PreAI — Security for the AI-Coding Era

A local-first security scanner for VS Code and every VS Code–compatible editor (Cursor, Windsurf, Antigravity, VSCodium). It stops leaked secrets, regulated PII, vulnerable dependencies, insecure AI-generated code, and risky AI-tool/agent configurations — before they reach a commit, a build, or an AI assistant's context window. Nothing ever leaves your machine.

Why PreAI matters

AI coding assistants and agents changed the threat model. They read your whole repo (including .env files and secrets), they write code that ships insecure defaults, they pull in packages that may not exist or may be malicious, and they act on your machine through MCP servers and auto-run settings. Traditional scanners were built for a world where a human typed every line and nothing read your code but you.

PreAI is the editor-level enforcement layer for that new world. It rolls five classes of risk into one extension and catches them as you work — not days later in a CI report:

And beyond detecting, PreAI can actively block: its Guard installs a pre-execution hook into Claude Code, GitHub Copilot (VS Code agent mode and Copilot CLI), Cursor, Windsurf, Antigravity (IDE and CLI) or Kiro CLI — on Windows, macOS and Linux, no Node.js needed — and decides — per action — whether to allow, ask, redact, or deny a command, file read, or tool call before it happens. (Enforcement capability varies by host — see the support matrix.)

Local-first, always. No scan data leaves your machine. No telemetry. Zero runtime dependencies. The only optional network call is a signed vulnerability-catalog refresh from a CDN you configure.

Who it's for

• Developers using AI assistants who want a safety net against leaked secrets and insecure generated code.
• Security & platform teams governing "shadow AI" — which tools the org allows, what they can read, and what agents are allowed to do.
• Regulated organizations (finance, healthcare, public sector) that cannot use cloud scanners because the code can't phone home. PreAI runs entirely on the machine.

Supported platforms

PreAI ships as a standard VS Code extension (engines.vscode ^1.85.0), so the full graphical experience — reports, status bar, squiggles, quick fixes — works in every VS Code–compatible editor. The Guard also reaches command-line agents that have no UI.

Detection, scanning, reports, and the AI Exposure Audit are identical in every GUI editor — each report auto-matches the host's theme. The Guard's enforcement varies by host († above): Cursor/Windsurf/Kiro CLI block secret-bearing reads where Claude/Copilot/Antigravity ask, Windsurf and Kiro CLI can't ask so they block, and Kiro IDE can't be enforced. PreAI tests every installed hook and shows a red Guard: not protecting alert if one stops working. See the full support matrix for exactly what works where.

Install

PreAI is distributed as a signed .vsix from the PreAI portal (PreAI sets up your subscription under an agreement; sign in to download; offline / air-gapped customers receive the .vsix and an offline license key from their PreAI license administrator). A valid license is required to scan.

VS Code / Cursor / Windsurf / Antigravity / VSCodium — same command in each editor's integrated terminal:

code --install-extension preai-2.6.0.vsix      # VS Code
cursor --install-extension preai-2.6.0.vsix    # Cursor
windsurf --install-extension preai-2.6.0.vsix  # Windsurf

…or from the editor UI: Extensions panel → “…” menu → Install from VSIX… → pick the file → Reload.

Build from source:

npm ci
npm run compile
npx @vscode/vsce package          # → preai-2.6.0.vsix
code --install-extension preai-2.6.0.vsix

That's it — PreAI activates automatically when you open a folder. There is nothing to configure to get started.

Your first 5 minutes

1. Open any project. PreAI activates and, ~2 seconds later, runs one combined workspace audit (secrets + PII + malicious patterns + dependencies).
2. Watch the status bar (bottom-right). You'll see two indicators, PreAI: (secrets/code) and SCA: (dependencies). They read not scanned → scanning… until the audit finishes, then $(shield) PreAI: clean / $(package) SCA: clean or counts such as $(alert) PreAI: 2 critical · 1 high. They stay live as you edit and as files change on disk. Click either one to open the live Security Report (the SCA item opens it on the Dependencies tab).
3. Open the PreAI sidebar — the shield icon in the Activity Bar (left edge) has three live sections: Findings (grouped, click to jump), Guard (agent protection, mode, installed hooks) and License (the License Manager: status, days left, licenses on this machine, mode, features, tools).
4. If there are findings, the Security Report opens automatically (a clean workspace opens nothing). Filter by severity, switch tabs, click any finding to jump to the exact line.
5. Run the AI Exposure Audit — Command Palette (Ctrl/Cmd+Shift+P) → “PreAI: AI Exposure Audit.” See which AI tools can read your secrets and one-click “Add all to .aiignore” to protect them.
6. (Optional) Turn on Guard — Command Palette → “PreAI: Enable … Pre-Execution Blocking” for your agent, starting in observe mode.

