Jokalala Code Analyzer - VS Code Extension

A hybrid SAST extension: local Tier-1 deterministic packs ($0 on-save) plus optional cloud Stage-1, with Container/IaC scanning, SCA, plugins, and 19+ languages.

Pricing & Access Tiers

Get started for free – no credit card required!

Quick Start

New to Jokalala? Check out our Getting Started Guide for step-by-step setup instructions!

1. Install the extension from VS Code Marketplace
2. Start analyzing – Works immediately with 5 free analyses/day (no account needed!)
3. Optional: Create a free account at jokalala.com/signup for 10/day + all languages
4. Analyze your code with Ctrl+Alt+A / Cmd+Alt+A

What's New in v2.12.7

• Accept All / Reject All in Dev Chat when multiple patches are pending (Confirm still per proposal).
• History sync with jokalala.com — hydrate on open, History picker, and open-chat?conversationId= deep link.
• Fix: Apply fix ByteString / truncated API key (2.12.6). Rejects API keys with Unicode ellipsis … so Apply/API calls fail with a clear re-set-key message.
• Fix: web Accept now shows IDE diffs (2.12.5). Confirm is non-modal and waits for the side-by-side vscode.diff.
• Marketplace docs catch-up (2.12.3). README What's New covers 2.12.x instead of stalling on v2.10.0.
• Open in Browser handoff (2.12.1). From the in-IDE Jokalala Chat panel, Open in Browser ↗ opens /ai/chat with your live conversationId.
• v2.12.0 — AI heuristics + smarter refactor. Local Tier-1 includes the jokalala.ai-code pack; symbol-aware rename via LSP; optional ghost-text tips.
• v2.11.0 — CodeLens Fix + Quick Edit. Fix (Jokalala) CodeLens; Quick Edit (Ctrl/Cmd+Shift+K); Dev Chat @file chips and tool steps.

See CHANGELOG.md for full history (including v2.10.x in-IDE Dev Chat panel and earlier IDE bridge work).

Features

Hybrid Tier-1 / Cloud Pipeline

1. Tier 1 (local): Versioned JSON packs + JS/TS AST — instant, offline-capable
2. Tier 2 (cloud Stage-1): Same pack IDs via analyze-enhanced when hybrid/deep/full
3. On-save: always Tier-1 only

Benefits:

• Instant feedback without network cost
• No quality cliff when offline (same local engine)
• Precision-first pack profile by default

Real-time Code Analysis

• File Analysis: Analyze individual files for security vulnerabilities, code quality issues, and best practice violations
• Selection Analysis: Analyze specific code selections for targeted feedback
• Project Analysis: Comprehensive analysis of entire projects with prioritized issue reporting
• Incremental Analysis: Only re-analyze changed files for faster feedback

Dev Chat Integration

Bring Jokalala Dev Chat's AI-proposed fixes directly into your editor:

• Chat without leaving VS Code: the "Dev Chat" sidebar view (Jokalala: Open Dev Chat) streams responses and lets you Accept/Reject proposed patches inline, without opening a browser tab
• Analyzer → chat loop: after a file scan, choose Fix with Dev Chat; use the lightbulb Ask Dev Chat to fix this finding; or click the inline Fix (Jokalala) CodeLens. Each turn attaches the active editor file so remediation tools have corpus without a prior zip index
• Quick Edit (Cmd+Shift+K): select code, describe the change, review via the same diff + Confirm apply flow as chat Accept
• Review before anything touches disk: every proposed patch opens as a real VS Code diff (original vs. proposed) before you're asked to confirm
• Freshness check: if a file changed since the proposal was generated, you're warned before the confirm dialog instead of finding out partway through Apply
• One explicit confirmation: nothing is written until you click Apply on the modal prompt — no silent writes, no auto-apply, and each file in a multi-file patch is applied independently (one file failing doesn't affect the others)
• Undo: Jokalala: Undo Last Applied Patch, also offered right on the success message — restores every file an Accept touched
• Hydrate on demand: push a local file into your Dev Chat cloud snapshot so proposals are generated against your actual current code, not a stale scan
• Multi-root aware: resolves the correct workspace folder automatically, or asks you to pick when a path is ambiguous across folders
• Real-time delta sync: with jokalala.ideBridge.deltaSync on, a FileSystemWatcher (not just save events) keeps your cloud snapshot aligned with creates, deletes, and changes made outside the editor — a git checkout or external tool writing a file no longer silently desyncs it
• Local verify revise loop: failed pnpm test / pnpm lint after Accept opens in-IDE Dev Chat with the output (browser fallback still available)
• Visible local verify: when local verify is enabled, it runs in a real integrated terminal by default so you can see what's happening (jokalala.ideBridge.localVerifyVisible, disable for a silent/headless run)

