VS Code Extension

Scan your lockfiles and SBOMs for known CVEs from inside VS Code, with exploitation intelligence, diagnostics and CVE hovers, powered by vuln.mlab.sh.

The mlab security extension scans your lockfiles for known CVEs from inside VS Code, powered by vuln.mlab.sh. Parsing and vulnerability resolution happen server-side: the extension uploads only the lockfile and shows the result. No local database, no heavy dependencies.

It runs in any editor that loads VS Code extensions (API 1.85+): VS Code, Codespaces, Remote and Tunnels from the Visual Studio Marketplace; VSCodium, Cursor, Windsurf, code-server, Gitpod, Theia and others from Open VSX; and in the browser on vscode.dev and github.dev.

Consent first, then automatic. Nothing is uploaded until you agree once, and the extension makes no network call when it activates. After that, mlab.autoScan (on by default) rescans a lockfile when its content changes. Results are cached per file content, so an unchanged lockfile is never re-uploaded, and writes are debounced, so an npm install costs one scan. Set mlab.autoScan to false for fully manual scans.

How to scan

Right-click a lockfile in the Explorer, or inside the editor, and choose Check for lock vulnerabilities. The entry only appears on recognized lockfiles.

Command Palette: mlab: Check for lock vulnerabilities, mlab: Scan all lockfiles in workspace, mlab: Clear results, mlab: Set API token, mlab: Manage API token & quota, mlab: Open mlab.

The Rescan button in the findings view rescans every lockfile in it, one at a time.

See vuln report reopens the last result for a lockfile straight from the cache: no network call, no scan spent.

What you get

A report panel beside the lockfile: a per-severity summary, then one row per finding with the package, the CVE (linking to its vuln.mlab.sh page), the version that fixes it and a short summary. The report also says what was not scanned: a manifest cut at your tier's limit, entries the server could not read (git or path dependency, unpinned version), packages left unchecked during an outage.
Exploitation intelligence on every finding: EPSS, and whether the CVE is in the CISA or EU known-exploited catalogues. The report sorts by that, not by CVSS band alone.
Diagnostics in the Problems panel, anchored on the line that declares the package (for a Maven pom.xml, the artifactId line). mlab.severityFloor decides what reads as an Error, a Warning or Information.
Explorer colors: vulnerable lockfiles are tinted by their worst severity, with a badge.
An mlab view in the Activity Bar: findings grouped lockfile, severity, advisory; and a status bar item with the finding count.
CVE hover: hover any CVE-YYYY-NNNN in any file for its CVSS, EPSS, known-exploited status, risk score and weaknesses.
Analyze selection: select a URL, IP, email, file hash, MAC address or domain and look it up on mlab.sh. The type is worked out locally and only the value is sent.

Supported lockfiles

Cargo.lock, package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, composer.lock, Gemfile.lock, go.sum, requirements.txt, poetry.lock, uv.lock, pdm.lock, Pipfile.lock, pom.xml, gradle.lockfile, packages.lock.json, pubspec.lock, mix.lock, mise.lock, and CycloneDX SBOMs named bom.json or bom.xml (a component without a purl is matched by its CPE).

Scan all lockfiles in workspace skips node_modules, vendor, target, dist, .git and, by default, git-ignored files. It tells you how many files need a fresh scan before uploading anything, scans them one at a time and waits out the server's cooldown in between.

API token and limits

	Packages per scan	Request size	Cooldown between scans
Anonymous (per IP)	512	4 MiB	10 s
Free account, with a token	1024	8 MiB	5 s
Paid plan, with a token	4096	32 MiB	none

Generate a token at vuln.mlab.sh/me/tokens.

Run mlab: Manage API token & quota (or mlab: Set API token) and paste it.

The token is stored only in VS Code SecretStorage, never in settings or on disk in plaintext, and attaches your scans to your history on vuln.mlab.sh. Background, batch and Rescan runs wait out a cooldown (HTTP 429) and retry once; an explicit scan shows the server's message, which says how long to wait and what the next tier unlocks.

Settings

Settings resolve through layers, highest priority first: <workspace>/.mlab/vuln.yml, <workspace>/.mlab/config.json (commit it to share a configuration), ~/.mlab/config.json, VS Code settings under mlab.*, then defaults. The mlab page (mlab: Open mlab) shows where each value comes from.

`.mlab/vuln.yml`

One file for the editor and for the GitHub Action. mlab: Create .mlab/vuln.yml for this workspace writes a commented template.

# Turn mlab off in this workspace (results are hidden, not deleted).
# disable: true

# Advisories accepted as known risk: hidden everywhere, never failing CI.
ignoreVulns:
  - CVE-2024-0000   # not reachable: only used in tests

Ignored ids are matched against the advisory id and all its aliases, and apply at once, without a rescan.

Setting	Default	Description
`mlab.autoScan`	`true`	Rescan a lockfile when its content changes (after the one-time consent).
`mlab.ignoreGitIgnored`	`true`	Skip git-ignored lockfiles in the workspace sweep and automatic rescans.
`mlab.ignoreVulns`	`[]`	Advisory ids accepted as known risk. Best kept in `.mlab/vuln.yml` with a comment.
`mlab.severityFloor`	`any`	Lowest severity shown as a Warning/Error diagnostic; below it, Information.
`mlab.cveHover`	`true`	CVE hover cards.
`mlab.analyzeSelection`	`true`	The Analyze selection menu entry.
`mlab.apiUrl`	`https://vuln.mlab.sh/api/v2/scan`	Scan endpoint, for a self-hosted instance.
`mlab.platformUrl`	`https://mlab.sh/api/v1`	Platform API, for indicator lookups.
`mlab.timeoutMs`	`30000`	Per-request timeout in milliseconds.

Privacy

Only the lockfile you scan is uploaded to vuln.mlab.sh. Your source code is never sent.
Nothing is uploaded before your one-time consent.
Under Workspace Trust Restricted Mode, scanning is disabled.
CVE hovers send only the identifier; Analyze selection only the selected value.