Skip to main content

AI coding assistants

Your AI coding assistant asks Vulkro.

Instead of reading your whole codebase to look for vulnerabilities, it asks Vulkro and gets back the proven finding with the path behind it. It makes the fix, and Vulkro checks it with a second scan.

Connect your assistantSee how it plugs in
  • Claude Code
  • Cursor
  • Codex
  • GitHub Copilot Chat
  • Windsurf
  • Gemini CLI
  • Cline
  • Amp
  • Kilo Code
  • OpenCode
  • + any other MCP client
  1. It searches with VulkroWhile it builds, it asks Vulkro's code search what uses the code it is changing, in one call instead of grep.
  2. It asks Vulkro to checkThe assistant runs Vulkro on the file it just changed. No model reads your code to find the problem.
  3. It gets the proofThe finding comes back with its path: where the data enters, the line it reaches, and who can reach it.
  4. It fixes, Vulkro checksThe assistant makes the fix. Vulkro scans it again before the work is called done: fixed, not fixed or made worse.

An illustrative session. The tools, the rule and the verdicts are real.

01Why ask

It asks instead of reading.

An assistant looking for vulnerabilities has to read file after file and still guesses. Vulkro has already done the search, so the assistant reads only the answer.

66%fewer tokenson a security review than an AI agent reading the code itself, finding as many real issues in total (238 of 280). Measured with vulkro 0.32.0 on 2026-10-07, on Vulkro's own test apps, which were used to develop Vulkro, so the result is flattered.55 to 69% less code read when getting oriented in a new codebase, with Vulkro's code search.Against an agent reading files, on two open-source repositories, three agent runs each.How the saving works
  • No AI in detection.The same code gets the same answer, every run. Finding and proving a vulnerability costs no model tokens at all.
  • Runs offline.Your code stays on your machine. Only the result reaches your assistant, and what it sends to its own model is up to you.
  • Read-only.Vulkro never writes to your code. Every change is your assistant’s, and yours to review.

02How it plugs in

It can ask, it knows when, and it is checked anyway.

Three pieces, each optional. Use one, or all three.

  1. 01Tools your assistant can callIt can ask.Vulkro shows up as a set of tools your assistant can call: search the code while it builds, scan a file or a project, prove a finding, get fix guidance and check its fix.assess_changescan_fileprovesuggest_fixesverify_fix
    • Claude Code
    • Cursor
    • GitHub Copilot Chat
    • Any MCP client
    Every tool
  2. 02The skillIt knows when to ask.A short set of instructions that tells your assistant to check its work with Vulkro before it calls a change done.A skill, a Cursor rules file, or instructions added to AGENTS.md.
    • Claude Code
    • Cursor
    • Codex
    About the skill
  3. 03The guardIt gets checked anyway.Every file your assistant writes is scanned, whether it asked or not. Serious findings go straight back to it to rewrite.Rewrite proven, High, CriticalReview the rest, never called clean
    • Claude Code
    • Cursor
    About the guard

03Set it up

Connect it in a couple of commands.

Install Vulkro, then pick your assistant. Every command runs on your machine.

Every tool your assistant can call

The MCP servers for code and Salesforce, the skill that teaches Claude when to ask, and the guard on every write.

terminal
# MCP servers
claude mcp add vulkro -- vulkro mcp serve
claude mcp add vulkro-sf -- vulkro-sf mcp serve
# the skill
curl -fsSL https://dist.vulkro.com/skill-install.sh | bash -s -- --agent claude-code
# the guard, on every file the agent writes
vulkro guard install --agent claude-code
Setup guide

New to Vulkro? Start the trial and install it first. Scanning, proof, fix checks and the guard are in every plan. See pricing.

Let your assistant ask instead of guess.

Connect your assistantTalk to us