Security Vulnerability Detection

• 50+ Vulnerability Types: SQL injection, XSS, command injection, path traversal, and more
• OWASP Top 10 Coverage: Comprehensive detection of all OWASP Top 10 vulnerabilities
• CWE/CVE Mapping: Industry-standard vulnerability classification
• CISA KEV & EPSS: Prioritization using exploit data and probability scores
• Auto-Fix Suggestions: One-click fixes for many vulnerability types

Container & Infrastructure-as-Code Security

Scan your infrastructure configurations for security misconfigurations:

• Dockerfile Analysis: Detect insecure base images, root user usage, exposed secrets, missing health checks (CIS Docker Benchmark)
• Docker Compose: Identify privileged containers, host network sharing, Docker socket mounts
• Kubernetes Manifests: Find privileged pods, missing security contexts, dangerous capabilities (CIS Kubernetes Benchmark, NSA/CISA Guide)
• Terraform: Detect open security groups, public resources, disabled encryption, hardcoded secrets
• CloudFormation: AWS infrastructure template security analysis
• Helm Charts: Kubernetes package security scanning

Software Composition Analysis (SCA)

Secure your dependencies across multiple ecosystems:

• Multi-ecosystem Support: npm, pip, Maven, Gradle, Go, Rust (Cargo), Ruby, PHP, .NET
• NVD Integration: Real-time CVE lookups with CVSS scores
• SBOM Generation: CycloneDX 1.5 and SPDX 2.3 format support
• License Compliance: Detect high-risk (GPL, AGPL) and medium-risk licenses
• Dependency Graph: Visualize transitive dependencies

Plugin System for Custom Rules

Extend the analyzer with your own security rules:

• Custom Rule Engine: Create pattern-based or AST-based rules
• Rule Packs: Bundle and share collections of rules
• Marketplace Integration: Browse and install community plugins
• Language Plugins: Add support for additional languages
• Hook System: Integrate with CI/CD pipelines

Language Support (19+ Languages)

Rust Language Support (NEW)

Comprehensive security analysis for Rust with framework detection:

Web Frameworks:

• Actix Web, Rocket, Axum, Warp

Database/ORM:

• Diesel, SQLx, Sea-ORM

Runtime:

• Tokio async runtime patterns

Security Patterns:

• Unsafe code analysis
• Memory safety violations
• Cryptographic security
• SQL injection (even with ORMs)
• Command injection
• FFI security
• Deserialization (Serde)

Interactive Tree Views (8 Views)

• Issues View: Browse issues organized by severity with one-click navigation
• CVE Database: Search and scan for known vulnerabilities with auto-refresh
• Recommendations: AI-powered improvement suggestions
• Code Metrics: Quality and security risk scores
• Refactoring: AI-powered code improvements with diff preview
• Dependencies (SCA): Vulnerable dependency visualization
• Container & IaC Security: Infrastructure security issues by type or severity
• Plugins & Custom Rules: Manage and configure your custom rules

Performance Features

• Intelligent Caching: Reduce API calls with configurable caching (TTL and size limits)
• Request Queue: Priority-based request management for optimal performance
• Circuit Breaker: Automatic failure detection and recovery
• Retry Logic: Exponential backoff for transient failures
• Worker Pool: Parallel analysis for large projects
• Streaming Analysis: Progressive results for large files

