SoterAI IDE Guard

Local-first AI security guard for VS Code. SoterAI IDE Guard scans code, selections, terminal commands, git changes, and AI prompts for secrets, PII, prompt injection, and insecure AI-generated code - entirely on your machine. Nothing leaves your computer unless you explicitly connect to SoterAI Cloud.

Website · Docs · Support · Report an issue · Source

The same links are in the Control Panel footer inside the editor.

Start in under a minute

1. Run SoterAI: Run Safe Demo Scan to see a real verdict using safe built-in test data.
2. Run SoterAI: Protect Workspace Secrets to review sensitive files and replace approved values with safe placeholders on disk.
3. Run SoterAI: Secure Installed AI Tools (One Click) to review supported AI client routing changes. Every approved change has an encrypted backup and can be undone with SoterAI: Undo AI Tool Security Changes.

Local scanning is already on after installation. No account, API key, or cloud connection is required for these first steps.

In VS Code

Real captures from the VS Code extension-host verification flow. They use test data only.

Secret finding with a safe copy

Scan selected text before it reaches AI

Local request protection enabled

Features

• Control Panel - one sidebar view with instant-apply toggles for Safe Mode, Protected Workspace, Live Scan, Sentinel, and the MCP firewall, plus Emergency Lockdown. Every control states in plain language what it does, and each coverage badge is resolved from the capability registry — a protection is only labelled ENFORCED when it is actually broker-gated, otherwise MONITORED.
• Secure My AI (one click) - finds the AI tools already installed (Cline, Claude Code, Copilot, Continue, Aider, and generic .env / shell profiles) and routes them through the local broker so prompts are scanned before they leave. Every rewritten file is backed up first, encrypted, outside your workspace — and SoterAI: Undo AI Tool Security Changes puts every original back in one click.
• Scan Current File / Selection / Workspace - detect leaked secrets, PII, prompt injection, unsafe instructions, and risky patterns with a redacted report.
• Live inline scanning + Quick Fixes - supported files are scanned as you type; findings appear as native diagnostics with lightbulb fixes (redact in place, copy a safe version of the line, move secrets to the vault).
• Redact Selection for AI - copy a safe version of selected text before using it in an AI assistant. Raw secrets are not copied.
• Scan Before AI Prompt - paste a prompt, scan it locally, and get an allow / redact / block verdict plus a safe prompt to copy.
• AI Egress Firewall - one local choke point for anything you are about to send to an AI tool: ALLOW / REDACT / ASK / BLOCK, with a redacted copy offered when secrets are present. Re-runs the detectors over de-obfuscated variants (zero-width unicode, homoglyphs, leetspeak, letter-spacing, reversal, base64), so smuggled injection that slips past a single-pass regex still scores. Also destination-aware: content heading to a non-allowlisted host escalates, and secret-bearing content heading to a vector database is blocked outright because an embedded leak is durable, not transient.
• Git pre-commit secret hook - installs a hook that blocks a commit containing secrets. Refuses to install (with an explanation) when core.hooksPath is set by husky/lefthook rather than writing to a directory git ignores, and backs up any existing hook.
• Screen-share risk check - warns when files that would expose secrets on a shared screen are open, matching on basename and on credential directories (.ssh, .aws, .gnupg, .kube, .docker) and key material.
• Scan Git Changes - scan staged and unstaged diffs for secrets and sensitive files before commit.
• Check Terminal Command - flag destructive, remote-exec, credential-exposing, or suspicious shell commands before you run them.
• Review Selected AI Code - surface likely vulnerabilities in AI-generated code inside a hardened webview.
• Local AI Broker - authenticated loopback-only OpenAI/Anthropic-compatible routing with request/response scanning, redaction, canary blocking, and SSE streaming (stream: true) with scan-before-forward output protection.
• Secret Broker - replaces raw secrets with scoped soterai://secret/... references so AI sees structure and approved operations, not values.
• AI Safe Mode - Developer, Strict, and Enterprise protection overlays for SoterAI-routed workflows.
• AI Memory Inspector - hashes, decisions, redacted evidence, and file metadata showing what SoterAI brokered or built for AI.
• Security Dashboard - risk score, latest findings, privacy mode, policy status, and local secret privacy proof.

