Getting started

Install the extension

The fastest way to install is from inside the editor: open the Extensions view (Ctrl+Shift+X / Cmd+Shift+X), search for Mondoo Security (publisher: Mondoo), and click Install.

You can also install from a marketplace:

• VS Code: Visual Studio Marketplace
• VSCodium, Cursor, Windsurf, and other VS Code forks: Open VSX

When you first open a workspace, VS Code may ask you to trust it. The extension only activates in trusted workspaces because it executes the cnspec and xgrep binaries against your files.

Take the tour

The fastest way in is the built-in walkthroughs, one per pillar. On first install the extension offers a short tour; reopen any of them from the Command Palette (Ctrl+Shift+P / Cmd+Shift+P) or the matching status-bar menu:

• Mondoo Code Security: Get Started opens a deliberately vulnerable demo file so you see real code findings in about two minutes, along with how to fix, dismiss, and explain them.
• Mondoo Infrastructure Security: Get Started with cnspec sets cnspec up and walks through running a policy against your own machine and authoring your first one.
• Mondoo Tools: Get Started with Bills of Materials covers generating an SBOM or AIBOM for your project.

Find your first code issue (no setup)

Code scanning works the moment the extension is installed: the xgrep scanner sets itself up automatically. It installs the official @mondoohq/xgrep npm package into the extension's own storage, shows you a progress notification while it does, and is removed again when you uninstall the extension.

Open any file in a supported language and security issues and leaked secrets appear in the Problems panel (Ctrl+Shift+M / Cmd+Shift+M) and as squiggles in the editor as you type. The shield icon in the status bar shows the scanner state and how many findings exist across your workspace.

To check the whole project rather than just open files, run Mondoo Code Security: Scan Workspace from the Command Palette (Ctrl+Shift+P / Cmd+Shift+P). From here, the code security guide shows you how to fix findings in one click, dismiss the ones that don't apply, and keep generated code out of your results.

If you prefer to manage the scanner binary yourself, install it with npm install -g @mondoohq/xgrep or set mondoo.xgrepPath, and turn off mondoo.xgrepAutoInstall.

Check your infrastructure

Infrastructure checks run through cnspec. The extension looks for it at the configured path (mondoo.cnspecPath, empty by default) and on your PATH; if it is missing, you get installation guidance for your platform when the extension activates.

To install manually:

# macOS
brew install cnspec

# Linux and macOS (installer script)
bash -c "$(curl -sSL https://install.mondoo.com/sh)"

See the cnspec installation documentation for Windows and package-manager options. After installing to a custom location, point mondoo.cnspecPath at the binary.

Then run your first check:

1. Open a folder containing .mql.yaml policy files, or create one.
2. Open the Mondoo view in the Activity Bar. The policy explorer lists every policy and query found in the workspace.
3. Click Run Query above any query in the editor (CodeLens), or use the run action on a policy in the explorer. Results open in the integrated terminal.

By default checks run against your local system. To assess the systems you actually operate, such as SSH hosts, Docker containers, cloud accounts, and Kubernetes clusters, add a target configuration. See Scan targets.

Next steps

• Code security: fix, dismiss, and tune code findings
• Infrastructure security: policies, scan targets, and the policy development workflow
• Bill of materials: inventory dependencies, asset packages, and AI models
• Settings reference