Offline / Local Tier-1 Analysis

• Shared versioned packs: secrets, Semgrep-lite patterns, JS/TS AST (same IDs as cloud Stage-1)
• jokalala.analysisTier: local | hybrid | cloud (default hybrid)
• jokalala.localPackProfile: precision (default, low noise) or full (+ Semgrep-lite patterns)
• On-save / quick: local Tier-1 only — $0 infra; zero-noise suppressions for safe sinks
• Bundled runtime: single dist/extension.js (esbuild) for lower IDE host overhead
• See docs/analyzer/LOCAL-TIER1.md for architecture

Security Features

• Secure API Key Storage: Uses VS Code's SecretStorage API for secure credential management
• Input Sanitization: XSS prevention with HTML escaping
• PII Anonymization: File paths, emails, and tokens redacted from telemetry
• HTTPS Validation: Warns when using insecure HTTP endpoints

Installation

From VS Code Marketplace

Search for "Jokalala Code Analyzer" in VS Code Extensions.

From VSIX

1. Download the latest .vsix file from releases
2. Open VS Code
3. Go to Extensions view (Ctrl+Shift+X / Cmd+Shift+X)
4. Click the ... menu → "Install from VSIX..."
5. Select the downloaded .vsix file

From Source

# Clone the repository
git clone https://github.com/jkalala/jokalala-code-analyzer-vscode.git
cd jokalala-code-analyzer-vscode

# Install dependencies
npm install

# Compile the extension
npm run compile

# Package the extension
npm run package

# Install the generated .vsix file
code --install-extension jokalala-code-analysis-*.vsix

Configuration

Getting Your API Key

For Individual Developers:

1. Sign up at jokalala.com/signup
2. Navigate to Dashboard → API Keys
3. Click Generate New API Key
4. Copy your key

For Teams:

Contact sales@jokalala.com for team licenses and custom deployments.

For Self-Hosted:

Deploy your own backend and generate keys from your admin dashboard.

Configuration Methods

Method 1: Quick Setup (Recommended)

1. Open Command Palette (Ctrl+Shift+P / Cmd+Shift+P)
2. Run: Jokalala: Show Settings
3. Enter your API endpoint: https://api.jokalala.com/analyze
4. Enter your API key (will be stored securely)

Method 2: VS Code Settings UI

1. Open Settings (Ctrl+, / Cmd+,)
2. Search for "jokalala"
3. Configure:
   • API Endpoint: https://www.jokalala.com/api/agents/dev-assistant
   • Analysis Mode: full, deep, or quick
   • Analysis Tier: hybrid, local, or cloud
   • Local Pack Profile: precision or full
   • Auto Analyze: on-save uses local Tier-1 only

Method 3: settings.json (Advanced)

{
  "jokalala.apiEndpoint": "https://www.jokalala.com/api/agents/dev-assistant",
  "jokalala.analysisMode": "full",
  "jokalala.analysisTier": "hybrid",
  "jokalala.localPackProfile": "precision",
  "jokalala.autoAnalyze": true,
  "jokalala.showInlineWarnings": true,
  "jokalala.enableDiagnostics": true,
  "jokalala.maxFileSize": 200000,
  "jokalala.maxProjectFiles": 10000,
  "jokalala.requestTimeout": 60000,
  "jokalala.enableTelemetry": false,
  "jokalala.plugins.enabled": false,
  "jokalala.plugins.trustedPublishers": ["jokalala", "official"],
  "jokalala.ideBridge.deltaSync": false,
  "jokalala.ideBridge.localVerifyVisible": true
}

Security Note: Use the Jokalala: Set API Key command for secure credential storage via VS Code's encrypted SecretStorage.

Usage

Commands

Access commands via Command Palette (Ctrl+Shift+P / Cmd+Shift+P):

Code Analysis:

• Jokalala: Analyze Current File - Analyze the currently open file
• Jokalala: Analyze Selection - Analyze the selected code
• Jokalala: Analyze Entire Project - Analyze the entire workspace
• Jokalala: Clear Analysis Cache - Clear the analysis cache

CVE Database:

• Jokalala: Search CVE/CWE Database - Search known vulnerabilities
• Jokalala: Scan Current File for CVEs - Find CVEs in current file
• Jokalala: Clear CVE Results - Clear CVE scan results

