VS Code Extension
Guides
VS Code extension
Scan your workspace from inside VS Code. Findings show up in the editor, the Problems panel and the Scanverra sidebar, and your code never leaves your machine.
Install
The extension is published on the Visual Studio Marketplace as Scanverra.
- Open the Extensions view (Ctrl+Shift+X, or Cmd+Shift+X on macOS).
- Search for Scanverra and click Install.
- A shield icon appears in the Activity Bar. That is the Scanverra view.
Or paste this into Quick Open (Ctrl+P, or Cmd+P on macOS)
ext install scanverra.scanverra-vscode
Log in
Scans need a Scanverra API key. Create one in your dashboard under API Keys.
- Open the Scanverra view. If you are not logged in, it shows a login card.
- Paste your API key and click Save API key. The key is checked with Scanverra before it is saved.
- You can also run Scanverra: Log In with API Key from the Command Palette.
The extension and the Scanverra CLI use the same saved login. If you already ran scanverra login, the extension is logged in too, and logging in from VS Code logs the CLI in as well.
Click Log out in the Scanverra view, or run Scanverra: Log Out. This removes the saved key for both the extension and the CLI on this machine.
Scan your workspace
- Open a folder in VS Code.
- Click Scan Workspace in the Scanverra view, click the shield in the status bar, or run Scanverra: Scan Workspace.
- Findings appear as squiggles in the editor and in the Problems panel, and are grouped by file in the sidebar.
- Use the severity chips and the search box to narrow the list, then click View to jump to a finding or Fix to read the suggested fix.
- Click Clear to dismiss the results.
How it works
Inline diagnostics
Each finding is shown on its line in the editor and listed in the Problems panel.
Triage sidebar
Score, quality gate, severity filters, findings by file, and dependency vulnerabilities in a separate tab.
Scans locally
The same engine as the CLI. Files are read and checked on your own machine.
Remembers the last scan
Results are kept per workspace, so they are still there after you restart VS Code.
Commands
All commands are available from the Command Palette (Ctrl+Shift+P, or Cmd+Shift+P on macOS).
| Command | Description |
|---|---|
Scanverra: Scan Workspace | Scan the open folder and show the results |
Scanverra: Clear Scan Results | Remove the findings from the editor and the sidebar |
Scanverra: Open Full View | Open the results in a full editor tab |
Scanverra: Log In with API Key | Paste and verify an API key |
Scanverra: Get an API Key | Open the API Keys page in your browser |
Scanverra: Log Out | Remove the saved API key |
What leaves your machine
The extension downloads the signed scanner rules from Scanverra, verifies them, and runs every check on your machine. It never uploads your files, matched code lines or a report. Only the API key is sent, to check your account and plan.
Current limitations
- Scans run when you ask for them. There is no scan-on-save yet.
- Findings are highlighted on the whole line, not a specific column.
- In a multi-root workspace, only the first folder is scanned.
Troubleshooting
| Message | What to do |
|---|---|
Log in to Scanverra | Paste an API key in the Scanverra view, or run Scanverra: Log In with API Key |
That API key was rejected | The key is wrong or was revoked. Create a new one under API Keys |
Your saved API key was rejected | The saved key no longer works. Paste a new one in the login card |
Requires a Pro, Team or Enterprise plan | Upgrade your plan, then scan again |
Open a folder to scan | Open a folder with File > Open Folder, then scan |
No scannable files found | Check the folder and your .gitignore or .scanverraignore |
Ready to scan from your editor?
Create an API key, install the extension, and run your first scan.