Install

Install the extension and let it fetch the scanning engine.

In VS Code

Open the Vulnetix listing on Open VSX and download the VSIX. In VS Code, open the Command Palette and choose Extensions: Install from VSIX, then select the downloaded file.

Or from the command line:

curl -L -o vulnetix.vsix \
  https://open-vsx.org/api/vulnetix/vulnetix/latest/file/vulnetix.vulnetix-latest.vsix
code --install-extension vulnetix.vsix

In everything else

Cursor, Windsurf, VSCodium, code-server, Gitpod, Coder, Eclipse Theia, OpenVSCode Server, Firebase Studio, Kiro, Positron and Trae all install from Open VSX, because the Visual Studio Marketplace’s terms permit only Microsoft’s own builds of VS Code to use it.

Searching Vulnetix in the Extensions view works in all of them, since Open VSX is already their default registry. Or:

cursor   --install-extension vulnetix.vulnetix
windsurf --install-extension vulnetix.vulnetix
codium   --install-extension vulnetix.vulnetix

Installing from Open VSX covers sideloading a .vsix, pinning a version, private registries and air-gapped setups. Per-editor detail, including pre-installing into a container image, is under Editors.

First run

The extension activates shortly after the editor finishes starting, and does nothing expensive until you ask it to. On the first scan it needs the Vulnetix CLI, and will offer to fetch it:

1. It looks for a binary you have configured with vulnetix.cli.path.
2. Then for vulnetix on your PATH.
3. Then for a copy it downloaded previously.
4. Failing all of those, it offers to download one.

Downloads are verified against the checksums.txt published with the release before the binary is ever executed. If the hash does not match, the download is discarded and you get an error, not a “continue anyway” button. There is no option to skip verification: if something between you and GitHub is rewriting traffic, the answer is an internally vetted binary via vulnetix.cli.path, not a disabled integrity check.

Verify it worked

Open the Command Palette (Ctrl+Shift+P) and run Vulnetix: Show Output. The log records the extension version, the resolved CLI path and version, and where that binary came from.

Updating

The extension updates through your editor like any other. The CLI is managed separately, because the extension needs a version it knows how to talk to. By default you are prompted when a compatible newer build is available; set vulnetix.cli.autoUpdate to auto to have it applied on the next restart, or never to pin it.

A CLI you configured yourself with vulnetix.cli.path is never touched.

Next

Run your first scan.