Cursor

AI-first VS Code fork. Installs from Open VSX; everything works.

Planned Designed and scheduled, not yet built. Documented so the design can be reviewed early.

Cursor is a desktop Electron application built on VS Code, so the extension host is a local Node process with full filesystem access. Every feature works.

Install

Cursor uses Open VSX, not the Visual Studio Marketplace. Open the Extensions view and search Vulnetix; you will get the Open VSX listing, which is the same extension.

If your Cursor build has search disabled or restricted:

  1. Download the .vsix from Open VSX or from GitHub releases.
  2. Command Palette → Extensions: Install from VSIX, and pick the file.

Worth knowing

The extension is not an AI feature and does not use your model quota. Scanning is deterministic rule evaluation running locally. It costs you nothing in Cursor credits and sends nothing to an AI provider.

It pairs well with AI-generated code. Cursor writes a lot of code quickly, and generated code carries the same injection, deserialisation and hardcoded-credential mistakes as hand-written code, often more, because a model happily reproduces an insecure pattern it saw in training data. Findings appear on the generated line as soon as it lands.

Composer and Agent edits are scanned. Anything written to the file triggers the same checks as typing, so a multi-file agent edit is checked as it completes rather than at the next commit.

Also worth having

The Vulnetix CLI installs agent skills into ~/.cursor/skills, which lets Cursor’s agent query the vulnerability database, triage findings and propose fixes directly:

vulnetix skills install

That is complementary to the extension: the extension gives you findings in the gutter, the skills give the agent the ability to reason about them.

Didn't find what you needed? Tell us what's missing · Ask a question · Edit this page