix vulnerabilities without leaving your editor.

Instead of asking your AI model “is this safe?” and trusting it to review its own code, SecureCode acts as an independent security auditor.

• Editors: VS Code and compatible desktop forks that support VSIX extensions, including Cursor, Windsurf, and Google Antigravity
• AI tools via MCP: Cursor, Claude Code, Codex, Windsurf, and other compatible MCP clients
• Languages (today): JavaScript / TypeScript, Python, PHP
• Use cases: AI-generated code review, security hardening, pre-commit checks

Why SecureCode?

AI coding tools are excellent at generating code, but they are not reliable security reviewers of their own output. SecureCode works independently of whichever editor, coding assistant, or model produced the code. Self-review often:

• Miss exploitable vulnerabilities
• Rationalize insecure patterns as “safe”
• Produce fixes that have not been tested against real attack techniques

SecureCode solves this by adding a multi-phase verification pipeline on top of your existing workflow:

• Fast AI discovery (Scout)
• Deep AI verification (Juror), by a different model than the one that found the candidate
• AI merge and de-duplication (Reconcile)
• On-demand secure fixes (Fixer)
• Opt-in adversarial proof (Attacker → Validator), which builds attack scenarios and can replay them against your own dev server

You keep using AI to write code. SecureCode verifies and hardens it.

Key Features

• One-click security scan of the current file
• AI pipeline: Scout → Juror → Reconcile → Fixer, plus an opt-in Attacker → Validator flow
• Actionable findings with severity, confidence, and explanation
• On-demand AI fixes for specific vulnerabilities
• Works alongside AI coding tools through the editor and the included MCP server
• Account-based usage with Free, Pro, and Lifetime plans

Editors and AI Tools

SecureCode is built on the VS Code extension API. It supports:

• Visual Studio Code - Marketplace installation, sidebar results, inline diagnostics, commands, and approval dialogs
• VS Code-compatible desktop editors - Cursor, Windsurf, Google Antigravity, and other forks that support standard VSIX extensions and the APIs SecureCode uses
• MCP clients - Cursor, Claude Code, Codex, Windsurf, and other clients that can launch a local stdio MCP server

Fork compatibility depends on each editor's VS Code API and Marketplace support. If an editor does not show the Visual Studio Marketplace listing, install the .vsix from the GitHub release. SecureCode's automated clean-host tests run against official VS Code; named forks are compatibility targets, not separately certified builds.

Supported Languages

Current optimized languages:

• JavaScript / TypeScript
• Python
• PHP

Quick Scan and Full Scan work on whichever file you have open. The multi-file modes (workspace, folder, staged, scan-on-save) currently cover .js, .jsx, .mjs, .cjs, .ts, .tsx and .py only.

Planned (roadmap):

• Java, Go, Rust, C++/C#, Ruby

How It Works – Scan Pipeline

SecureCode uses a four-phase AI pipeline to balance speed, recall, and precision. Every phase runs on the SecureCode API — there is no local analysis phase and no non-AI mode. See Privacy & Security for exactly what is uploaded.

Phase 1 – Scout (AI Fast Discovery)

• A fast, code-strong model at low reasoning effort
• Scans the entire file for security hotspots
• Returns line numbers + vulnerability types only (minimal output)
• Designed for speed and high recall – false positives are acceptable

Example output:

[
  { "line": 45, "type": "SQL Injection" },
  { "line": 71, "type": "Missing Authorization" }
]

Phase 2 – Juror (AI Deep Verification)

• A stronger reasoning model at high reasoning effort, deliberately not the same model as Scout, so the Juror is not grading its own output
• Takes each candidate from Scout and inspects ±20 lines of context
• Verifies whether the issue is real and exploitable
• Outputs: status, severity, confidence, explanation, and fix strategy

Example verdict:

{
  "status": "VULNERABLE",
  "severity": "HIGH",
  "confidence": 0.92,
  "why": "User input flows directly into SQL without parameterization.",
  "fix_strategy": "Use parameterized queries / prepared statements."
}

Phase 3 – Reconcile (AI Merge, Deep Mode Only)

• Merges the verified Juror findings into one list
• Deduplicates overlapping issues
• Drops obvious false positives
• Marks each finding with decision_basis. Every finding is AI_ONLY — there is no non-AI source to corroborate against

This gives you a clean, de-duplicated list of real issues.

Phase 4 – Fixer (On-Demand Secure Fixes)

• A model tuned for emitting large, structured patches
• Triggered only when you click “Fix” on a specific vulnerability
• Generates a targeted patch (function/section), not the whole file
• Adds security notes and why the fix is secure

Example output:

{
  "fixed_code": "...",
  "diff": "...",
  "fix_summary": "Replaced string concatenation with parameterized query.",
  "security_notes": ["Prevents SQL injection", "Uses prepared statements"],
  "why_secure": "User input is no longer concatenated directly into SQL.",
  "imports_needed": [],
  "confidence": 95
}

Plans & Limits (Short Summary)

Scanning is AI-metered end to end. When your allowance is exhausted the scan stops and the extension offers to top up — there is no non-AI fallback to drop back to.

