SoterAI IDE Guard

Safer AI Coding

Local by Default

Protect secrets, prompts, agent tools, terminal commands, and AI coding context before they become security incidents.

Scan locally · Redact sensitive context · Guard supported AI traffic

SoterAI IDE Guard adds a security layer to the editor you already use. Catch secrets and personal data, inspect prompts and AI-generated code, review risky commands and agent configurations, and route supported AI traffic through an enforceable local broker—all without creating an account.

Install from inside your editor

Open Extensions with Ctrl+Shift+X (Cmd+Shift+X on macOS), search for SoterAI IDE Guard, and select Install. In VS Code, you can also open Quick Open with Ctrl+P / Cmd+P and paste:

ext install soterai.soterai-ide-guard

Install the authentic extension

Name: SoterAI IDE Guard — Local AI Security · Publisher: soterai · Extension ID: soterai.soterai-ide-guard

For offline installation, download the .vsix from Open VSX, then choose Extensions → Install from VSIX…. After installation, select the SoterAI Guard shield in the Activity Bar.

Cannot find it in editor search? Use the direct Marketplace, Open VSX, or guided installer. Registry search results can take time to refresh after a release.

Start protecting your workspace in 60 seconds

Open SoterAI Guard → Control Panel after installation:

1. Run SoterAI: Run Safe Demo Scan to see a real local verdict using built-in test data—without exposing your code.
2. Run SoterAI: Protect Workspace Secrets to preview sensitive files and replace only approved values with safe local placeholders.
3. Run SoterAI: Secure Installed AI Tools (One Click) to review supported AI client routing changes. Every approved rewrite gets an encrypted backup outside your workspace and can be reversed with SoterAI: Undo AI Tool Security Changes.

Local scanning is already enabled when you install. These first steps need no account, cloud connection, or provider API key.

Your AI security posture, in one view

See active controls, request checking, editor warnings, known gaps, and the current data boundary without leaving your editor.

Know your protection at a glance

The Control Panel always shows the current data boundary, active controls, known gaps, and one recommended next action. Green protection labels are reserved for paths SoterAI technically controls.

See it inside VS Code

Real extension-host captures using test data only.

Find a secret without exposing it in the result

Check selected context before sharing it with AI

Turn on local request protection

Features

• Control Panel - one sidebar view with instant-apply toggles for Safe Mode, Protected Workspace, Live Scan, Sentinel, and the MCP firewall, plus Emergency Lockdown. A live Data boundary receipt says whether data stays local, cloud actions are available, or optional redacted metadata is enabled. Every coverage badge is resolved from the capability registry — a protection is only labelled ENFORCED when it is actually broker-gated, otherwise MONITORED.
• Secure My AI (one click) - finds the AI tools already installed (Cline, Claude Code, Copilot, Continue, Aider, and generic .env / shell profiles) and routes them through the local broker so prompts are scanned before they leave. Every rewritten file is backed up first, encrypted, outside your workspace — and SoterAI: Undo AI Tool Security Changes puts every original back in one click.
• Scan Current File / Selection / Workspace - detect leaked secrets, PII, prompt injection, unsafe instructions, and risky patterns with a redacted report.
• Live inline scanning + Quick Fixes - supported files are scanned as you type; findings appear as native diagnostics with lightbulb fixes (redact in place, copy a safe version of the line, move secrets to the vault).
• Redact Selection for AI - copy a safe version of selected text before using it in an AI assistant. Raw secrets are not copied.
• Scan Before AI Prompt - paste a prompt, scan it locally, and get an allow / redact / block verdict plus a safe prompt to copy.
• AI Egress Firewall - one local choke point for anything you are about to send to an AI tool: ALLOW / REDACT / ASK / BLOCK, with a redacted copy offered when secrets are present. Re-runs the detectors over de-obfuscated variants (zero-width unicode, homoglyphs, leetspeak, letter-spacing, reversal, base64), so smuggled injection that slips past a single-pass regex still scores. Also destination-aware: content heading to a non-allowlisted host escalates, and secret-bearing content heading to a vector database is blocked outright because an embedded leak is durable, not transient.
• Git pre-commit secret hook - installs a hook that blocks a commit containing secrets. Refuses to install (with an explanation) when core.hooksPath is set by husky/lefthook rather than writing to a directory git ignores, and backs up any existing hook.
• Screen-share risk check - warns when files that would expose secrets on a shared screen are open, matching on basename and on credential directories (.ssh, .aws, .gnupg, .kube, .docker) and key material.
• Scan Git Changes - scan staged and unstaged diffs for secrets and sensitive files before commit.
• Check Terminal Command - flag destructive, remote-exec, credential-exposing, or suspicious shell commands before you run them.
• Review Selected AI Code - surface likely vulnerabilities in AI-generated code inside a hardened webview.
• Local AI Broker - authenticated loopback-only OpenAI/Anthropic-compatible routing with request/response scanning, redaction, canary blocking, and SSE streaming (stream: true) with scan-before-forward output protection.
• Bounded local protocols - broker JSON responses and MCP stdio frames are capped at 1 MiB. Oversized MCP frames are discarded through their newline so later valid checks remain synchronized.
• Secret Broker - replaces raw secrets with scoped soterai://secret/... references so AI sees structure and approved operations, not values.
• AI Safe Mode - Developer, Strict, and Enterprise protection overlays for SoterAI-routed workflows.
• AI Memory Inspector - hashes, decisions, redacted evidence, and file metadata showing what SoterAI brokered or built for AI.
• Security Dashboard - risk score, latest findings, privacy mode, policy status, and local secret privacy proof.