📖 Full step-by-step instructions for every platform and feature: see docs/public/product/user-manual.md.

The reports — what you get and how to read them

PreAI surfaces results through several complementary surfaces. Keep the ambient ones on always; open the rich ones when you're fixing things. (Full reference: docs/public/product/reports-guide.md.)

How the reports load: each webview is a static, sandboxed shell (strict CSP, no inline data) that receives findings via message-passing and renders them live — so a panel you leave open updates as you edit, and it inherits your editor's theme. The Security Report auto-opens on startup only when there's something to show.

The Security Report at a glance

╔═══════════════════════════════════════════════════════════════════════╗
║  ◆ PreAI — Security Report                                             ║
║  Generated 2026-06-17 10:42 UTC  ·  Tool v2.4.0  ·  Catalog 2026.06   ║
╠═══════════════════════════════════════════════════════════════════════╣
║  [All 11] [Malicious 1] [Insecure 2] [Dependencies 7] [Secrets 4]     ║
║  ● Critical 3   ● High 5   ● Medium 3                  [Export HTML ▾] ║
╟───────────────────────────────────────────────────────────────────────╢
║  ▾ package-lock.json — 4 findings                                     ║
║     │ CRITICAL  minimist <1.2.6 — Prototype Pollution                 ║
║     │           minimist@1.2.5 · npm · via express · ⚠ reachable      ║
║     │           Fix: upgrade to 1.2.6+              Open file · Advisory║
║  ▸ src/api.ts — 4 findings  (AWS key, Aadhaar, JWT, …)                ║
╚═══════════════════════════════════════════════════════════════════════╝

Features

Real-time secret, PII & malicious-code detection

Pattern + entropy scanning on every file you open, edit, or save. Secrets are redacted on screen (AKIA********LE) so the alert never re-leaks the value. Covers AWS, GitHub, Slack, Stripe, OpenAI, Anthropic, Twilio, SendGrid, Mailgun, npm tokens, private keys, JWTs, DB connection strings, and high-entropy blobs — plus globally-regulated PII (credit cards with Luhn+BIN, IBAN mod-97, email, E.164 phone), national IDs across ~20 countries — US SSN, Canada SIN, UK NINO/NHS, France NIR, Spain DNI, Germany Steuer-ID, Netherlands BSN, Italy Codice Fiscale, Brazil CPF/CNPJ, China Resident ID, Korea RRN, Singapore NRIC, Australia TFN, South Africa ID and the Middle East (UAE Emirates ID, Saudi ID, Qatar QID, Israel ID, Turkey T.C. Kimlik), each confirmed by its own checksum — and India-specific PII (PAN, Verhoeff-validated Aadhaar, GSTIN, IFSC, bank account, mobile). Malicious patterns include curl | sh, reverse shells, eval(atob(…)) obfuscation, destructive deletes on Linux and Windows (rm -rf /, Remove-Item -Recurse C:\, format, diskpart clean), ransomware-style recovery wipes (vssadmin delete shadows, wbadmin delete), prompt injection, and Trojan-Source Unicode.

Insecure code — the “AI-slop” rule pack

A dedicated pack for the insecure defaults AI codegen reliably reproduces, shown in their own Insecure code tab: TLS verification disabled, unsafe deserialization (pickle.loads, yaml.load, torch.load), SQL/shell injection by string-building, weak JWT verification, weak hashes (MD5/SHA-1), debug mode enabled, permissive CORS, world-writable perms, insecure randomness used for secrets, and XSS, SSRF, path traversal, XXE, template injection and hard-coded keys — verified per language by an executable matrix (133 language × vulnerability cells across 13 languages, each with a vulnerable snippet that must flag and a safe one that must not). A line that visibly sanitizes the input (path.basename, secure_filename, an allow-list check) is not flagged.

Software Composition Analysis (SCA)

Inline diagnostics on 30 lockfile & manifest formats across 12 advisory-audited ecosystems (npm, pip incl. PEP 751 pylock.toml, Go, RubyGems, Composer, Cargo, NuGet, Maven, Dart, Elixir, Swift, Haskell), matched against an embedded catalog of known-vulnerable versions with full semver, PEP 440, and exact-version range grammars. Ecosystems whose lockfile is opt-in (NuGet, Gradle) or absent are also scanned from their declared project manifests — .csproj/.fsproj/.vbproj, packages.config, Directory.Packages.props, build.gradle(.kts), the libs.versions.toml version catalog (incl. rich versions), pyproject.toml (PEP 621, PEP 735 dependency groups, Poetry, uv, PDM)/setup.py, and Package.swift (incl. Package@swift-X.Y.swift) — so a project with no committed lockfile is never silently skipped (a resolved lockfile, when present, supersedes the manifest to avoid double-counting; a Gradle catalog defers to any lockfile in its project). In a multi-root workspace every folder is scanned and gets its own SARIF and SBOM. A further 7 ecosystems are inventory-only (CocoaPods, Conan, Conda, Crystal, Clojure, Elm, vcpkg) — parsed into the SBOM so nothing is silently unscanned, but not vulnerability-audited (no curated advisory feed); the scan summary and report label these explicitly so a clean result is never mistaken for an audit. No package manager is ever executed — read-only parsing only. Every finding gets import-level reachability (reachable: true/false/unknown) so unused vulnerable deps don't drown out real exposure, and a dep-path that traces a transitive CVE back to the direct dependency you can actually upgrade. Build-step pinning rules catch unpinned GitHub Actions and :latest Docker base images.

