Installing from Open VSX

The registry every VS Code fork uses, why it exists, and how to install from it.

Vulnetix is available from Open VSX. VS Code users can download the VSIX from that listing. Compatible editors such as Cursor, Windsurf and VSCodium use Open VSX as their built-in registry.

Why there are two registries

The Visual Studio Marketplace’s terms of use permit only Microsoft’s own builds of Visual Studio Code to access it. That is a licence restriction, not a technical one, and it applies to every fork: Cursor, Windsurf, VSCodium, code-server, Gitpod, Eclipse Theia, Kiro, Positron, Trae and the rest.

Open VSX is the Eclipse Foundation’s vendor-neutral answer. It is the default registry in every one of those editors, and it is why the same extension works across all of them.

The practical consequence is worth stating plainly: a security extension published only to the Visual Studio Marketplace is unavailable to a large share of working developers. Vulnetix publishes each release to Open VSX so those editors can install it through their normal extension flow.

Installing

From the Extensions view

In any Open VSX-backed editor, open the Extensions view (Ctrl+Shift+X, or Cmd+Shift+X on macOS), search for Vulnetix, and install the one published by vulnetix. Your editor is already pointed at Open VSX, so there is nothing to configure.

From the command line

Most forks ship a CLI that mirrors code:

cursor   --install-extension vulnetix.vulnetix
windsurf --install-extension vulnetix.vulnetix
codium   --install-extension vulnetix.vulnetix

# Server-side editors install into the server, not a desktop app:
code-server --install-extension vulnetix.vulnetix

From a downloaded VSIX

Useful when extension search is disabled, when the editor cannot reach the network, or when your organisation vets extensions before allowing them.

curl -L -o vulnetix.vsix \
  https://open-vsx.org/api/vulnetix/vulnetix/latest/file/vulnetix.vulnetix-latest.vsix

Then either Command Palette → Extensions: Install from VSIX, or:

codium --install-extension vulnetix.vsix

The same .vsix is attached to every GitHub release.

Pinning a version

The latest path above always resolves to the newest release. To pin:

curl -L -o vulnetix-0.2.0.vsix \
  https://open-vsx.org/api/vulnetix/vulnetix/0.2.0/file/vulnetix.vulnetix-0.2.0.vsix

Worth knowing if you pin: the extension and the Vulnetix CLI share a protocol version that must match exactly, so an old extension pinned against a new CLI refuses to start the language server and says so. Pin both together, or pin neither. See managing the engine binary.

Air-gapped and private registries

Open VSX is self-hostable, and several editors support pointing at a private registry. Two common arrangements:

Mirror the extension into your own Open VSX instance. Download the .vsix as above and publish it into your registry. Editors configured against it will find Vulnetix the same way they find anything else.

Distribute the VSIX directly. Put it on internal storage and install it with --install-extension, or pre-install it in your workspace or container image. See your editor’s page under Editors for the image-build snippet.

Remember the extension is only half of it. The Vulnetix CLI is a separate binary, and in an air-gapped environment it needs either a mirror serving the release layout including checksums.txt, or a pre-installed binary and the vulnetix.cli.path setting. That is covered in managing the engine binary.

Verifying what you installed

Open VSX serves the artefact the release workflow published. To check that what you have is what we published, compare the SHA-256 of your .vsix against the one attached to the corresponding GitHub release:

sha256sum vulnetix.vsix

The Open VSX artefact and the VSIX attached to the matching GitHub release come from the same release workflow and have the same digest.

Which editors use which registry

Per-editor detail, including how to pre-install into a container or workspace image, is on each editor’s page under Editors.