Privacy & Security

• Local-first by default. Detection, redaction, policy checks, and secret reference creation run locally in the extension host.
• No raw secrets leave the extension by default. Reports, webviews, telemetry, logs, clipboard output, hash caches, broker records, and exported views are designed to avoid raw secret material.
• Secret broker privacy proof. SoterAI: Local Privacy Status, SoterAI: Preview What AI Will See, and SoterAI: What Stays Local? explain what stays local without displaying raw secrets.
• Redacted, opt-in telemetry only. Telemetry is off by default. When enabled, it uses minimized event metadata, not raw content or tokens.
• Opt-out purges pending metadata. Turning SoterAI telemetry off, returning to local privacy mode, disabling cloud, or disabling editor telemetry immediately clears SoterAI's in-memory telemetry queue.
• Cloud tokens stay in VS Code SecretStorage. Provider and cloud credentials are stored locally through VS Code's secret APIs and are never logged.
• Config backups are encrypted and kept out of your workspace. When "Secure My AI" rewrites a config, the pre-rewrite copy is encrypted (AES-GCM, key in VS Code SecretStorage) and stored in the extension's global storage — never as a plaintext sibling file that .gitignore would miss. If the backup cannot be written, the rewrite does not happen.
• A repository cannot turn its own protection off. The 25 safety-relevant settings are machine-scoped and declared as restricted in untrusted workspaces, so a checked-in .vscode/settings.json cannot disable a guard or repoint the broker at another endpoint.
• The packaged artifact is inspected, not assumed safe. Release CI rejects unexpected source, tests, maps, logs, .env files, dependencies, duplicate/unsafe archive paths, missing runtime bundles, and oversized archives. It records a SHA-256 and exact entry inventory, then generates a deterministic CycloneDX 1.6 SBOM with a SHA-256 component for every file that actually ships. Integrity evidence and the SBOM are not claimed to be a cryptographic signature.
• Broker ingress fails closed. Request bodies are capped, declared oversize is rejected before reading, compressed and ambiguous framing is refused, and malformed UTF-8 is never replacement-decoded into apparently valid JSON.

What Leaves Your Machine?

Use SoterAI: Local Privacy Status anytime to show a user-safe report that contains no API keys, prompts, secrets, raw files, private keys, database URLs, or PII.

Workspace Trust

The extension declares limited untrusted-workspace support:

Local scanning always works. Cloud, token, and remote features are gated behind a trusted workspace and surfaced clearly in the dashboard.

Commands

The palette shows the core workflows by default. Older command names still work — they stay registered for keybindings, tasks and other extensions — but they no longer occupy a second palette row next to the command they forward to, and the individual report commands are now listed inside SoterAI: Open Report. Enable soterai.showAllCommands to see the full advanced surface.

