vetkit for VS Code

See your latest vetkit audit findings right in the editor.

vetkit audits your repositories for security, supply-chain, code-quality and AI-application risks. This extension brings the findings of the latest successful audit of a repository into VS Code:

• Diagnostics on the affected files and lines, in the Problems panel and inline.
• A Findings view in the vetkit activity bar, grouped by severity. Click a finding to jump to its location.
• Stale marking: when your local HEAD differs from the audited commit, findings are labelled [stale] so you know the line numbers may have moved.
• Quick fixes on the diagnostics: apply a rule's own fix, or preview an AI fix suggestion as a diff.
• Run Audit: when a repository has no audit yet, start one from VS Code. It runs a free Quick Scan on the vetkit server against the default branch, and the findings load when it finishes.

Findings come from the server-side audit, not from your unsaved buffers. The extension never uploads your code.

Getting started

1. Install the extension.
2. Run vetkit: Sign In from the Command Palette, or click Sign in to vetkit in the vetkit view.
3. Approve the request in your browser. Compare the code shown in VS Code with the one on the page.
4. Your findings appear.

vetkit matches the git remotes of your workspace (read from .git/config, no git binary needed) against the repositories of your organization and selects the right one automatically. If nothing matches, pick a repository from a list, or connect the repository in vetkit. Run vetkit: Select Repository at any time to change it. The selection is remembered per workspace.

If the repository has never been audited, the vetkit view shows Run Audit. It starts a free Quick Scan (posture, secrets and dependency checks on the latest commit of the default branch; the workspace owner gets 10 a month). When this month's Quick Scans are used up, the extension offers a full scan, which costs 1 credit from the workspace owner. While an audit runs, the view says so and the findings appear when it finishes. vetkit: Open in vetkit opens the audit in the vetkit app.

Sign-in creates an API key that can read repositories, audits and findings, start an audit of a connected repository (audits:run) and request AI fix previews (findings:ai-fix, honoured only for organization administrators). It cannot cancel audits, change findings or settings, or delete anything. It expires after 90 days. It is stored in VS Code's secret storage (never in settings files) and is visible and revocable in vetkit under Settings → API keys. vetkit: Sign Out revokes the key and removes all local sign-in data.

To renew a VS Code sign-in key, run vetkit: Sign In again. These keys cannot be renewed with Rotate under Settings → API keys, so they remain linked to the device and its revocation controls.

Quick fixes

Put the cursor on a vetkit diagnostic and open the lightbulb (Ctrl+. / Cmd+.):

• Apply vetkit fix appears for findings whose rule provides its own fix. The fix is applied locally from the findings already loaded (no extra request), and only when the finding's lines in your file are still exactly the scanned snippet. If they changed, or the snippet was redacted because it contained a secret, the action is shown disabled with "code changed since scan". The edit is not saved for you.
• Suggest fix with AI (vetkit) appears for other code findings (not dependency findings). vetkit reads the file at the scanned commit on the server, asks your organization's AI review provider for a minimal patch, checks it and, where possible, re-runs the rule. The extension sends only the finding id, never your local file. The patch is then matched to your local file and shown in a diff editor; it is applied only after you confirm. You are told when your file differs from the scanned commit; if the patch no longer fits your file, nothing is applied and you can open the suggested patch instead.

The AI suggestion needs an organization administrator and a verified AI review provider in vetkit (your own API key; no credits are used). If you signed in with version 0.3.0 or earlier, sign in again once to grant the findings:ai-fix scope. A manually created API key needs findings:ai-fix or findings:write and must belong to an administrator.

Commands

Advanced / self-hosted: manual API key

1. Create an API key in the vetkit app under Settings → API keys.
2. In VS Code settings, set vetkit.apiUrl (only for self-hosted or non-default APIs; default https://api.vetkit.dev), vetkit.orgId and vetkit.repositoryId.
3. Run vetkit: Set API Key, then vetkit: Refresh Findings.

