Scanverra for VS Code

Scan the open workspace for hardcoded secrets, SAST vulnerabilities, dependency CVEs, AI agent risks, IaC misconfigurations and code quality issues without leaving the editor. Findings show up two ways: as diagnostics (squiggles + Problems panel) exactly where they are, and in a dedicated Scanverra sidebar (shield icon in the Activity Bar) with the score, quality gate, severity breakdown, per-file findings and dependency vulnerabilities. Click any finding to jump straight to it.

This extension runs the same engine as @scanverra/cli: it downloads the signed rules bundle from Scanverra, verifies it, and scans your files locally. Your source code stays on your machine. Only the CLI's scan --no-upload behavior applies here; this extension never uploads a report.

AI security checks

Your AI coding agents read files from the repo and act on them with your permissions, so the scan covers them too:

• Poisoned agent instructions: hidden Unicode (decoded so you can read it), prompt injection phrasing, and instructions to send secrets off the machine in .cursorrules, .cursor/rules/*.mdc, CLAUDE.md, AGENTS.md, .github/copilot-instructions.md and other agent files.
• Risky agent and MCP setup: auto-approve / YOLO settings, Claude Code hooks and API redirects, unpinned or vulnerable MCP servers (for example mcp-remote before 0.1.16), and hardcoded tokens in MCP configs.
• LLM code: model output passed to eval or a shell, agent tools that run commands, AI keys exposed to the browser, and user input inside system prompts.
• Governance: an inventory of the AI providers, models and MCP servers in the repo, checked against .scanverra/ai-policy.json if you add one.

Findings are mapped to the OWASP Top 10 for LLM Applications and for Agentic Applications.

Requirements

• A Scanverra API key (the Free plan includes one). Create it in your Scanverra dashboard under API keys.

Logging in

Open the Scanverra view in the Activity Bar. If you are not logged in, the view shows a login card: paste your API key and click Save API key. The key is checked against Scanverra before it is saved. You can also run Scanverra: Log In with API Key from the Command Palette.

If you already use the Scanverra CLI (npx @scanverra/cli login), the extension picks up the same login automatically, and logging in from VS Code logs the CLI in too.

To log out, click Log out in the Scanverra view's toolbar, or run Scanverra: Log Out. This removes the saved key for both the extension and the CLI on this machine.

Usage

1. Open a folder in VS Code.
2. Open the Scanverra view in the Activity Bar (shield icon) and click Scan Workspace. You can also run Scanverra: Scan Workspace from the Command Palette, or click the shield icon in the status bar.
3. Findings appear in the editor gutter and the Problems panel, and are grouped by file and severity in the sidebar. The status bar and sidebar both show the resulting score. Click any finding in the sidebar to jump to it.
4. Run Scanverra: Clear Scan Results (or the sidebar's Clear button) to dismiss them.

The sidebar remembers the last scan's results per workspace, so reopening the view (even after a VS Code restart) shows them again without re-scanning.

Known limitations

• Scans are manual only, there is no scan-on-save yet.
• Findings are whole-line diagnostics (no column-level ranges).

Development

cd packages/vscode-extension
npm install
npm run build       # bundles src/extension.ts -> dist/extension.js
npm run typecheck

To try it locally, open this folder in VS Code and press F5 (Run Extension) to launch an Extension Development Host.