Documentation
VS Code and every fork of it. Which marketplace each uses, what works, and how to install.
Vulnetix is published to both the Visual Studio Marketplace and
Open VSX. That matters
because only Microsoft’s own builds of VS Code may use the Visual Studio
Marketplace; every fork uses Open VSX or asks you to install the .vsix by
hand. Publishing to both is why the same extension works everywhere below.
Not the editor’s name: where the extension host runs, and whether it has a real filesystem and the ability to start a process.
Scanning means running the Vulnetix CLI over your files. Anywhere the extension host is a Node process with disk access, everything works, whether that process is on your laptop or on a server in a data centre. The only reduced case is a purely browser-based editor, where there is no Node process at all.
| Editor | Marketplace | Extension host | Support |
|---|---|---|---|
| VS Code | Visual Studio Marketplace | Local, or remote over SSH/WSL/containers | Full |
| Cursor | Open VSX | Local | Full |
| Windsurf | Open VSX | Local | Full |
| VSCodium | Open VSX | Local | Full |
| code-server | Open VSX | Remote (the server) | Full |
| OpenVSCode Server | Open VSX | Remote (the server) | Full |
| Gitpod | Open VSX | Remote (the workspace) | Full |
| Coder | Open VSX or a private registry | Remote (the workspace) | Full |
| Eclipse Theia | Open VSX | Local or remote | Full |
| Firebase Studio | Open VSX | Remote (the workspace) | Full |
| Kiro | Open VSX | Local | Full |
| Positron | Open VSX | Local | Full |
| Trae | Open VSX | Local | Full |
| vscode.dev and github.dev | Visual Studio Marketplace | Browser only | Reduced |
vscode.dev and github.dev run entirely in the browser tab. There is no Node
process, no child processes, and the files you see come from a virtual
filesystem rather than a disk. Nothing that requires running a scanner can work
there.
What still works is everything backed by the service: the threat intelligence browser, organisation policy, and findings from a scan that already ran somewhere else. The extension detects this and hides the commands it cannot honour, rather than offering them and failing.
The full picture is on browser-based editors.
A common assumption is that “in the browser” means degraded. For Gitpod, code-server, Coder, Firebase Studio and VS Code’s own Remote-SSH, that is not true: the interface is in your browser, but the extension host is a full Node process running next to your files, so scanning is exactly as capable as on a laptop, and often faster.
The extension declares itself a workspace extension for precisely this reason.
In a remote session it runs where the code is, not on your local machine, so it
sees the real node_modules, the real git history, and the real file tree.
If your editor is a VS Code fork on version 1.96 or later and it can install from Open VSX, the extension will almost certainly work. Tell us about it and we will test it and add a page: open an issue.