Docs · VS Code

VS Code extension

See the latest vetkit audit findings for the repository you have open, directly in VS Code, as diagnostics and in a Findings tree view in the vetkit activity bar.

Install

Install vetkit (publisher vetkit, id vetkit.vetkit-vscode) from the Visual Studio Code Marketplace. It requires VS Code 1.85 or later.

Run vetkit: Sign In from the Command Palette, or click Sign in to vetkit in the Findings view.

Your browser opens the vetkit app at /ide/connect and shows a one-time code. Check that it matches the code shown in VS Code.
Choose the organization and approve. You need the Member role or higher; Viewers cannot approve.
Approval creates a read-only API key (scopes repos:read, audits:read, findings:read, findings:ai-fix) named “VS Code — device name” that expires after 90 days. The extension stores it in VS Code Secret Storage.

The one-time code expires after 10 minutes. If it does, start the sign-in again.

The extension warns you about 7 days before the key expires. When the key expires or is revoked, it asks you to sign in again.

Alternatively, run vetkit: Set API Key and paste a key you created yourself.

Repository detection

The extension reads the remotes in the workspace’s .git/config (it does not run git), normalizes them to host/owner/name and looks them up in the signed-in organization. A single match is selected automatically.

Otherwise vetkit: Select Repository shows a picker. It includes a Connect this repository in vetkit option that opens the vetkit Repositories page with the repository prefilled.

Results come from the latest successful server-side audit, not from unsaved editor buffers. They are marked stale when your local HEAD differs from the audited commit.

Disconnecting

vetkit: Sign Out revokes the key on the server and deletes it from your device. A key you pasted manually is only forgotten locally; it is not revoked.
You can also revoke the device in the vetkit app under Settings → Security → Connected devices, and organization admins can revoke it under Settings → API keys.
Removing a member from an organization, or changing their role to Viewer, automatically revokes their VS Code keys in that organization.

Data sent

At sign-in, the device (host) name, sanitized and used to name the API key.
The normalized git remote (host/owner/name) for the repository lookup.
Authenticated API requests to list repositories, audits and findings.

The extension never uploads source code.

For self-hosted installations, set vetkit.apiUrl (HTTPS is required, except for localhost). The key is only sent to the API that issued it.