Where SoterAI appears while you work

You do not have to remember to open the Command Palette. The checks are on the surfaces where the risk actually happens:

Both keybindings only apply while an editor has focus, so they never shadow a shortcut you use elsewhere in VS Code.

Your AI agent can ask SoterAI before it acts

SoterAI contributes three tools an AI agent can call, so the check happens inside the agent's own loop instead of in a sidebar the agent cannot see:

In VS Code chat and Copilot agent mode they appear as tools automatically. Other MCP clients get the same three from a bundled MCP server, which VS Code offers to agent mode without you editing any config.

These tools are advisory. They answer questions an agent chooses to ask. SoterAI cannot force an agent to ask, and no extension API lets it intercept what an agent does on its own — so every result states that limit in full rather than implying the action was blocked.

They need a recent editor. SoterAI keeps its VS Code ^1.85.0 floor so Cursor, Windsurf, Kiro and Antigravity stay supported, and on a host without the language model tool API it registers nothing instead of pretending. SoterAI: Show Runtime Capability Summary reports which surfaces are live on the editor you are actually using.

Settings

Settings that can disable a protection or change where your data goes are machine-scoped: they are read from your user/machine settings only, and a value set in a repository's .vscode/settings.json is ignored. Scan budgets (maxFileSizeKb, maxWorkspaceFiles, excludeGlobs) and palette visibility stay workspace-configurable, because none of them can weaken a guard.

Supported Files

SoterAI focuses on developer text formats: JavaScript, TypeScript, Python, Markdown, MDX, text, JSON, YAML, .env-style files, MCP configuration, and agent prompt/config files. Binary files and oversized files are skipped.

API Key Setup

Cloud and broker provider tokens are stored with VS Code SecretStorage. Use SoterAI: Connect to SoterAI Cloud or the broker configuration commands only in trusted workspaces. Local privacy mode does not require an API key and does not make network calls.

Troubleshooting

• If commands do not appear, run SoterAI: Quick Start from the Command Palette.
• If a file is skipped, check soterai.scan.maxFileSizeKb and exclude globs.
• If cloud setup is disabled, verify VS Code Workspace Trust is enabled.
• If the VSIX was installed manually, reload VS Code after installation.

Known Limitations

• Detection is defense-in-depth, not a guarantee that every issue will be found. Detectors are regex/heuristic in the packaged extension — no ONNX/ML model ships in the VSIX.

• Live scan is VISIBILITY_ONLY: squiggly diagnostics after content exists; it does not block send-to-AI or other extensions.

• Terminal review is DETECTION_ONLY unless you use the broker controlled terminal allowlist route (STRONG_ENFORCEMENT for fixed-argv read-only commands only).

• MCP and extension risk analysis is config/metadata heuristic (DETECTION_ONLY). The MCP gateway engine exists in guard-core but is not wired into the packaged extension (UNKNOWN_NOT_TESTED until routed).

• DepGuard is DETECTION_ONLY: local heuristics always; optional online OSV advisory lookup (soterai.dependencyGuard.osvMode) with explicit consent. Not a full SCA product; cannot block installs outside SoterAI-reviewed commands.

• Broker streaming is STRONG_ENFORCEMENT only for traffic routed through the loopback broker. Partial tokens already flushed before a late block cannot be recalled (honest residual risk).

• Full cloud telemetry submission is disabled until a reviewed endpoint client is added.

• SoterAI Guard is not a replacement for professional security review, secure SDLC, or incident response.

• Universal claims (full terminal/MCP/network enforcement for arbitrary agents) are UNSUPPORTED without an OS-level broker/sandbox.

Development

npm run typecheck   # tsc --noEmit
npm run lint        # eslint
npm run test        # node --test static manifest/contract tests
npm run bundle      # extension + standalone local broker bundles
npm run package     # bundle + vsce package -> .vsix

The extension is bundled with esbuild into a single dist/extension.js (with @soterai/guard-core inlined) so the packaged VSIX stays small and never follows the symlinked monorepo.

License

See LICENSE (Business Source License 1.1). Copyright SoterAI.