VulnMatter VS Code Extension

Visual Studio Code extension integrating CVE vulnerability analysis and automatic configuration of MCP (Model Context Protocol) servers for VulnMatter and Filesystem.

NOTE: CVE analysis, report generation and products UI sections are currently hidden (temporarily disabled) while focusing on configuration features. They can be re-enabled later without code loss.

🚀 Key Features

• Management and persistence of VulnMatter X-API-Key
• Batch CVE scoring (temporarily hidden)
• Aggregated report generation (temporarily hidden)
• Local history (products) (temporarily hidden)
• Automatic configuration of:
  • VulnMatter MCP server (supergateway over SSE)
  • Filesystem MCP server (@modelcontextprotocol/server-filesystem)
  • Synchronization for both VS Code MCP and Claude Desktop
• Diagnostic button (🔧) to view current configuration status

1. Development Installation

npm install
npm run compile

Then press F5 in VS Code to open the "Extension Development Host" window.

2. Requirements

3. VulnMatter API Configuration

1. Open the extension side view.
2. Go to the "API Configuration" section.
3. Enter your X-API-Key and optionally a different API URL if you use a custom environment.
4. Click "Save Configuration".

3.1 How to Obtain a VulnMatter API Key

If you do not yet have an API Key (official site: https://vulnmatter.com/):

1. Navigate to the VulnMatter portal (internal/company URL or https://app.vulnmatter.com as applicable).
2. Sign in (create an account if needed) with your corporate SSO or email/password (depending on deployment).
3. Open your user/profile menu and locate the section named "API Keys" or "Developer / API Access".
4. Click "Create New Key" (or "Generate Token").
5. Provide an optional label (e.g. "VS Code Extension").
6. Copy the generated key immediately – many portals only show it once.
7. Paste it into the extension UI field X-API-Key and press "Save Configuration".
8. (Optional) If you are using a self‑hosted VulnMatter instance set the custom base URL before saving.

IMPORTANT: The value must be placed specifically in the form field labeled X-API-Key inside the extension panel (it is a password-style input). Do not place it in the API URL field.

Security / storage notes:

• The key is written in plain text to ~/.vulnmatter/config.json (no encryption). Protect filesystem access.
• You can revoke the key at any time in the portal; then generate a new one and update the extension.
• Avoid committing the key to source control. The extension never auto-uploads it.
• If multiple keys are supported later you can rotate without downtime.

For assistance you can email: support@vulnmatter.com

Troubleshooting key issues:

• 401 / unauthorized responses → key revoked, expired, or pasted with whitespace.
• Empty results or timeouts → verify base URL or network proxy settings.
• After changing the key, use the UI Save again to force regeneration of external MCP configs.

Generated configuration file:

~/.vulnmatter/config.json

Example:

{
  "apiKey": "TU_API_KEY",
  "apiUrl": "https://api.vulnmatter.com",
  "timestamp": "2025-09-20T12:34:56.123Z",
  "paths": {
    "vulnmatterConfig": "C:/Users/usuario/.vulnmatter/config.json",
    "claudeDesktopConfig": "C:/Users/usuario/AppData/Roaming/Claude/claude_desktop_config.json",
    "vsCodeMcpConfig": "C:/Users/usuario/AppData/Roaming/Code/User/mcp.json",
    "effectiveRoot": "C:/ruta/proyecto",
    "serverNodeName": "filesystem_miproyecto"
  }
}

4. CVE Analysis (Temporarily Hidden)

When re-enabled:

1. Enter CVEs one per line, format: CVE-YYYY-NNNN.
2. Click "Analyze CVEs".
3. Scores appear (simulated values are generated if the API is unreachable).

Color legend:

• High (>=7.0): Red
• Medium (4.0–6.9): Orange
• Low (<4.0): Green

5. Report Generation (Temporarily Hidden)

When re-enabled:

1. Make sure you have entered CVEs.
2. (Optional) Add additional query parameters: format=pdf&detailed=true.
3. Click "Generate Report".
4. A record is stored in ~/.vulnmatter/products.json.

6. MCP Integration

The extension configures MCP nodes for both VS Code and Claude Desktop.

6.1 Configuration Paths

6.2 VulnMatter MCP Server

Generated node:

{
  "servers": {
    "VulnMatter": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "supergateway", "--sse", "https://mcp.singularity-matter.com/sse"],
      "env": {
        "NODE_TLS_REJECT_UNAUTHORIZED": "0",
        "X-API-Key": "TU_API_KEY"
      }
    }
  }
}

6.3 Filesystem MCP Server

Dynamic name: filesystem_<project_basename>

{
  "servers": {
    "filesystem_miproyecto": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem"],
      "env": { "ROOT": "C:/ruta/proyecto" }
    }
  }
}

6.4 Activation from the UI

Available checkboxes:

• MCP VS Code → creates/updates VulnMatter node in mcp.json.
• MCP Claude → creates/updates node in claude_desktop_config.json.
• Filesystem MCP → creates local filesystem server.

The API Key is automatically injected into env.X-API-Key each time you reconfigure.

6.5 Diagnostic Button (🔧)

Shows a modal summary with:

• Status of each server
• Presence of API Key
• Active file paths

7. Automatic Migrations

If a legacy Assents node existed, it is renamed to VulnMatter in all configs (internal + Claude + VS Code MCP). Existing customizations are preserved.

8. Security

To improve security you could:

• Integrate with a Secret Manager (Azure Key Vault, AWS Secrets Manager)
• Encrypt the local file (add AES layer + user passphrase)

9. Troubleshooting

View current configuration

Click the 🔧 button (MCP status) or inspect:

~/.vulnmatter/config.json
%APPDATA%/Code/User/mcp.json
%APPDATA%/Claude/claude_desktop_config.json

Full reset

# Close VS Code and Claude Desktop first
rm ~/.vulnmatter/config.json
rm %APPDATA%/Code/User/mcp.json
rm %APPDATA%/Claude/claude_desktop_config.json

(Adjust paths per OS). Then reopen and reconfigure.

10. Development Scripts

npm run compile   # Compile
npm run watch     # Watch / incremental rebuild
npm run package   # Webpack production build

Package:

npm install -g @vscode/vsce
vsce package

11. Extend

12. Changelog

13. License

(Define here: MIT / Apache-2.0 / Proprietary)

14. Support

• Internal contact / Slack channel
• Repository issues (if applicable)

Need screenshots or want the hidden features back? Open an issue or request it.

npm install --save-dev @vscode/vsce
npx vsce package
npx vsce publish