Problem

Developers want security feedback while writing code, not after pushing to CI. Inkog currently works in VSCode through the MCP server integration with GitHub Copilot, but this requires Copilot and manual invocation. A native VSCode extension would provide real-time inline diagnostics, problems panel integration, and gutter icons — the same experience developers expect from ESLint or Pylint, but for AI agent security.

Current Behavior

• ✅ MCP server (@inkog-io/mcp on npm) works with Claude Desktop and GitHub Copilot in VSCode
• ✅ CLI can be run manually from the terminal
• ❌ No native VSCode extension
• ❌ No inline diagnostics or problems panel integration
• ❌ No real-time scanning on file save

Proposed Solution

Build a native VSCode extension that wraps the Inkog CLI:

Core features

1. Diagnostics provider — Run inkog -output json on file save, parse findings, display as inline squiggles (red=CRITICAL, orange=HIGH, yellow=MEDIUM)
2. Problems panel — Register findings with VSCode's diagnostic collection for the standard problems view
3. Code actions — Quick-fix suggestions based on finding remediation text
4. Status bar — Show scan status and finding count in the status bar
5. Configuration — Settings for policy preset, severity threshold, scan-on-save toggle

Architecture

VSCode Extension (TypeScript)
  ├── Calls: inkog CLI binary (must be installed)
  ├── Parses: JSON output from -output json
  ├── Provides: DiagnosticCollection, CodeActionProvider
  └── Config: extension settings → CLI flags

Extension settings

{
  "inkog.policy": "balanced",
  "inkog.severity": "MEDIUM",
  "inkog.scanOnSave": true,
  "inkog.cliPath": "inkog"
}

References

• VSCode Extension API — Diagnostics
• Semgrep VSCode extension — prior art
• Snyk VSCode extension — prior art
• Existing MCP integration: @inkog-io/mcp on npm

Notes

• The extension should wrap the CLI binary, not embed detection logic (maintaining the dumb-client pattern)
• JSON output already includes file, line, severity, description, remediation — everything needed for diagnostics
• Consider workspace-level caching to avoid re-scanning unchanged files
• The MCP server integration should remain as a complementary option for Copilot Chat users
• This could live in a new inkog-vscode/ directory in the monorepo or a separate repository