VS Code Extension

The Promptfoo Security Scanner for VS Code detects LLM security vulnerabilities directly in your editor. It finds prompt injection risks, jailbreak vulnerabilities, PII exposure, and other security issues as you code—before they reach your CI pipeline or production.

:::info Enterprise Feature The VS Code extension is available for Promptfoo Enterprise customers. Contact us to get access for your organization. :::

Features

• Real-time scanning: Automatically scans files on save
• Inline diagnostics: Security issues appear as squiggly underlines in your code
• Problems panel: All findings listed in VS Code's Problems panel
• CodeLens annotations: Inline severity indicators above vulnerable code
• Quick fixes: Apply suggested fixes with one click
• AI assistance: Get AI-generated prompts to help fix complex issues
• Git diff scanning: Scan all changed files in your branch

Getting Started

1. Contact us to get the extension package (.vsix file)
2. Install in VS Code: Extensions → ⋯ → Install from VSIX
3. Configure your API key: Cmd+Shift+P → Promptfoo: Configure API Key

Usage

Automatic scanning: Files are scanned when you save. Findings appear as inline diagnostics in your code and in the Problems panel.

Manual scanning: Use the Command Palette (Cmd+Shift+P):

• Promptfoo: Scan Current File — Scan the active file
• Promptfoo: Scan Selection — Scan selected code
• Promptfoo: Scan Git Changes — Scan all changed files in your branch
• Promptfoo: Clear All Scan Results — Clear all diagnostics
• Promptfoo: Show Output — Show the extension's output channel

Keyboard Shortcuts

Context Menu

Right-click in the editor to access:

• Scan Current File — Scan the entire file
• Scan Selection — Scan only the selected code (when text is selected)

Configuration

Configure the extension in VS Code Settings or in your settings.json:

Example settings.json

{
  "promptfoo.minimumSeverity": "medium",
  "promptfoo.scanOnSave": true,
  "promptfoo.scanOnSaveDebounceMs": 2000,
  "promptfoo.showCodeLens": true
}

Supported Languages

By default, the extension scans:

• JavaScript / TypeScript (including JSX/TSX)
• Python
• Go
• Java
• Rust
• Ruby
• PHP
• C#
• C/C++

Customize with the promptfoo.enabledLanguages setting. An empty array enables scanning for all languages.

Severity Levels

Findings are classified by severity:

Use the promptfoo.minimumSeverity setting to filter out lower-severity findings.

Privacy

Code is sent to Promptfoo's servers for analysis and is not stored after analysis completes. For organizations that need to run scans on their own infrastructure, the extension works with Promptfoo Enterprise On-Prem.

See Also

• Code Scanning Overview
• GitHub Action
• CLI Command