Skip to main content

VS Code extension

Catch the security problem on the line that causes it.

Vulkro underlines the problem when you open or save the file. It shows how someone could reach it and what to change, then checks again once you or your AI agent fix it. Your code stays on your machine.

Install the extensionRead the docs
  • VS Code
  • Cursor
  • Windsurf
  • VSCodium

Works with a 14-day trial or Pro.

Hover to see what is wrong and how someone could reach it, step by step.

A TypeScript route in VS Code with the extension installed. Vulkro says what to change and where; your AI agent or you make the change, and the next scan confirms the problem is gone.

01Why in the editor

Fix it while it is still one line.

Security problems usually turn up in a pipeline or a review, after you have moved on. The extension shows them when you save, while the change is still in your head.

Why this matters more with AI-written code

SaveThe extension reports here: the line, the path behind it and what to change, on open and on save.

02Your AI assistant

Your AI assistant can ask it too.

  • Ask in plain words whether a file is safe to ship.
  • The assistant gets the finding and its path from Vulkro, instead of reading your whole codebase to look for it.
  • Your assistant makes the fix as a diff you review, and Vulkro scans again to confirm it.

Agent mode in VS Code calls Vulkro through tools the extension adds. Other assistants can use the Vulkro MCP server it registers, which makes no network calls.

Vulkro with AI coding agents

03Why trust it

Quiet, local, and yours to approve.

  1. 01Quiet while you typeIt checks a file when you open or save it, never on every keystroke, so the editor stays fast.Saving checks only the file you saved
  2. 02Nothing changes without youThe extension suggests what to change. You or your AI agent make the change; it never edits your files on its own, not even to silence a warning.You review every edit before it is applied
  3. 03Your code stays with youScanning runs on your machine and detection uses no AI. AI help is optional, on a local model by default.Your code is not uploaded to scan it
  4. 04The same answer as CIThe extension runs the same engine as the command line and your pipeline, so the pull request shows what you already fixed.The engine found 181 of 229 problems planted in 9 blind test apps (vulkro 0.30.0, 2026-10-05; not re-measured since)

04Install

Install it from the command line.

Install Vulkro, then one more command finds your editor and adds the extension. Pick the edition for your code, or install both.

Application code

Vulkro

JavaScript, TypeScript, Python, Go and Java, plus dependencies, infrastructure as code, containers and secrets.

terminal
# install the command line, then the extension
$ curl -fsSL https://dist.vulkro.com/install.sh | bash
$ vulkro install-extension
Setup guide

Salesforce

Vulkro for Salesforce

Apex, LWC, Aura, Visualforce, Flow and permission metadata, with how each Apex class runs shown above it.

terminal
# install the command line, then the extension
$ curl -fsSL https://dist.vulkro.com/install-sf.sh | bash
$ vulkro-sf install-extension
Setup guide
Installs into
  • VS Code
  • Cursor
  • Windsurf
  • VSCodium
Through the language server
  • Neovim
  • Helix
  • Emacs
Salesforce DX projects
Both editions run side by side, each on its own files

Find the problem while you write the code.

Install the extensionTalk to us