CLI Tool Checks

CLI tool checks require external programs installed on your machine. If a tool is not found, the check returns skip — never an error. Install only the tools relevant to your stack.

Tip

The extension uses where (Windows) or which (Unix) to pre-check binary availability before running — avoiding cryptic error messages from OS locale differences.

---

Semgrep — SAST Security

Runs semgrep scan --config auto — detects security vulnerabilities, OWASP Top 10, and code anti-patterns across 30+ languages.

Install:

pip install semgrep

Configure:

"devManager.quality.semgrep.enabled": true,
"devManager.quality.semgrep.config": "auto"

config options: "auto" | "p/security-audit" | path to a custom rules file.

---

Trivy — CVE Vulnerability Scanner

Scans dependencies, Dockerfiles, IaC configs, and secrets for known CVEs. Supports all major package ecosystems (npm, pip, cargo, go.mod, composer, gem, etc.).

Install:

Windows

winget install AquaSecurity.Trivy

macOS

brew install trivy

Linux

curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

Configure:

"devManager.quality.builtin.trivy.enabled": true,
"devManager.quality.builtin.trivy.failOnSeverity": "HIGH",
"devManager.quality.builtin.trivy.warnOnSeverity": "MEDIUM"

---

ESLint Security — JS/TS Security Rules

Runs ESLint with eslint-plugin-security to detect JavaScript/TypeScript-specific security anti-patterns (prototype pollution, ReDoS, unsafe regex, eval usage, etc.).

Install:

npm i -D eslint eslint-plugin-security

Configure:

"devManager.quality.builtin.eslintSecurity.enabled": true

No additional configuration needed — the extension auto-detects your ESLint installation.

---

Bandit — Python Security

Static analysis tool for Python security issues (hardcoded passwords, SQL injection, unsafe deserialization, subprocess misuse, etc.).

Install:

pip install bandit

Configure:

"devManager.quality.builtin.bandit.enabled": true,
"devManager.quality.builtin.bandit.path": "bandit"

Auto-skips if no Python files are found in the project.

---

Bearer — Sensitive Data Flow Analysis

SAST scanner that tracks how sensitive data (PII, credentials, tokens) flows through your code. Detects data leaks, insecure storage, and compliance violations.

Linux/macOS only

Bearer has no native Windows binary. On Windows, install it inside WSL2 and set devManager.quality.builtin.bearer.path to the WSL binary path.

Install (macOS/Linux):

# macOS
brew install bearer/tap/bearer

# Linux
curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh

Configure:

"devManager.quality.builtin.bearer.enabled": true,
"devManager.quality.builtin.bearer.path": "bearer"

Windows (WSL2):

"devManager.quality.builtin.bearer.path": "wsl bearer"

---

jscpd — Copy-Paste Detection

Detects copy-pasted code blocks across the project. Supports 50+ languages.

Install:

npm i -D jscpd

Configure:

"devManager.quality.builtin.jscpd.enabled": true,
"devManager.quality.builtin.jscpd.threshold": 5,
"devManager.quality.builtin.jscpd.minLines": 5

threshold — duplication percentage to trigger a warning.

---

Knip — Dead Code Detection

Detects unused exports, files, and dependencies in JavaScript/TypeScript projects.

Auto-installed via npx — no manual install needed.

"devManager.quality.builtin.knip.enabled": true

---

dependency-cruiser — Circular Dependencies

Detects circular import chains in JavaScript/TypeScript projects. Supports custom .dependency-cruiser.js configuration.

Auto-installed via npx — no manual install needed.

"devManager.quality.builtin.dependencyCruiser.enabled": true

---

Package Audit — CVE Scan via Package Managers

Runs your language’s native vulnerability audit:

Language	Command
Node.js	npm audit / pnpm audit / yarn audit
Python	pip-audit
Rust	cargo audit
Ruby	bundle audit
Go	govulncheck
PHP	composer audit

Configure:

"devManager.quality.builtin.pkgAudit.enabled": true

Automatically detects the right tool from your lockfile.

---

Outdated Dependencies

Shows packages with newer versions available.

"devManager.quality.builtin.outdatedDeps.enabled": true

---

License Compliance — license-checker

Lists all dependency licenses and warns on restrictive ones (GPL, AGPL, LGPL, unknown).

Auto-installed via npx — no manual install needed.

"devManager.quality.builtin.licenseCheck.enabled": true

---

Hadolint — Dockerfile Linting

Lints Dockerfiles for best-practice violations and security issues.

Install:

Windows

winget install hadolint

macOS

brew install hadolint

Linux

curl -sL https://github.com/hadolint/hadolint/releases/latest/download/hadolint-Linux-x86_64 \
  -o /usr/local/bin/hadolint && chmod +x /usr/local/bin/hadolint

"devManager.quality.builtin.hadolint.enabled": true

Scans all Dockerfile and Dockerfile.* files found in the project tree.

---

ShellCheck — Shell Script Linting

Static analysis for Bash/sh scripts — detects bugs, portability issues, and style problems.

Install:

Windows

winget install koalaman.shellcheck

macOS

brew install shellcheck

Linux

sudo apt install shellcheck

"devManager.quality.builtin.shellcheck.enabled": true

---

golangci-lint — Go Linting

Aggregates 100+ Go linters in a single fast run. Only activates when a go.mod file is found.

Install:

macOS

brew install golangci-lint

Windows

winget install golangci-lint

Go install

go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest

"devManager.quality.builtin.golangciLint.enabled": true,
"devManager.quality.builtin.golangciLint.warnAt": 5,
"devManager.quality.builtin.golangciLint.failAt": 20

---

Stryker — Mutation Testing

Runs mutation tests to measure how well your test suite catches bugs. Only for JavaScript/TypeScript projects.

Caution

Stryker is disabled by default — it can be slow on large projects.

Install:

npm i -D @stryker-mutator/core @stryker-mutator/jest-runner

"devManager.quality.builtin.stryker.enabled": false