• Free plan

  • 1 AI scan per day
  • 1 AI Fix per month
  • Basic findings & standard support

• Pro plan

  • Higher scan and fix limits for daily use
  • Full feature access

• Lifetime plan

  • One-time payment
  • Monthly quotas forever

(Exact pricing and quotas are shown on your landing page / dashboard.)

Installation

VS Code

1. Open Extensions (Ctrl+Shift+X / Cmd+Shift+X)
2. Search for “SecureCode AI”
3. Click Install
4. Leave secureCode.apiUrl alone unless you self-host — it already points at the hosted API (https://api.usesecurecode.tech). Set it to http://localhost:3000 to run against a local API
5. Open a JavaScript/TypeScript, Python, or PHP file
6. Press the command palette → SecureCode: Scan Current File

Cursor, Windsurf, Antigravity, and other VS Code forks

1. Open the editor's extensions panel and search for “SecureCode AI”
2. If the listing is unavailable in that editor's registry, download the .vsix from the GitHub releases page and use the editor's Install from VSIX command
3. Run SecureCode: Scan Current File from the command palette

MCP setup for AI coding tools

1. Install SecureCode AI in VS Code or a compatible fork and log in
2. Open a workspace folder
3. Run SecureCode: Show MCP Setup
4. Add the generated configuration to Cursor, Claude Code, Codex, Windsurf, or another MCP client
5. Use securecode.scan and securecode.map directly; securecode.fix and securecode.attack require explicit approval in the editor

Usage

1. Open any supported file (JS/TS, Python, PHP)
2. Run: “SecureCode: Scan Current File”
3. Wait ~15 seconds for the pipeline to complete
4. Review the list of findings:
   • Severity (LOW / MEDIUM / HIGH / CRITICAL)
   • Confidence score
   • Explanation (“why this is vulnerable”)
5. Click “Fix” on a finding to request a secure patch (subject to your plan limits)

Configuration

Model selection, reasoning effort, concurrency and timeouts are server-side and are not user-configurable.

The extension's own settings (Settings → Extensions → SecureCode) are:

Each setting's full description is in the settings UI.

Moving off the old API host

The API moved from https://securecode-api.onrender.com to https://api.usesecurecode.tech. What that means for you depends on how your secureCode.apiUrl is set:

• You never touched the setting. Updating the extension is all you need — the new default applies as soon as the new build is installed. Until you update, your editor keeps calling the old host.
• You set the setting explicitly (including anyone who pasted the old URL into settings.json). Your value wins over the shipped default forever, and no extension update will change it. Clear the setting to inherit the new default, or set it to https://api.usesecurecode.tech.

The old host cannot be redirected to the new one — an onrender.com hostname belongs to Render and cannot be pointed at self-hosted infrastructure — so it will be shut down rather than forwarded once enough installs have moved. If scans start failing with network errors and your secureCode.apiUrl still says onrender.com, that is why.

Privacy & Security

Scanning uploads your code. There is no local analysis phase and no non-AI mode. When you run a scan or request a fix, the extension sends to the SecureCode API:

• the complete contents of the file being scanned
• its absolute file path and language id
• the endpoint summary the Project Map derived for that file (route paths, middleware names, parameter names, auth scheme, ORM)

The API forwards your code to its inference provider for the Scout, Juror, Reconcile and Fixer phases. Transport is HTTPS/TLS, the code is used only for the request that carried it, and SecureCode does not train on it or retain it long-term.

What genuinely runs on your machine, with no upload:

• The Tree-sitter Project Map — the workspace parse that produces the endpoint summary. The parsing is local; the resulting summary travels with a scan, as above.
• Dependency scanning — lockfiles and manifests are parsed locally. Only package names and versions are sent, to the public OSV and NVD databases. No source code.
• The sandbox and runtime tracing — your workspace is copied to a temp directory, the proposed fix is applied there, and that copy's dev server is started and attacked on loopback, locally. Your own files are never modified and the copy is deleted afterwards. When secureCode.sandboxAiAdjudication is enabled (the default), cases the deterministic rules cannot decide send a redacted, truncated response excerpt to the API. Disable that setting to keep sandbox response analysis fully local.

There is no telemetry. The extension collects no usage analytics of any kind.

To keep files out of the workspace, folder, staged and scan-on-save modes, list them in a .securecodeignore file at the workspace root. Quick Scan and Full Scan act on the editor you have open, so they upload that file whatever it is.

Limitations

• Currently focused on JS/TS, Python, PHP
• Native UI workflows require VS Code or a compatible desktop fork; headless AI tools use the included MCP server
• Complex multi-service architectures may require manual review in addition to the tool

Feedback & Support

• Issues / bugs: use the support email listed in the extension or on the website
• Feature requests: contact via X/Twitter or email
• Enterprise / team usage: reach out for roadmap and team features