Refactoring:

• Jokalala: Analyze for Refactoring - Get AI refactoring suggestions
• Jokalala: Quick Fix Issue - Apply quick fixes
• Jokalala: Apply All Safe Fixes - Batch apply fixes
• Jokalala: Clear Refactoring Results - Clear refactoring data

Dependencies (SCA):

• Jokalala: Scan Dependencies (SCA) - Scan project dependencies
• Jokalala: Generate SBOM - Generate Software Bill of Materials
• Jokalala: Check License Compliance - Check dependency licenses
• Jokalala: Clear SCA Results - Clear SCA data

Container & IaC Security:

• Jokalala: Scan Container/IaC Files - Scan all infrastructure files
• Jokalala: Scan Dockerfiles - Scan only Dockerfile configurations
• Jokalala: Scan Kubernetes Manifests - Scan Kubernetes YAML files
• Jokalala: Scan Terraform Files - Scan Terraform configurations
• Jokalala: Scan Current Container/IaC File - Scan currently open file
• Jokalala: Clear Container/IaC Results - Clear infrastructure scan data

Plugins & Custom Rules:

• Jokalala: Create New Plugin - Create a custom plugin
• Jokalala: Import Custom Rules - Import rules from file
• Jokalala: Export Custom Rules - Export rules to file
• Jokalala: Reload Plugins - Reload all plugins
• Jokalala: Open Plugins Folder - Open plugins directory

Dev Chat Integration:

• Jokalala: Open Dev Chat - Focus the "Dev Chat" sidebar chat panel (Ctrl/Cmd+Shift+J)
• Jokalala: Ask Dev Chat About Finding - Seed Dev Chat with the current/selected analyzer finding
• Jokalala: Quick Edit Selection - Rewrite the selection via LLM (Ctrl/Cmd+Shift+K) then Accept in the editor
• Jokalala: Attach File to Dev Chat - Queue workspace files as @file attachments for the next turn
• Jokalala: Apply Dev Chat Patch - Fetch and apply a proposed patch (normally triggered by clicking Accept in Dev Chat, not run manually)
• Jokalala: Undo Last Applied Patch - Revert the most recently applied patch (also offered as an "Undo" button on the success message)
• Jokalala: Hydrate File into Dev Chat - Push the current file into your Dev Chat cloud snapshot

Settings:

• Jokalala: Open Settings - Open extension settings
• Jokalala: Set API Key - Securely store API key

Keyboard Shortcuts

• Ctrl+Alt+A / Cmd+Alt+A - Analyze current file
• Ctrl+Alt+S / Cmd+Alt+S - Analyze selection

Tree Views

The extension adds eight tree views to the sidebar:

1. Issues - Detected security issues organized by severity
2. CVE Database - Search and browse known vulnerabilities
3. Recommendations - AI-powered code improvement suggestions
4. Code Metrics - Quality and security risk metrics
5. Refactoring - AI-powered refactoring opportunities with one-click fixes
6. Dependencies (SCA) - Vulnerable dependencies with severity indicators
7. Container & IaC Security - Infrastructure security issues organized by type or severity
8. Plugins & Custom Rules - Manage custom rules and plugins

Code Actions

When issues are detected, the extension provides quick fixes:

• Apply Suggestion - Apply the recommended fix
• Preview Diff - Preview changes before applying
• Mark as False Positive - Report incorrect detections
• Mark as Helpful - Provide positive feedback

Infrastructure Security

Dockerfile Security (CIS Docker Benchmark)

• Insecure base image detection (latest tag)
• Root user warnings
• Exposed secrets in ENV/ARG
• Missing HEALTHCHECK
• Unnecessary ADD usage
• Shell form CMD detection

Kubernetes Security (CIS Benchmark + NSA/CISA Guide)

• Privileged container detection
• Missing security contexts
• Host namespace sharing
• Dangerous capabilities
• Missing resource limits
• Default service accounts

Terraform Security

• Open security groups (0.0.0.0/0)
• Public S3 buckets
• Disabled encryption
• Hardcoded secrets
• Missing logging

CloudFormation Security

• Misconfigured IAM policies
• Public resources
• Missing encryption settings
• Security group misconfigurations

