AI-powered predictive security analysis with LangGraph multi-agent system, real CVE database scanning via OSV.dev, CWE classification, and cross-module impact prediction
Installation
Launch VS Code Quick Open (Ctrl+P), paste the following command, and press enter.
PreSec AI is a security extension for Visual Studio Code that catches vulnerabilities as you write code. It combines local static analysis with the contextual depth of Large Language Models (LLMs) to flag issues before they are committed.
Key Features
Real-Time AST Parsing: Moves beyond standard regex matching by using Abstract Syntax Tree (AST) analysis to natively understand code logic, variables, and structure.
Hybrid Detection Engine: Utilizes a local dictionary of standard OWASP Top 10 vulnerabilities for instant feedback, falling back to a structured LLM engine for complex, context-dependent threats.
Context-Aware Analysis: Define your current architectural context (e.g., Database, Auth System) via the sidebar panel to strictly guide the vulnerability engine.
Structured AI Outputs: Leverages strictly enforced API schemas to ensure consistent, machine-readable vulnerability reports without UI drift or layout breaks.
How to Use
Open the PreSec AI panel in the VS Code sidebar.
Enter your API key in the extension settings to enable the LLM engine.
Select your current development context from the structured UI dropdown.
Write code. The extension automatically highlights dangerous patterns and suggests remediations directly in your editor.
Configuration
To utilize the context-aware LLM features, you must configure your API key in VS Code settings.
Setting
Description
presec.api.geminiKey
Your Google Gemini API key used for deep-context vulnerability analysis.
Note: Local AST parsing and standard OWASP detection run entirely on your machine and do not require an API key.
Privacy and Data Security
Standard structural vulnerabilities are caught locally on your machine without transmitting code.
When the LLM engine is triggered, only the relevant code snippets and defined architectural tags are sent to the API.
Review your LLM provider's data retention policies regarding API usage.
Feedback and Contributions
PreSec AI is open-source. If you encounter bugs, false positives, or want to contribute to the local detection dictionaries, please visit the repository.