AI Exposure Audit

The audit no other scanner runs — which AI tools are active, what they can read and do, and which of your secrets are reachable by them. It detects tools three ways (manifest capability classifier, signed risk registry, MCP config parsing) so brand-new tools are caught without an update. Detections include: AI-reachable secrets (not excluded by .aiignore/.cursorignore/…), an evasion-resistant AI Content Threat Engine (direct & indirect prompt injection, hidden/Unicode-obfuscated content, exfiltration chains — tagged to OWASP LLM Top 10 / OWASP Agentic / MITRE ATLAS), hallucinated-import / slopsquat detection, MCP capability + supply-chain audit, MCP rug-pull / definition-drift, out-of-workspace folder access, untrusted model-file (pickle opcode) scanning, model-endpoint / data-residency classification, dangerous-autonomy config detection, and an AI governance policy (.preai/ai-policy.json) with optional defaultDeny.

Guard — actively block risky agent actions

Everything above detects; the Guard prevents. It evaluates read / write / shell / mcp_call / fetch and decides — per action — to allow / ask / redact / deny before it runs, reusing the same detection engines with zero new network access. Three modes (observe → ask → enforce), one-command host installers for Claude Code / GitHub Copilot / Cursor / Windsurf / Antigravity / Kiro CLI (or install-all), a standalone Guard program so hooks run without Node.js (Windows, macOS, Linux), automatic hook repair and health checks with a loud alert when a hook isn't protecting, an MCP guard gateway for MCP servers, and a redacted decision audit log. Like the rest of PreAI it is license-gated — the CLI, gateway, and daemon run inert (pass-through, never blocking your agent) unless a valid license is present (mirrored to ~/.preai/guard-license.json and cryptographically re-verified). Full reference: docs/public/product/guard.md.

Also included

Signed Ed25519 catalog auto-update (PreAI's built-in feed of ≈139,000 OSV advisories, or your own mirror) · policy engine with expiring suppressions (.preai/policy.json) · CycloneDX 1.5 SBOM · ready-to-use CI/CD workflows (PR diff gate, scheduled scans, SARIF upload) · multi-repo fleet dashboard · VS Code quick fixes (upgrade dep / suppress finding).

Command reference

Run from the Command Palette (Ctrl/Cmd+Shift+P):

Settings reference

All settings live under the preai.* namespace (Ctrl/Cmd+, → search “preai”).

Secret / credential scanner

SCA (dependency scanner)

AI Exposure Audit

Guard

Licensing

Team Server (optional — Team edition)

The .preai/ folder

PreAI writes everything into a workspace-local .preai/ folder (safe to commit the policy files; add the rest to .gitignore if you prefer):

Privacy & security

1. No scan data leaves your machine by default — lockfiles, package names, source, findings: none transmitted unless you opt in. The one exception is the optional Team Server (preai.team.serverUrl): when you configure it, PreAI reports result summaries only — finding metadata, counts, file paths, redacted Guard decisions — to your own self-hosted server. Source code and secret values are never sent.
2. No telemetry — no analytics SDK, no install ID, no usage tracking.
3. Outbound traffic you can see and switch off — the signed vulnerability-catalog refresh (a plain download from PreAI's feed when the release has one built in, or from your own mirror in catalogManifestUrl; nothing about you, your code or your packages is sent; off with preai.sca.autoUpdateCatalogs: false) and Team Server reporting (preai.team.serverUrl, your own host, off unless you set it).
4. Zero runtime dependencies — the audit surface is exactly the code in this repo.
5. Signature verification fails closed — tampered/unsigned/wrong-key downloads are rejected.

Troubleshooting & FAQ

The status bar shows old data after I delete/move files, or after an AI agent / git pull / npm install changes files. Fixed — both indicators follow file changes on disk (created, modified, deleted, moved) as well as editor edits, and the SCA indicator rescans when any dependency file or .preai/policy.json changes. Hover an indicator to see what it covers and when it last updated; use Rescan workspace in the report to force a full rescan.