Creating Custom Rules

Plugin Structure

my-plugin/
├── jokalala-plugin.json   # Plugin manifest
├── rules/
│   ├── custom-rule-1.json
│   └── custom-rule-2.json
└── src/
    └── index.ts           # Optional programmatic rules

Example Rule Definition

{
  "id": "custom-sql-injection",
  "name": "Custom SQL Injection Detection",
  "description": "Detects SQL injection in custom ORM",
  "severity": "critical",
  "category": "security",
  "cwe": ["CWE-89"],
  "owasp": ["A03:2021"],
  "languages": ["typescript", "javascript"],
  "patterns": [
    {
      "type": "regex",
      "pattern": "customQuery\\s*\\([^)]*\\$\\{",
      "message": "Potential SQL injection via string interpolation"
    }
  ],
  "suggestion": "Use parameterized queries instead of string interpolation"
}

Development

Prerequisites

• Node.js 16.x or higher
• npm 7.x or higher
• VS Code 1.85.0 or higher

Setup

# Install dependencies
npm install

# Compile TypeScript
npm run compile

# Watch mode for development
npm run watch

# Run tests
npm test

# Package extension
npm run package

Architecture

Core Services

• CodeAnalysisService - API communication and request management
• ContainerIaCService - Infrastructure security scanning
• RefactoringService - AI-powered code improvements
• PluginManager - Plugin lifecycle and custom rules
• OfflineAnalyzer - Local analysis engine with 100+ rules
• ConfigurationService - Settings management with validation
• Logger - Centralized logging with PII anonymization
• SecurityService - Secure credential storage and input sanitization

Tree Providers

• IssueTreeProvider - Security issues view
• CVETreeProvider - CVE database view
• RefactoringTreeProvider - Refactoring suggestions view
• SCATreeProvider - Dependencies view
• ContainerIaCTreeProvider - Infrastructure security view
• PluginsTreeProvider - Plugins and custom rules view

Project Structure

src/
├── commands/           # Command implementations
├── core/               # Core analysis engines
│   ├── custom-rules.ts
│   ├── offline-analyzer.ts
│   ├── incremental-analyzer.ts
│   ├── streaming-analyzer.ts
│   └── worker-pool.ts
├── interfaces/         # TypeScript interfaces
├── providers/          # Tree view and code action providers
│   ├── issue-tree-provider.ts
│   ├── cve-tree-provider.ts
│   ├── refactoring-tree-provider.ts
│   ├── sca-tree-provider.ts
│   ├── container-iac-tree-provider.ts
│   └── plugins-tree-provider.ts
├── services/           # Core business logic
│   ├── code-analysis-service.ts
│   ├── container-iac-service.ts
│   ├── plugin-manager.ts
│   └── refactoring-service.ts
├── test/               # Test suites
├── utils/              # Utility functions
│   ├── circuit-breaker.ts
│   ├── confidence-calculator.ts
│   ├── false-positive-detector.ts
│   └── quality-gate.ts
└── extension.ts        # Extension entry point

Troubleshooting

Common Issues

Extension Not Activating

Problem: Extension doesn't activate when opening code files

Solution:

1. Check that you're working with supported languages (see language support section)
2. Reload VS Code window (Developer: Reload Window)
3. Check Output panel (View → Output → Jokalala Code Analysis) for errors

API Connection Errors

Problem: "Failed to connect to API endpoint" error

Solution:

1. Verify API endpoint is correct in settings
   • Production (default): https://www.jokalala.com/api/agents/dev-assistant
   • Local: http://localhost:3000/api/agents/dev-assistant
2. Check that API endpoint uses HTTPS in production (HTTP will show a warning)
3. Set your API key with Jokalala: Set API Key (SecretStorage — not the deprecated settings field)
4. Check network connectivity and firewall settings
5. Review circuit breaker status in logs
6. SCA / feedback require the same Bearer key; feedback posts to {site}/api/analysis-feedback

Set "jokalala.logLevel": "debug" for verbose Output channel logs.

