Security scanner for AI-built web apps. Scans your code via Docker and shows findings inline in VS Code.
Requirements
- Docker installed and running
Getting Started
- Install the extension and a Welcome panel will guide you through setup
- Open a project folder in VS Code
- Run CodeWatchtower: Scan Workspace from the Command Palette (
Ctrl+Shift+P) - Findings appear in the Problems panel with inline squiggly underlines
Tip: You can re-open the welcome guide anytime via
Ctrl+Shift+P→ CodeWatchtower: Getting Started
Free vs Pro
| Free | Pro ($12.99/mo) | |
|---|---|---|
| Security score | ✅ | ✅ |
| Top 5 issues | ✅ | ✅ |
| All findings | ❌ | ✅ |
| SCA dependency checks | ❌ | ✅ |
| JSON/Markdown export | ❌ | ✅ |
After a free scan, VS Code will prompt you to upgrade — or you can enter your key anytime.
License Key
- Get a key at codewatchtower.com/pricing
- Run CodeWatchtower: Set License Key from the Command Palette (
Ctrl+Shift+P) - Your key is stored securely via VS Code's SecretStorage (encrypted, per-user)
- Your next scan will show full results
Settings
| Setting | Default | Description |
|---|---|---|
codewatchtower.imageName |
ghcr.io/refercraft/codewatchtower |
Docker image to use |
codewatchtower.dockerPath |
docker |
Path to Docker binary |
How It Works
The extension mounts your workspace into a Docker container and runs the CodeWatchtower scanner. Results are written to a temp file inside your workspace, read back by the extension, then cleaned up — no stdout parsing issues.
docker run --rm -v <workspace>:/app ghcr.io/refercraft/codewatchtower scan /app --format json --output /app/.cwt-result.json