VS Code / Cursor Extension

Work with Threat Models next to your code in VS Code or Cursor.

DevArmor's VS Code extension (also works in Cursor) brings Threat Models into your editor: sign in, pick a project, and review threats and controls in a sidebar next to your code — with open controls published to the editor's Problems panel.

What it does

• Sign in through the DevArmor web app (OAuth). Tokens are stored in the editor and refreshed automatically.

• Pick a project — choose an existing DevArmor project or create a new one. The current project is shown in the status bar.

• Threat Model sidebar — after a project is selected, the Activity Bar icon opens a Threat Model view with Threats and Controls sections. Threats are sorted by name; controls are grouped by priority (Critical → None).

• Build — prepare a Threat Model (name, documents, repos), create a version, and run a findings scan. Repositories are checked against the API; ones you can't access are marked in the setup UI.

• Load results — pick an existing Threat Model and version from the project and fill the sidebar without running a new build.

• Finding details — click a threat or control to open a detail view. Threat details include event, STRIDE category, sources, target components, frameworks, persona, and associated controls. Both link back to the matching finding in DevArmor.

• Problems panel — controls that aren't done are published as diagnostics under source DevArmor. Severity follows control priority: Critical/High → Error, Medium → Warning, Low/None → Information.

• Status bar — shows the current project and, once a scan has run, the finding count.

One workspace folder keeps at most one active Threat Model + version at a time.

Installation

DevArmor's extension isn't on the public VS Code Marketplace yet — install it from the .vsix file DevArmor provides:

1. Get the current .vsix build from your DevArmor contact.

2. In VS Code or Cursor, open the Command Palette and run Extensions: Install from VSIX..., then select the file.

3. Reload the editor if prompted.

Using the extension

1. Open the DevArmor view — click the DevArmor icon in the Activity Bar, or run View: Show DevArmor from the Command Palette.

2. Sign in — if you're not signed in, the view shows Sign in to DevArmor, which opens the DevArmor app in your browser; sign-in completes there and returns to the editor automatically. You can also run DevArmor: Sign In.

3. Pick a project — after signing in, choose an existing project or create a new one (DevArmor: Open a Project, the sidebar button, or the status bar item). You can't change projects while a build is running.

4. Get findings into the sidebar:

   • Run Threat Model (the + button) opens the setup view. Create a new Threat Model, or a new minor version of an existing one — attach documents and select workspace git repositories, then DevArmor runs architecture, findings, and action-item generation. Threats and controls land in the sidebar once findings complete.

   • Open Threat Model lists Threat Models in the project; choosing a version loads its threats and controls into the sidebar without running a new build.

5. Review findings — expand Threats or Controls in the sidebar, or click a matching entry in the Problems panel, to open its detail view.

6. Sign out — DevArmor: Sign Out clears stored tokens.

Commands

Open the Command Palette (Cmd+Shift+P / Ctrl+Shift+P) and type DevArmor:

Command	What it does
DevArmor: Sign In	Starts browser sign-in if you're not already authenticated.
DevArmor: Sign Out	Clears stored auth tokens.
DevArmor: Open a Project	Opens the project picker (create or select). Disabled while a build is running.
DevArmor: Run Threat Model	Opens the Threat Model setup view (new model or new minor version), then runs the findings build.
DevArmor: Open Threat Model	Picks a Threat Model version from the project and fills the sidebar.
DevArmor: Show Output Logs	Opens the DevArmor Output channel (API calls, auth, builds) — useful for troubleshooting.

Settings

Open Settings and search for DevArmor.

Setting	Default	Description
devarmor.logLevel	info	Verbosity of the DevArmor Output channel. debug includes request start lines; warn/error show only higher-severity events.