VS Code and Cursor

There are three ways to get Aspex findings into your editor. The first is an extension that lives in the main repository and is not yet on the Marketplace; the other two need nothing but the CLI.

The extension (build from source)

extensions/vscode-aspex/ in the aspex repository is a small extension that runs aspex scan --json and shows findings in the Problems panel. It works in VS Code, Cursor, Windsurf, and other VS Code-based editors. What it does:

Scan on save: when you save an MCP config file, it runs aspex scan and refreshes diagnostics.
Problems panel: each finding becomes a diagnostic with its severity and rule ID.
Two commands in the palette (Cmd+Shift+P): Aspex: Scan MCP Configuration and Aspex: Scan All MCP Configurations.

Setting	Default	Description
`aspex.binaryPath`	`aspex scan`	Path to the binary if it is not on your `PATH`
`aspex.scanOnSave`	`true`	Re-scan when an MCP config file is saved
`aspex.minSeverity`	`medium`	Lowest severity shown: `critical`, `high`, `medium`, `low`

Build and install:

brew install aspex-security/tap/aspex      # the extension shells out to aspex scan
git clone https://github.com/aspex-security/aspex
cd aspex/extensions/vscode-aspex
npm install && npm run compile
npx @vscode/vsce package                   # produces vscode-aspex-0.1.0.vsix
code --install-extension vscode-aspex-0.1.0.vsix

For Cursor, use cursor --install-extension with the same file.

The extension is deliberately thin: it does not add quick fixes or a report view. aspex scan --explain and aspex scan --html in the terminal remain the richest way to read a finding.

SARIF in the editor

aspex scan writes SARIF 2.1.0, and the SARIF Viewer extension renders it with inline annotations:

aspex scan --sarif-output aspex.sarif

Open aspex.sarif in VS Code. This route needs no Aspex-specific extension and is the same file the CI integration uploads to GitHub code scanning.

Pre-commit hook

aspex scan install-hook

Installs a Git hook that runs aspex-scan --no-exec --fail-on high before each commit and blocks the commit on a HIGH or CRITICAL finding. The hook reads your .aspex.yaml, so accepted risks and severity overrides apply. aspex scan uninstall-hook removes it; git commit --no-verify bypasses it once.

Start

Concepts

Commands

Guides

Reference

VS Code and Cursor

The extension (build from source)

SARIF in the editor

Pre-commit hook

​The extension (build from source)

​SARIF in the editor

​Pre-commit hook

The extension (build from source)

SARIF in the editor

Pre-commit hook