> ## Documentation Index
> Fetch the complete documentation index at: https://aspex.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# VS Code and Cursor

> aspex scan findings as editor diagnostics, plus the SARIF viewer and pre-commit hook routes that work today.

There are three ways to get Aspex findings into your editor. The first is an extension that lives in the main repository and is not yet on the Marketplace; the other two need nothing but the CLI.

## The extension (build from source)

`extensions/vscode-aspex/` in the [aspex repository](https://github.com/aspex-security/aspex/tree/main/extensions/vscode-aspex) is a small extension that runs `aspex scan --json` and shows findings in the Problems panel. It works in VS Code, Cursor, Windsurf, and other VS Code-based editors.

What it does:

* **Scan on save**: when you save an MCP config file, it runs `aspex scan` and refreshes diagnostics.
* **Problems panel**: each finding becomes a diagnostic with its severity and rule ID.
* **Two commands** in the palette (`Cmd+Shift+P`): `Aspex: Scan MCP Configuration` and `Aspex: Scan All MCP Configurations`.

| Setting             | Default      | Description                                                |
| ------------------- | ------------ | ---------------------------------------------------------- |
| `aspex.binaryPath`  | `aspex scan` | Path to the binary if it is not on your `PATH`             |
| `aspex.scanOnSave`  | `true`       | Re-scan when an MCP config file is saved                   |
| `aspex.minSeverity` | `medium`     | Lowest severity shown: `critical`, `high`, `medium`, `low` |

Build and install:

```sh theme={"dark"}
brew install aspex-security/tap/aspex      # the extension shells out to aspex scan
git clone https://github.com/aspex-security/aspex
cd aspex/extensions/vscode-aspex
npm install && npm run compile
npx @vscode/vsce package                   # produces vscode-aspex-0.1.0.vsix
code --install-extension vscode-aspex-0.1.0.vsix
```

For Cursor, use `cursor --install-extension` with the same file.

<Note>
  The extension is deliberately thin: it does not add quick fixes or a report view. `aspex scan --explain` and `aspex scan --html` in the terminal remain the richest way to read a finding.
</Note>

## SARIF in the editor

`aspex scan` writes SARIF 2.1.0, and the [SARIF Viewer](https://marketplace.visualstudio.com/items?itemName=MS-SarifVSCode.sarif-viewer) extension renders it with inline annotations:

```sh theme={"dark"}
aspex scan --sarif-output aspex.sarif
```

Open `aspex.sarif` in VS Code. This route needs no Aspex-specific extension and is the same file the [CI integration](/guides/ci-integration) uploads to GitHub code scanning.

## Pre-commit hook

```sh theme={"dark"}
aspex scan install-hook
```

Installs a Git hook that runs `aspex-scan --no-exec --fail-on high` before each commit and blocks the commit on a HIGH or CRITICAL finding. The hook reads your `.aspex.yaml`, so accepted risks and severity overrides apply. `aspex scan uninstall-hook` removes it; `git commit --no-verify` bypasses it once.