xgrep in JetBrains IDEs

In IntelliJ IDEA and the other JetBrains IDEs there is nothing to wire up: install the Mondoo plugin from the JetBrains Marketplace and it finds or downloads xgrep and manages the Language Server for you — no LSP client to register, no command to configure.

Scanning runs on your machine. No account is needed and your code is not uploaded. Connecting to Mondoo Platform is optional, and only used if you publish a policy to a space.

Requirements

An IntelliJ-based IDE 2026.1.4 or newer (build 261.26222). There is no upper bound: the plugin declares no maximum build, and each release is checked against the current EAP so a platform change is caught before that version ships.

Supported IDEs

The plugin declares no product-specific dependencies, so it installs across the whole IntelliJ platform family:

IntelliJ IDEA (Ultimate and Community), GoLand, PyCharm (Professional and Community), WebStorm, PhpStorm, RubyMine, CLion, Rider, RustRover, DataGrip, DataSpell, MPS, and Android Studio.

Scanning is language-agnostic — xgrep parses the file, not the IDE — so a Python finding appears in CLion and a Go finding appears in PyCharm, whether or not that IDE ships a language plugin for it.

Found a problem in any IntelliJ IDE? It is worth reporting.

The Marketplace also lists JetBrains Client, Gateway, and Code With Me guest as compatible. Those are thin clients for remote development rather than IDEs in their own right; the plugin runs on the host side.

Features that depend on the IDE

Two capabilities are declared as optional dependencies, so the plugin loads and the rest keeps working when they are absent:

• Live diagnostics as you type need the platform's LSP client (com.intellij.modules.lsp), which is present in every IDE at 2026.1.4 and newer — this is why that is the minimum. Without it, findings still arrive from explicit scans.
• Open cnspec Shell needs the bundled Terminal plugin. If it has been disabled, the action is unavailable and everything else is unaffected.

Setup

1. Open Settings | Plugins | Marketplace, search for Mondoo, and click Install. Restart the IDE.
2. Open a project and open any source file. If the xgrep binary is not already on your machine, the plugin offers to download it. Nothing is fetched until you accept; the download is verified against its published SHA-256 before use.

To see it working right away, run Tools | Mondoo Code Security | Open Demo File. The demo file produces a hardcoded-credential finding on first run.

If the status bar shows xgrep: set up, the scanner could not be located — click it to choose a binary or start the download.

What you get

• Findings as you type — highlighted in the editor, grouped by severity and rule in the Mondoo tool window, and counted in the status bar. Severity and quickfix behavior match the IDE overview.
• One-click fixes — apply a rule's fix, or dismiss a false positive with a nogrep suppression (optionally with a reason) that CI honors too.
• Scans before you commit — Scan Workspace covers every file in the project; Scan Changed Files (Fast) covers only what git reports as new or modified.
• Dependency reachability — the Dependencies tab of the Mondoo tool window shows which vulnerable packages your code actually imports, so you triage what runs first. See reachability.
• Bills of materials — software, cryptography, and AI inventories (SBOM, CBOM, AIBOM) generated from the project.
• Policy authoring — completion, hover, diagnostics, linting, and formatting for Mondoo policy bundles written in MQL, and running them against your machine, an SSH host, Docker, or Kubernetes.

Settings

Under Settings | Tools | Mondoo you can:

• point the plugin at a specific xgrep binary, or turn off the download offer,
• run a custom rule pack instead of the built-in rules (Custom rules path), and
• exclude generated or vendored paths from scanning (Scan scope).

Manual LSP setup

If you prefer to manage the Language Server yourself — for example to run an unreleased xgrep build — the LSP4IJ route described under other editors still works. For everyday use the Mondoo plugin is the recommended path.

Source and issues

The plugin is open source under Apache 2.0: mondoohq/mondoo-intellij-plugin. File bugs and feature requests in its issue tracker.