Privacy & Security

• Local-first by default. Detection, redaction, policy checks, and secret reference creation run locally in the extension host.
• No raw secrets leave the extension by default. Reports, webviews, telemetry, logs, clipboard output, hash caches, broker records, and exported views are designed to avoid raw secret material.
• Secret broker privacy proof. SoterAI: Local Privacy Status, SoterAI: Preview What AI Will See, and SoterAI: What Stays Local? explain what stays local without displaying raw secrets.
• Redacted, opt-in telemetry only. Telemetry is off by default. When enabled, it uses minimized event metadata, not raw content or tokens.
• Cloud tokens stay in VS Code SecretStorage. Provider and cloud credentials are stored locally through VS Code's secret APIs and are never logged.
• Config backups are encrypted and kept out of your workspace. When "Secure My AI" rewrites a config, the pre-rewrite copy is encrypted (AES-GCM, key in VS Code SecretStorage) and stored in the extension's global storage — never as a plaintext sibling file that .gitignore would miss. If the backup cannot be written, the rewrite does not happen.
• A repository cannot turn its own protection off. The 23 safety-relevant settings are machine-scoped and declared as restricted in untrusted workspaces, so a checked-in .vscode/settings.json cannot disable a guard or repoint the broker at another endpoint.

What Leaves Your Machine?

Use SoterAI: Local Privacy Status anytime to show a user-safe report that contains no API keys, prompts, secrets, raw files, private keys, database URLs, or PII.

Workspace Trust

The extension declares limited untrusted-workspace support:

Local scanning always works. Cloud, token, and remote features are gated behind a trusted workspace and surfaced clearly in the dashboard.

Commands

The palette lists 10 core commands by default. The full surface (162 commands) is available by enabling soterai.showAllCommands.

Settings

Settings that can disable a protection or change where your data goes are machine-scoped: they are read from your user/machine settings only, and a value set in a repository's .vscode/settings.json is ignored. Scan budgets (maxFileSizeKb, maxWorkspaceFiles, excludeGlobs) and palette visibility stay workspace-configurable, because none of them can weaken a guard.

Supported Files

SoterAI focuses on developer text formats: JavaScript, TypeScript, Python, Markdown, MDX, text, JSON, YAML, .env-style files, MCP configuration, and agent prompt/config files. Binary files and oversized files are skipped.

API Key Setup

Cloud and broker provider tokens are stored with VS Code SecretStorage. Use SoterAI: Connect to SoterAI Cloud or the broker configuration commands only in trusted workspaces. Local privacy mode does not require an API key and does not make network calls.

Troubleshooting

• If commands do not appear, run SoterAI: Quick Start from the Command Palette.
• If a file is skipped, check soterai.scan.maxFileSizeKb and exclude globs.
• If cloud setup is disabled, verify VS Code Workspace Trust is enabled.
• If the VSIX was installed manually, reload VS Code after installation.

Known Limitations

• Detection is defense-in-depth, not a guarantee that every issue will be found. Detectors are regex/heuristic in the packaged extension — no ONNX/ML model ships in the VSIX.

• Live scan is VISIBILITY_ONLY: squiggly diagnostics after content exists; it does not block send-to-AI or other extensions.

• Terminal review is DETECTION_ONLY unless you use the broker controlled terminal allowlist route (STRONG_ENFORCEMENT for fixed-argv read-only commands only).

• MCP and extension risk analysis is config/metadata heuristic (DETECTION_ONLY). The MCP gateway engine exists in guard-core but is not wired into the packaged extension (UNKNOWN_NOT_TESTED until routed).

• DepGuard is DETECTION_ONLY: local heuristics always; optional online OSV advisory lookup (soterai.dependencyGuard.osvMode) with explicit consent. Not a full SCA product; cannot block installs outside SoterAI-reviewed commands.

• Broker streaming is STRONG_ENFORCEMENT only for traffic routed through the loopback broker. Partial tokens already flushed before a late block cannot be recalled (honest residual risk).

• Full cloud telemetry submission is disabled until a reviewed endpoint client is added.

• SoterAI Guard is not a replacement for professional security review, secure SDLC, or incident response.

• Universal claims (full terminal/MCP/network enforcement for arbitrary agents) are UNSUPPORTED without an OS-level broker/sandbox.

Development

npm run typecheck   # tsc --noEmit
npm run lint        # eslint
npm run test        # node --test static manifest/contract tests
npm run bundle      # extension + standalone local broker bundles
npm run package     # bundle + vsce package -> .vsix

The extension is bundled with esbuild into a single dist/extension.js (with @soterai/guard-core inlined) so the packaged VSIX stays small and never follows the symlinked monorepo.

License

See LICENSE (Business Source License 1.1). Copyright SoterAI.