The status bar says not scanned or off. not scanned means the startup audit hasn't run (or preai.sca.scanOnStartup is off) — click the indicator and the report opens and starts the scan. off means there is no active license, so nothing is scanning.

Clicking the status bar. It opens the live Security Report (the SCA indicator opens the Dependencies tab). The report updates in place as results change; Rescan workspace runs a full scan.

Reports show an old product name. You're running an older installed build. Reinstall the current .vsix (--force) and Reload Window.

It's not installable from my editor's marketplace. Cursor/Windsurf pull from Open VSX, not the VS Code Marketplace. Install the .vsix directly (command above or “Install from VSIX…”).

Will it slow down my editor? Real-time scans are debounced (preai.debounceMs, default 400 ms) and capped at 1 MB/file; the heavy workspace/AI audits run on open and on demand, not per keystroke.

A finding is a false positive. Use the Suppress this finding quick fix (adds an expiring rule to .preai/policy.json), or add a path to preai.scanFilenameAllowlist.

My ecosystem isn't listed. Unsupported ecosystems are reported as “not audited” in the scan output — they're never silently skipped.

Disclaimer

PreAI performs automated, best-effort static analysis. It does not guarantee detection of all secrets, vulnerabilities, or policy violations, and may produce false positives or miss real issues. A clean result is not a warranty that your code is secure or compliant. Use PreAI as one layer within a broader security process — not a sole control. The software is provided “as is”, without warranty of any kind; the authors and SANNIDDHI INFOSOLUTIONS LIMITED accept no liability for any loss or damage arising from its use.

Licensing & activation

PreAI is paid-only: a valid, signed license is required to scan. Licenses are Ed25519-signed and verified locally against PreAI's keys built into the extension (license keys from settings or files are never trusted in release builds). Two licensing models, switchable at any time:

Run PreAI: Switch Licensing Mode to change models. The online and offline licenses are stored separately, so switching back restores the other one. Offline licenses have a fixed start date and expiry date chosen by the issuer; before the start date the license shows as not yet valid, and after expiry (plus any grace days) scanning stops until a new key is installed. An issuer can switch an offline license off early with a signed revocation list — run PreAI: Import License Revocation List / Clock Reset, or place the file at ~/.preai/revocations.json.

Machine-linked licenses. Offline licenses are normally linked to specific developer machines. Each developer runs PreAI: Copy Device ID and sends the ID to their license administrator; one key can link many machines. On any other machine the key is rejected ("this device is not linked to the license"). When machines, seats or features change, the issuer sends a replacement key plus a revocation list for the old key — install the key, then import the list.

Tamper resistance. All preai.license.* settings are read from user settings only (a repository's .vscode/settings.json can't change licensing), the license server URL must be https://, licenses are re-checked while the editor is open, and PreAI remembers the latest date it has seen so turning the clock back doesn't extend a license. The official package also checks that signature inside the scanner before detection patterns are used, so a license that is not signed by PreAI does not turn scanning on. For support, run PreAI: License Diagnostics and paste the report into your ticket.

Device-bound licenses. An offline license can be pinned to one machine. Run License Manager → Copy device ID (or PreAI: Copy Device ID) and send that ID with your license request; the issued .lic then works only on that machine — copying it elsewhere is rejected as “bound to a different device.” The device ID is a one-way hash of stable hardware signals (only the hash ever leaves your machine). Floating licenses (no device binding) keep working everywhere.

License

Proprietary / closed-source. © SANNIDDHI INFOSOLUTIONS LIMITED. All rights reserved. Distributed under the PreAI commercial license; not redistributable.

Support & more

• 📖 docs/public/product/user-manual.md — full step-by-step end-user manual for every platform and feature
• 📊 docs/public/product/reports-guide.md — every report explained, with what you can do with each
• 🛡️ docs/public/product/guard.md — the Guard subsystem (modes, per-host installers, MCP gateway, audit log)
• 🧪 docs/public/product/guard-testing.md — test the Guard and MCP gateway (preai-guard selftest), manual per-agent checks, and the exact hook config for every tool
• 📗 docs/public/product/guard-complete-guide.md — the complete Guard guide: every mode, setting, platform, agent and the MCP gateway, with demo data and worked examples
• 🤖 docs/public/product/guard-supported-agents.md — which AI agents the Guard protects in this version, and exactly how (hook files, payloads, answers, health checks)
• ⚖️ docs/public/product/extension-vs-guard.md — the extension vs. the Guard: what each does, with side-by-side examples and full feature lists
• 🧩 DEVELOPER.md — internals & contribution guide · CHANGELOG.md — version history
• ✉️ Questions / bug reports: the PreAI portal, or info@preai.dev

When reporting an SCA false positive/negative, include the lockfile (or a minimal repro), the package+version, the advisory ID, and the output of PreAI: Show SCA Status.