VulnMatter VS Code Extension

Visual Studio Code extension integrating CVE vulnerability analysis and automatic configuration of MCP (Model Context Protocol) servers for VulnMatter and Filesystem.

NOTE: CVE analysis, report generation and products UI sections are currently hidden (temporarily disabled) while focusing on configuration features. They can be re-enabled later without code loss.

🚀 Key Features

• Management and persistence of VulnMatter X-API-Key
• Batch CVE scoring (temporarily hidden)
• Aggregated report generation (temporarily hidden)
• Local history (products) (temporarily hidden)
• Automatic configuration of:
  • VulnMatter MCP server (supergateway over SSE)
  • Filesystem MCP server (@modelcontextprotocol/server-filesystem)
  • Synchronization for both VS Code MCP and Claude Desktop
• Diagnostic button (🔧) to view current configuration status

1. Development Installation

npm install
npm run compile

Then press F5 in VS Code to open the "Extension Development Host" window.

2. Requirements

3. VulnMatter API Configuration

1. Open the extension side view.
2. Go to the "API Configuration" section.
3. Enter your X-API-Key and optionally a different API URL if you use a custom environment.
4. Click "Save Configuration".

Generated configuration file:

~/.vulnmatter/config.json

Example:

{
  "apiKey": "TU_API_KEY",
  "apiUrl": "https://api.vulnmatter.com",
  "timestamp": "2025-09-20T12:34:56.123Z",
  "paths": {
    "vulnmatterConfig": "C:/Users/usuario/.vulnmatter/config.json",
    "claudeDesktopConfig": "C:/Users/usuario/AppData/Roaming/Claude/claude_desktop_config.json",
    "vsCodeMcpConfig": "C:/Users/usuario/AppData/Roaming/Code/User/mcp.json",
    "effectiveRoot": "C:/ruta/proyecto",
    "serverNodeName": "filesystem_miproyecto"
  }
}

4. CVE Analysis (Temporarily Hidden)

When re-enabled:

1. Enter CVEs one per line, format: CVE-YYYY-NNNN.
2. Click "Analyze CVEs".
3. Scores appear (simulated values are generated if the API is unreachable).

Color legend:

• High (>=7.0): Red
• Medium (4.0–6.9): Orange
• Low (<4.0): Green

5. Report Generation (Temporarily Hidden)

When re-enabled:

1. Make sure you have entered CVEs.
2. (Optional) Add additional query parameters: format=pdf&detailed=true.
3. Click "Generate Report".
4. A record is stored in ~/.vulnmatter/products.json.

6. MCP Integration

The extension configures MCP nodes for both VS Code and Claude Desktop.

6.1 Configuration Paths

6.2 VulnMatter MCP Server

Generated node:

{
  "servers": {
    "VulnMatter": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "supergateway", "--sse", "https://mcp.singularity-matter.com/sse"],
      "env": {
        "NODE_TLS_REJECT_UNAUTHORIZED": "0",
        "X-API-Key": "TU_API_KEY"
      }
    }
  }
}

6.3 Filesystem MCP Server

Dynamic name: filesystem_<project_basename>

{
  "servers": {
    "filesystem_miproyecto": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem"],
      "env": { "ROOT": "C:/ruta/proyecto" }
    }
  }
}

6.4 Activation from the UI

Available checkboxes:

• MCP VS Code → creates/updates VulnMatter node in mcp.json.
• MCP Claude → creates/updates node in claude_desktop_config.json.
• Filesystem MCP → creates local filesystem server.

The API Key is automatically injected into env.X-API-Key each time you reconfigure.

6.5 Diagnostic Button (🔧)

Shows a modal summary with:

• Status of each server
• Presence of API Key
• Active file paths

7. Automatic Migrations

If a legacy Assents node existed, it is renamed to VulnMatter in all configs (internal + Claude + VS Code MCP). Existing customizations are preserved.

8. Security

To improve security you could:

• Integrate with a Secret Manager (Azure Key Vault, AWS Secrets Manager)
• Encrypt the local file (add AES layer + user passphrase)

9. Troubleshooting

View current configuration

Click the 🔧 button (MCP status) or inspect:

~/.vulnmatter/config.json
%APPDATA%/Code/User/mcp.json
%APPDATA%/Claude/claude_desktop_config.json

Full reset

# Close VS Code and Claude Desktop first
rm ~/.vulnmatter/config.json
rm %APPDATA%/Code/User/mcp.json
rm %APPDATA%/Claude/claude_desktop_config.json

(Adjust paths per OS). Then reopen and reconfigure.

10. Development Scripts

npm run compile   # Compile
npm run watch     # Watch / incremental rebuild
npm run package   # Webpack production build

Package:

npm install -g @vscode/vsce
vsce package

11. Extend

12. Changelog

13. License

(Define here: MIT / Apache-2.0 / Proprietary)

14. Support

• Internal contact / Slack channel
• Repository issues (if applicable)

Need screenshots or want the hidden features back? Open an issue or request it.

npm install --save-dev @vscode/vsce
npx vsce package
npx vsce publish