Scanverra for VS Code

Scan the open workspace for hardcoded secrets, SAST vulnerabilities, dependency CVEs, IaC misconfigurations and code quality issues without leaving the editor. Findings show up two ways: as diagnostics (squiggles + Problems panel) exactly where they are, and in a dedicated Scanverra sidebar (shield icon in the Activity Bar) with the score, quality gate, severity breakdown, per-file findings and dependency vulnerabilities — click any finding to jump straight to it.

This extension runs the same engine as @scanverra/cli: it downloads the signed rules bundle from Scanverra, verifies it, and scans your files locally. Your source code stays on your machine — only the CLI's scan --no-upload behavior applies here; this extension never uploads a report.

Requirements

• A Scanverra API key on a Pro, Team or Enterprise plan.
• You must already be logged in via the CLI:

  npx @scanverra/cli login
  

  The extension reads the same saved login (~/.config/scanverra/config.json) — there is no separate sign-in inside VS Code yet.

Usage

1. Open a folder in VS Code.
2. Open the Scanverra view in the Activity Bar (shield icon) and click Scan Workspace — or run Scanverra: Scan Workspace from the Command Palette, or click the shield icon in the status bar.
3. Findings appear in the editor gutter and the Problems panel, and are grouped by file/severity in the sidebar; the status bar and sidebar both show the resulting score. Click any finding in the sidebar to jump to it.
4. Run Scanverra: Clear Scan Results (or the sidebar's Clear button) to dismiss them.

The sidebar remembers the last scan's results per workspace, so reopening the view (even after a VS Code restart) shows them again without re-scanning.

Known limitations (MVP)

• Scans are manual only — no scan-on-save yet.
• Findings are whole-line diagnostics (no column-level ranges).

Development

cd packages/vscode-extension
npm install
npm run build       # bundles src/extension.ts -> dist/extension.js
npm run typecheck

To try it locally, open this folder in VS Code and press F5 (Run Extension) to launch an Extension Development Host.