> For the complete documentation index, see [llms.txt](https://docs.devarmor.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devarmor.com/modules/threat-modeler/vs-code-extension.md).

# VS Code / Cursor Extension

Work with Threat Models next to your code in VS Code or Cursor.

DevArmor's VS Code extension (also works in Cursor) brings Threat Models into your editor: sign in, pick a project, and review threats and controls in a sidebar next to your code — with open controls published to the editor's Problems panel.

### What it does

* **Sign in** through the DevArmor web app (OAuth). Tokens are stored in the editor and refreshed automatically.
* **Pick a project** — choose an existing DevArmor project or create a new one. The current project is shown in the status bar.
* **Threat Model sidebar** — after a project is selected, the Activity Bar icon opens a Threat Model view with **Threats** and **Controls** sections. Threats are sorted by name; controls are grouped by priority (Critical → None).
* **Build** — prepare a Threat Model (name, documents, repos), create a version, and run a findings scan. Repositories are checked against the API; ones you can't access are marked in the setup UI.
* **Load results** — pick an existing Threat Model and version from the project and fill the sidebar without running a new build.
* **Finding details** — click a threat or control to open a detail view. Threat details include event, STRIDE category, sources, target components, frameworks, persona, and associated controls. Both link back to the matching finding in DevArmor.
* **Problems panel** — controls that aren't done are published as diagnostics under source `DevArmor`. Severity follows control priority: Critical/High → Error, Medium → Warning, Low/None → Information.
* **Status bar** — shows the current project and, once a scan has run, the finding count.

One workspace folder keeps at most one active Threat Model + version at a time.

### Installation

DevArmor's extension isn't on the public VS Code Marketplace yet — install it from the `.vsix` file DevArmor provides:

1. Get the current `.vsix` build from your DevArmor contact.
2. In VS Code or Cursor, open the Command Palette and run **Extensions: Install from VSIX...**, then select the file.
3. Reload the editor if prompted.

### Using the extension

1. **Open the DevArmor view** — click the DevArmor icon in the Activity Bar, or run **View: Show DevArmor** from the Command Palette.
2. **Sign in** — if you're not signed in, the view shows **Sign in to DevArmor**, which opens the DevArmor app in your browser; sign-in completes there and returns to the editor automatically. You can also run **DevArmor: Sign In**.
3. **Pick a project** — after signing in, choose an existing project or create a new one (**DevArmor: Open a Project**, the sidebar button, or the status bar item). You can't change projects while a build is running.
4. **Get findings into the sidebar**:
   * **Run Threat Model** (the **+** button) opens the setup view. Create a new Threat Model, or a new minor version of an existing one — attach documents and select workspace git repositories, then DevArmor runs architecture, findings, and action-item generation. Threats and controls land in the sidebar once findings complete.
   * **Open Threat Model** lists Threat Models in the project; choosing a version loads its threats and controls into the sidebar without running a new build.
5. **Review findings** — expand **Threats** or **Controls** in the sidebar, or click a matching entry in the Problems panel, to open its detail view.
6. **Sign out** — **DevArmor: Sign Out** clears stored tokens.

### Commands

Open the Command Palette (`Cmd+Shift+P` / `Ctrl+Shift+P`) and type `DevArmor`:

| Command                         | What it does                                                                                      |
| ------------------------------- | ------------------------------------------------------------------------------------------------- |
| **DevArmor: Sign In**           | Starts browser sign-in if you're not already authenticated.                                       |
| **DevArmor: Sign Out**          | Clears stored auth tokens.                                                                        |
| **DevArmor: Open a Project**    | Opens the project picker (create or select). Disabled while a build is running.                   |
| **DevArmor: Run Threat Model**  | Opens the Threat Model setup view (new model or new minor version), then runs the findings build. |
| **DevArmor: Open Threat Model** | Picks a Threat Model version from the project and fills the sidebar.                              |
| **DevArmor: Show Output Logs**  | Opens the DevArmor Output channel (API calls, auth, builds) — useful for troubleshooting.         |

### Settings

Open **Settings** and search for `DevArmor`.

| Setting             | Default | Description                                                                                                                      |
| ------------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------- |
| `devarmor.logLevel` | `info`  | Verbosity of the DevArmor Output channel. `debug` includes request start lines; `warn`/`error` show only higher-severity events. |