WhiteSniper for VS Code

WhiteSniper brings your workspace's findings — security, code quality, supply-chain, and the rest of the Production Readiness Pack — into the editor: diagnostics as you work, a findings view grouped by severity and file, one-click rechecks, and an agent-ready fix hand-off. It works in VS Code and in any Code-OSS-based editor (Cursor, Windsurf, VSCodium, and the like).

WhiteSniper never reimplements its own scanning: this extension is a thin client over two local processes it launches for you — a language server (@whitesniper/lsp) that produces diagnostics and code actions, and an MCP server (@whitesniper/mcp) that gives your agent the same findings, fix context, and recheck commands as tools.

What it does

• Diagnostics as you work. The language server reports findings as standard diagnostics with Quick Fix actions, so they show up like any other compiler warning.
• Findings view. A dedicated view in the activity bar lists every finding, grouped by severity (critical to info) and then by file. Selecting one opens the file at the exact location.
• Recheck. Re-runs a finding's original detectors and reports whether it is resolved, still present, or inconclusive — the same rule the CLI and CI use to close a finding.
• Explain Finding. Opens a finding's full detail — description, remediation, baseline state, and the recheck command — in the editor's own Markdown preview. No custom webview.
• Fix with Agent. Builds the finding's fix prompt (its context, its constraints, and the recheck command that closes it) and hands it to whatever you use to make the change: your editor's chat view when one is open, or the clipboard otherwise. WhiteSniper never assumes a particular AI extension is installed.
• MCP server. WhiteSniper registers itself as an MCP server definition provider, so any agent that talks MCP in your editor gets the same findings, fix context, and recheck tools without extra setup.

The cockpit

WhiteSniper: Open Cockpit opens two panes beside your code (see docs/cockpit.md in the repository):

• Plan & Task Contract. Reads whitesniper.plan.yml: the goal, the tasks, and the proofs that show each one done. A task claimed done whose proofs do not all hold shows as unproven. Findings under a proof open in the editor or go to your agent.
• Live Quality Twin. Your app running on this machine (whitesniper.twin.url): whether it answers, what the probe finds on each page, which contracts hold, and the readiness pillars. It probes every 15 seconds while visible, only in a trusted workspace, and opens the app in the Simple Browser beside it.

Both panes follow your theme, work by keyboard, and load nothing from the network.

Workspace Trust

In a restricted (untrusted) workspace, WhiteSniper never runs engines that execute repository code or its own configuration (ESLint using the project's eslint.config.js, Pyright using the project's pyproject.toml), and it launches the MCP server with --untrusted. Engines that only read files — secret scanning, dependency checks — still run. The findings view and status bar say when you're in restricted mode.

What data leaves the machine

By default, nothing does: every engine WhiteSniper runs works entirely on your local files, and the MCP server is launched with --offline. Turning on WhiteSniper: Allow Network Engines (whitesniper.allowNetworkEngines) lets a full workspace scan also run engines that look things up externally — for example, checking a dependency's advisories against a public database. That setting never applies to on-save scans, only to an explicit Scan Workspace.

Settings

Privacy and telemetry

This extension sends no telemetry: no activation events, no scan counts, no crash reports, nowhere. The only network activity it can ever cause is the language server's or MCP server's own engines, and only when whitesniper.allowNetworkEngines is on and you run a full workspace scan.

Requirements

• VS Code 1.101.0 or later (or a compatible Code-OSS editor).
• Nothing else: the language server and the MCP server ship inside the extension, with their dependencies and core's rule and configuration files. Engines that WhiteSniper runs but does not ship (ESLint, Ruff, Pyright, Opengrep, Gitleaks, OSV-Scanner) are used when they are installed and reported as skipped when they are not.
• To use another build of a server, set whitesniper.lspPath / whitesniper.mcpPath to its absolute path. From source: code --extensionDevelopmentPath=<repo>/packages/vscode <folder> after pnpm build.