VS Code Extension

audit/bench, right in your editor

Same review engine as the CLI and web app — inline diagnostics, hover explanations, and one-click AI fixes, without leaving VS Code.

What it does

Talks to the same /audit, /me, and repo-scan/fix endpoints the CLI and web app use — no separate backend, no separate account.

Audit Current File

Sends the active file to your account and shows findings as inline squiggly diagnostics — red for critical/high, yellow for medium, blue for low.

Hover for the full finding

Description, root cause, suggested fix, and an example patch where available — without leaving the line you’re looking at.

Status bar verdict

Shows the last verdict and how many tokens it cost — nothing shown if the finding was free (cached, or resolved by local checks alone).

Fix All Issues with AI

One click fixes every finding in a file, applies the result to the editor, then re-checks the fix and updates the diagnostics to match.

Account & Usage panel

Your plan, and daily/monthly AI-audit quota with reset times — a status bar glance opens the full panel.

Secrets-aware by default

A file that looks like it holds a real key — an AWS/Slack/Stripe/GitHub token, a PEM header, a .env or credentials.json — gets a confirmation prompt before anything is sent, every time, not just once.

charge.ts

async function chargeCard(token: string, amount: number) {

logger.info(`charging ${token} for ${amount}`);

}

Card token logged in plain text

Security · critical · 96% confidence

Sensitive payment data is written to application logs on every charge attempt — mask it before logging.

$(shield) audit/bench: do not ship$(wand) Fix All Issues with AI

Fix All Issues with AI

The backend's AI-fix endpoints are scoped to a repo scan, the same way the web app's fix-in-editor flow works. Rather than needing a separate backend path for a single open file, the extension zips just that one file and uploads it through the same repo-scan endpoint the CLI's auditbench scan uses — a one-file "repo." One click: zip → upload → scan → bulk AI fix → apply to the editor → re-check the result.

That's up to three AI calls in one action — notably more than a single file audit — so it only ever runs when you click it, never automatically, and it requires your plan to include repository scanning. The summary afterward is specific about what actually happened: whether the original findings are confirmed gone, or a fresh full re-check surfaced something different — not a vague "issues remain."

Get it

Not yet on the VS Code Marketplace — build it from source for now, same as the CLI before its first release.

build & install

git clone https://github.com/noumanas/audit-bench-vscode-extenstion.git
cd audit-bench-vscode-extenstion
npm install
npm run compile
npm run package
code --install-extension auditbench-vscode-0.1.0.vsix

Then run audit/bench: Set API Keyfrom the Command Palette (Dashboard → Integrations → "CLI / CI-CD API key") and you're set.

Settings

auditbench.apiUrl

API base URL — override for local backend testing.

auditbench.provider

Force a specific LLM provider: anthropic, openai, or gemini.

auditbench.auditOnSave

Automatically audit a file every time you save it. Off by default.

auditbench.warnAboveChars

Confirm before auditing a file over this many characters (20,000 default).

Review code without leaving the editor

Free plan includes single-file audits from the extension — sign up, generate an API key, and you're auditing in a couple of minutes.

Get started free See the CLI