Set API Key shows the API origin that will receive the key and binds the saved key to that origin. Changing vetkit.apiUrl to another origin requires setting a key for that server. Manually saved keys from older extension versions need to be entered once again so their API origin can be confirmed.

When you are signed in, the signed-in organization and the repository selected for the workspace take precedence over vetkit.orgId and vetkit.repositoryId.

Changing the effective API, organization or repository settings clears the previous findings. Run vetkit: Refresh Findings to load results for the new connection.

vetkit: Sign Out only forgets a manually entered key locally; it does not revoke it, because such a key may be shared. A key created by vetkit: Sign In is only ever sent to the API URL that issued it.

What data the extension sends

• At sign-in: the device (host) name, used to name the API key (for example "VS Code - my-laptop").
• For the repository lookup: the normalized git remote of your workspace (host/owner/name).
• Authenticated API requests to list repositories, audits and findings.
• For Suggest fix with AI: the finding id. The server reads the scanned file itself.
• For Run Audit: the repository id and the scan mode (Quick Scan or full scan). The server clones the default branch from the connected provider.

The extension never sends source code. The API key is stored in VS Code Secret Storage and is only sent to the API that issued it.

Disconnecting

• Run vetkit: Sign Out. This revokes the sign-in key; a manually set key is only removed locally.
• Or revoke it in the vetkit app under Settings → Security → Connected devices.
• An organization admin can revoke it under Settings → API keys. Removing a member or changing them to Viewer revokes their VS Code keys automatically.

The extension warns about 7 days before a sign-in key expires. If the key is revoked or expired, it is cleared and the view shows "Your vetkit session ended. Sign in again." with a Sign In action. A manually set key is kept and you get a clear message instead.

Security

• The API URL must use HTTPS (plain HTTP is allowed only for localhost / 127.0.0.1).
• Credentials are only sent to the configured API origin; redirects are rejected.
• Only file paths inside your workspace are opened; unsafe paths in findings are ignored.

Development

cd integrations/vscode
npm ci
npm run typecheck          # tsc, no output
npm test                   # unit tests of the client modules (node:test, no VS Code needed)
npm run test:integration   # extension-host suite in a real VS Code (see below)
npx @vscode/vsce package   # .vsix (only package.json, README, LICENSE, CHANGELOG, out/*.js and the icon ship)

Extension-host suite

npm run test:integration builds the extension, compiles test/integration/ to out-test/ and runs the real extension inside a downloaded VS Code with @vscode/test-electron. A stub of the vetkit API (plain node:http on 127.0.0.1, started inside the test) stands in for the backend; no real backend, account or network access beyond the VS Code download is involved. The scenarios run in order in one window: activation without credentials, vetkit: Sign In starting a device flow against the stub, the stubbed approval matching the workspace's git remote and turning the findings into diagnostics, the rule quick fix (UTF-16 columns with original) offered as a code action and applied on a line with non-ASCII text, its refusal when original no longer matches, a 429 surfacing "Try again in N seconds", and vetkit: Sign Out.

• VS Code is downloaded once into integrations/vscode/.vscode-test/ (gitignored, about 200 MB; delete it to reclaim the space). VSCODE_TEST_VERSION=1.85.0 npm run test:integration tests a specific version instead of the latest stable.
• The run uses a throwaway workspace, user-data and extensions directory in the system temp folder, so your own VS Code settings, secrets and extensions are never touched or read.
• macOS: runs without interaction (a VS Code window opens briefly). The browser is not opened; the suite replaces vscode.env.openExternal, which VS Code leaves patchable in extension tests.
• Linux: needs a display; run it under xvfb-run -a npm run test:integration on headless machines.
• Windows is untested.

Support

Questions or problems: vetkit.dev or contact@vetkit.dev.

License

Proprietary. Copyright © 2026 vetkit. All rights reserved. See LICENSE.md.