VulTech brings unified SAST, software composition analysis (SCA), and compliance mapping into your IDE — the same detection engine as the VulTech platform.

Works with VS Code, Cursor, cloud SSO, and air-gapped on-prem deployments.

Features

SAST — Rule and taint-based findings with CWE/OWASP metadata, inline diagnostics, and quick actions
SCA — Dependency manifests (package.json, lockfiles, requirements.txt, etc.) sent with unified scans; CVE details in the Dependencies sidebar
Compliance — Maps findings to frameworks (OWASP, NIST, etc.) when enabled on your deployment
Deployment profiles — cloud, on-prem, or custom API URL
Auth — SSO Sign In, password login (on-prem), or paste JWT (stored in SecretStorage)

Quick start

Install the extension from the Marketplace (or install from VSIX).
Open Settings → search vultech:
- Cloud: default — click Authenticate in the VulTech sidebar or run VulTech: Sign In
- New user: Create Account → app.vultech.io/signup
- On-prem: deploymentMode = on-prem, set vultech.apiUrl → Login with Password
Open a source file and run VulTech: Scan Current File (Cmd/Ctrl+Shift+V).

Commands

Command	Description
VulTech: Scan Current File	SAST + SCA (manifests) for the active file
VulTech: Scan Workspace	Parallel workspace scan; SCA manifests collected once per root
VulTech: Sign In	Cloud / SSO authentication
VulTech: Login with Password	On-prem email + password
VulTech: Paste Access Token	Store JWT in secure editor storage
VulTech: Open Dashboard	Open your deployment in the browser
VulTech: Clear All Findings	Clear Problems and sidebars

Settings (common)

Setting	Default	Notes
`vultech.deploymentMode`	`custom`	`cloud` \| `on-prem` \| `custom`
`vultech.apiUrl`	`http://localhost:8081`	Resolved by deployment mode
`vultech.autoScan`	`true`	Scan on save (SAST-light; preserves SCA sidebar)
`vultech.collectManifests`	`true`	Include lockfiles/manifests in unified scans
`vultech.requestTimeoutMs`	`120000`	Increase for large files / ML on server

Do not put your login JWT in Api Key — that field is for server integration keys only.

Requirements

A running VulTech API with POST /api/analyze/unified (VulTech Cloud, on-prem, or local Docker)
JWT for unified scans — use Authenticate or create an account

Privacy

The extension is a thin client: code and manifests are sent only to vultech.apiUrl. See the extension PRIVACY tab on the Marketplace listing.