Skip to main content

​
Installation

Install VulnZap globally: 
npm install -g vulnzap

​
Quick Start

Complete onboarding with API key setup and IDE integration: 
vulnzap init
This command will:
  • Guide you through API key setup
  • Automatically detect installed IDEs (VS Code, Cursor, Windsurf)
  • Allow you to select multiple IDEs for integration
  • Configure MCP settings and install extensions
  • Set up your development environment for secure coding

​
2. Manual Setup (Alternative)

# Setup API key only
vulnzap setup -k <your-api-key>

# Setup API key with specific IDE (cursor|windsurf|cline|vscode)
vulnzap setup -k <your-api-key> --ide cursor

​
Commands Reference

​
Authentication and Configuration

​
vulnzap init

Complete onboarding workflow with interactive setup. 
vulnzap init
Features:
  • Magic authentication flow with QR code support
  • Automatic IDE detection (VS Code, Cursor, Windsurf, JetBrains)
  • Multi-IDE configuration support
  • MCP server setup for compatible IDEs

​
vulnzap setup

Manual authentication and IDE configuration. 
vulnzap setup -k <api-key>
vulnzap setup -k <api-key> --ide <cursor|windsurf|cline|vscode>
Options:
  • -k, --key <key>: API key for authentication
  • --ide <ide-name>: Target IDE for integration

​
vulnzap account

Display account information and usage statistics. 
vulnzap account
Displays:
  • User profile information
  • Current subscription tier
  • API usage metrics
  • Remaining scan quota

​
vulnzap status

System health check and configuration verification. 
vulnzap status
Validates:
  • Server connectivity
  • Authentication status
  • User profile data
  • System configuration

​
Security Scanning

​
vulnzap check

Analyze individual packages for vulnerabilities. 
# Recommended format
vulnzap check <ecosystem:package@version>
vulnzap check npm:express@4.17.1
vulnzap check pip:requests@2.25.1

# Alternative format
vulnzap check <package@version> --ecosystem <ecosystem>
vulnzap check express@4.17.1 --ecosystem npm
Supported ecosystems: npm, pip, go, rust, maven, gradle, composer, nuget, pypi

​
vulnzap batch-scan

Scan all dependencies in the current project directory. 
vulnzap batch-scan
vulnzap batch-scan --ecosystem npm
vulnzap batch-scan --output results.json
Options:
  • --ecosystem <ecosystem>: Filter by specific package ecosystem
  • --output <file>: Save results to JSON file (default: .vulnzap/batch-scan-results.json)
Automatically detects and parses:
  • package.json (npm)
  • requirements.txt (pip)
  • go.mod (go)
  • Cargo.toml (rust)
  • pom.xml (maven)
  • build.gradle (gradle)
  • composer.json (composer)
  • *.csproj (nuget)

​
vulnzap scan

Initiate repository-wide vulnerability scan for GitHub repositories. 
vulnzap scan <repository-url>
vulnzap scan https://github.com/owner/repo --branch main
vulnzap scan https://github.com/owner/repo --wait --output scan-results.json
Options:
  • -b, --branch <branch>: Target branch (default: main)
  • --wait: Block until scan completion
  • -o, --output <file>: Save results to JSON file
  • --key <api-key>: Override default API key
Returns:
  • Job ID for tracking
  • Project ID for dashboard access
  • Real-time scan progress (with --wait)
  • Remaining line quota

​
vulnzap watch

Monitor directory for file changes and perform incremental security analysis. 
vulnzap watch
vulnzap watch --timeout 120000
vulnzap watch --output ./scan-results
Options:
  • -t, --timeout <ms>: Session timeout in milliseconds (default: 120000)
  • -o, --output <dir>: Output directory for results (default: .vulnzap/incremental)
Features:
  • Real-time file change detection
  • Incremental vulnerability scanning
  • Session-based result tracking
  • Automatic timeout handling
  • Manual stop with Ctrl+C

​
IDE Integration

​
vulnzap connect

Configure MCP integration for supported IDEs. 
vulnzap connect
vulnzap connect --ide cursor
vulnzap connect --ide windsurf
Supported IDEs:
  • cursor: Cursor IDE
  • windsurf: Windsurf IDE
  • antigravity: Antigravity IDE
  • claude: Claude Code
  • cline: Cline (VS Code extension)
  • vscode: VS Code (extension only)
  • jetbrains: JetBrains IDEs (IntelliJ, WebStorm, etc.)
Configuration locations:
  • Cursor: .cursor/mcp.json
  • Windsurf: .codeium/windsurf/mcp_config.json
  • Cline: Platform-specific MCP settings

​
vulnzap mcp

Start the MCP server for IDE integration. 
vulnzap mcp
Environment variables:
  • VULNZAP_API_KEY: API key for authentication
  • VULNZAP_DEBUG: Enable verbose logging
This command is typically invoked automatically by IDE MCP configurations.

​
Utility Commands

​
vulnzap tools

Display interactive guide to available MCP tools. 
vulnzap tools

​
vulnzap help

Display comprehensive help information. 
vulnzap help

​
Supported IDEs

VulnZap integrates with the following IDEs:

Cursor

Full MCP integration + extension

Windsurf

Full MCP integration + extension

Cline

MCP integration supported

VS Code

Extension only (no MCP server)

​
Automatic IDE Detection

The init command automatically detects which supported IDEs are installed on your system (VS Code, Cursor, Windsurf) and allows you to select multiple IDEs for integration.

​
Getting Help

For issues or questions:

Documentation

Complete documentation

Support

Contact support team