No Issues Detected

Problem: Analysis completes but no issues are shown

Solution:

1. Check that the file size is within limits (default: 200KB)
2. For local-only findings set jokalala.analysisTier to local or use Quick mode
3. For cloud Stage-1 use hybrid/full and verify jokalala.apiEndpoint (HTTPS)
4. Check the Output panel for API / Tier-1 details
5. Clear cache and re-analyze (Jokalala: Clear Cache)

Local findings but no cloud issues

Hybrid merges local Tier-1 with cloud. If the API is down, you still get local pack findings. Set tier to cloud only when you intentionally skip local packs.

Debug Mode

Enable debug logging to troubleshoot issues:

{
  "jokalala.logLevel": "debug"
}

Then check the Output panel: View → Output → Jokalala Code Analysis

Privacy & Security

What Data is Sent to the Cloud?

Transparency matters. Here's exactly what happens when you analyze code:

Privacy-First Design:

• Quick Mode / local tier: deterministic packs run locally – no code sent to cloud
• No code storage: Your code is analyzed and immediately discarded
• Anonymization: File paths, emails, and tokens are redacted from all logs
• Opt-out telemetry: Disable with "jokalala.enableTelemetry": false

Enterprise & Compliance

For organizations with strict security requirements:

• Self-hosted option: Deploy your own backend (Enterprise tier)
• Air-gapped environments: Offline mode with 100+ bundled rules
• SOC 2 / GDPR: Contact sales@jokalala.com for compliance documentation
• On-premise: Full control over data residency

Secure Storage

• API keys are stored using VS Code's SecretStorage API
• Credentials are encrypted at rest
• No sensitive data is logged or transmitted in telemetry

Network Security

• All API communication uses HTTPS (TLS 1.3)
• HTTP endpoints trigger security warnings
• Request/response validation prevents injection attacks

Contributing

We welcome contributions! Please see CONTRIBUTING.md for guidelines.

Development Workflow

1. Fork the repository
2. Create a feature branch (git checkout -b feature/amazing-feature)
3. Make your changes
4. Run tests (npm test)
5. Run linter (npm run lint)
6. Commit your changes (git commit -m 'Add amazing feature')
7. Push to the branch (git push origin feature/amazing-feature)
8. Open a Pull Request

Code Quality Standards

• TypeScript strict mode enabled
• 90%+ test coverage required
• ESLint and Prettier for code formatting
• Comprehensive JSDoc comments for public APIs

License

This project is licensed under the MIT License - see the LICENSE file for details.

Comparison with Alternatives

When to Choose Jokalala

Best for:

• Full-stack teams needing security + IaC + SCA in one tool
• Blockchain developers (Solidity smart contract auditing)
• Teams wanting AI-powered refactoring suggestions
• DevSecOps requiring comprehensive container/K8s scanning

Consider alternatives if:

• You need 100% offline-only operation (use Quick mode or self-host)
• You're in a highly regulated air-gapped environment (Enterprise self-hosted recommended)
• You only need simple linting (try ESLint/Prettier instead)

Integration Recommendations

For Individual Developers:

1. Start with the free tier (5 analyses/day, no account needed)
2. Use Quick mode for instant local feedback
3. Use Full mode for comprehensive security reviews before commits

For Teams/Enterprises:

1. Request a demo at jokalala.com/enterprise
2. Evaluate self-hosting for security compliance
3. Integrate with CI/CD for automated scanning
4. Use SBOM generation for supply chain security

CI/CD Integration:

# GitHub Actions example
- name: Jokalala Security Scan
  uses: jokalala/code-analysis-action@v1
  with:
    api-key: ${{ secrets.JOKALALA_API_KEY }}
    fail-on: critical

Support

• Documentation: https://docs.jokalala.com
• Issues: GitHub Issues
• Discussions: GitHub Discussions
• Email: support@jokalala.com
• Discord: Join our community

Changelog

See CHANGELOG.md for a list of changes in each version.

Acknowledgments

• Built with VS Code Extension API
• Powered by Jokalala AI Code Analysis Platform
• Security patterns based on OWASP, CWE, SWC Registry, CIS Benchmarks
• Icons from VS Code Codicons

Made with care by the Jokalala Team